http:
  routers:
    # Traefik Dashboard (ADMIN, without subdomeain)
    traefik-dashboard:
      rule: "Host(`traefik.forust.xyz`)"
      entryPoints:
        - websecure
      service: api@internal
      middlewares:
        - auth
        - security-headers
      tls: {}

    # Nextcloud AIO Interface (ADMIN, without subdomeain)
    nextcloud-aio:
      rule: "Host(`nextcloud-aio.forust.xyz`)"
      entryPoints:
        - websecure
      service: nextcloud-aio
      middlewares:
        - security-headers
      tls: {}

    # Nextcloud AIO Interface (ADMIN, without subdomeain)
    penpot:
      rule: "Host(`penpot.forust.xyz`)"
      entryPoints:
        - websecure
      service: penpot
      middlewares:
        - security-headers
      tls: {}

    # Termix (public (account required))
    termix:
      rule: "Host(`termix.forust.xyz`)"
      entryPoints:
        - websecure
      service: termix
      middlewares:
        - security-headers
      tls: {}

    # MeTube (public (auth required))
    metube:
      rule: "Host(`metube.forust.xyz`)"
      entryPoints:
        - websecure
      service: metube
      middlewares:
        - metube-auth
        - security-headers
      tls: {}

    # Portainer (public (account required))
    portainer:
      rule: "Host(`portainer.forust.xyz`)"
      entryPoints:
        - websecure
      service: portainer
      middlewares:
        - security-headers
      tls: {}

    # Uptime Kuma (public (account required))
    uptime-kuma:
      rule: "Host(`uptime.forust.xyz`)"
      entryPoints:
        - websecure
      service: uptime-kuma
      tls: {}

    # AdGuard Home (public (account required))
    adguard:
      rule: "Host(`adguard.forust.xyz`)"
      entryPoints:
        - websecure
      service: adguard
      middlewares:
        - security-headers
      tls: {}

    # Nextcloud Main (public (account required))
    nextcloud:
      rule: "Host(`nextcloud.forust.xyz`)"
      entrypoints:
        - websecure
      service: nextcloud
      middlewares:
        - nextcloud-chain
      tls: {}

    # Dockmon (public (account required))
    dockmon:
      rule: "Host(`dockmon.forust.xyz`)"
      entryPoints:
        - websecure
      service: dockmon
      middlewares:
        - security-headers
      tls: {}

    # Gitea (public (account required))
    gitea:
      rule: "Host(`gitea.forust.xyz`)"
      entryPoints:
        - websecure
        - ssh
      service: gitea
      middlewares:
        - security-headers
      tls: {}

    # Glance (public, without subdomain)
    glance:
      rule: "Host(`glance.forust.xyz`)"
      entryPoints:
        - websecure
      service: glance
      middlewares:
        - security-headers
      tls: {}

    # Watercrawl (public, without subdomain)
    watercrawl:
      rule: "Host(`watercrawl.fourst.xyz`)"
      entryPoints:
        - websecure
      service: watercrawl
      middlewares:
        - security-headers
      tls: {}

    # N8N (public, without subdomain)
    n8n:
      rule: "Host(`n8n.forust.xyz`)"
      entryPoints:
        - websecure
      service: n8n
      middlewares:
        - security-headers
      tls: {}

    # Landing Page (public)
    forust-homepage:
      rule: "Host(`forust.xyz`)"
      entryPoints:
        - websecure
      service: forust-homepage
      middlewares:
        - security-headers
      tls: {}