userbot/traefik/dynamic/dynamic.yml

http:
  routers:
    # Traefik Dashboard (ADMIN, local only)
    traefik-dashboard:
      rule: "Host(`traefik.workstation`)"
      entryPoints:
        - websecure
      service: api@internal
      middlewares:
        # - auth
        - security-headers
      tls: {}

    # Nextcloud AIO Interface (ADMIN, local is better)
    nextcloud-aio:
      rule: "Host(`nextcloud-aio.workstation`)"
      entryPoints:
        - websecure
      service: nextcloud-aio
      middlewares:
        - security-headers
      tls: {}

    # Portainer (public (account required))
    portainer:
      rule: "Host(`portainer.forust.xyz`)"
      entryPoints:
        - websecure
      service: portainer
      middlewares:
        - security-headers
      tls: {}

    # AdGuard Home (public (account required))
    adguard:
      rule: "Host(`adguard.forust.xyz`)"
      entryPoints:
        - websecure
      service: adguard
      middlewares:
        - security-headers
      tls: {}


    # Nextcloud Main (public (account required))
    nextcloud:
      rule: "Host(`nextcloud.forust.xyz`)"
      entrypoints:
        - websecure
      service: nextcloud
      middlewares:
        - nextcloud-chain
      tls: {}

    # Dockmon (public (account required))
    dockmon:
      rule: "Host(`dockmon.forust.xyz`)"
      entryPoints:
        - websecure
      service: dockmon
      middlewares:
        # - dockmon-auth
        - security-headers
      tls: {}

    # Gitea (public (account required))
    gitea:
      rule: "Host(`gitea.forust.xyz`)"
      entryPoints:
        - websecure
      service: gitea
      middlewares:
        - security-headers
      tls: {}

    # Gitea SSH
    gitea-ssh:
      rule: "HostSNI(`*`)"
      entryPoints:
        - ssh
      service: gitea-ssh
      tls: {}

    # Glance (local only)
    glance:
      rule: "Host(`glance.workstation`)"
      entryPoints:
        - websecure
      service: glance
      middlewares:
        - security-headers
      tls: {}

    # Watercrawl (local only)
    watercrawl:
      rule: "Host(`watercrawl.workstation`)"
      entryPoints:
        - websecure
      service: watercrawl
      middlewares:
        - security-headers
      tls: {}

    # N8N (local only)
    n8n:
      rule: "Host(`n8n.workstation`)"
      entryPoints:
        - websecure
      service: n8n
      middlewares:
        - security-headers
      tls: {}


  services:
    # Portainer
    portainer:
      loadBalancer:
        servers:
          - url: "https://portainer:9443"
        serversTransport: insecureTransport

    # AdGuard Home
    adguard:
      loadBalancer:
        servers:
          - url: "http://adguardhome:3000"

    # Nextcloud AIO Interface
    nextcloud-aio:
      loadBalancer:
        servers:
          - url: "https://nextcloud-aio-mastercontainer:8080"
        serversTransport: insecureTransport

    # Nextcloud Main
    nextcloud:
      loadBalancer:
        servers:
          - url: "http://nextcloud-aio-apache:11000"

    # Dockmon
    dockmon:
      loadBalancer:
        servers:
          - url: "https://dockmon:443"
        serversTransport: insecureTransport

    # Glance
    glance:
      loadBalancer:
        servers:
          - url: "http://glance:8080"

    # Watercrawl
    watercrawl:
      loadBalancer:
        servers:
          - url: "http://nginx:80"

    # N8N
    n8n:
      loadBalancer:
        servers:
          - url: "http://n8n:5678"
    
    # Gitea
    gitea:
      loadBalancer:
        servers:
          - url: "http://gitea:3000"

    # Gitea SSH
    gitea-ssh:
      loadBalancer:
        servers:
          - url: "ssh://gitea:22"


  serversTransports:
    insecureTransport:
      insecureSkipVerify: true

  middlewares:
    # HTTPS Redirect
    redirect-https:
      redirectScheme:
        scheme: https
        permanent: true

    # Basic Auth Traefik Dashboard
    auth:
      basicAuth:
        users:
          - "admin:$$apr1$$57E60OUM$$JoYwmLr/uZKaTy6U4IQd9."
        realm: "Traefik Dashboard"

    # Basic Auth Dockmon
    dockmon-auth:
      basicAuth:
        users:
          - "admin:$$apr1$$.bCpmIHl$$dxPEKdw5aZLAwo8wUz52b1"
        realm: "Dockmon Access"
    
    # Cloudflare IP Whitelist
    cloudflare-ipwhitelist:
      ipWhiteList:
        sourceRange:
          - "173.245.48.0/20"
          - "103.21.244.0/22"
          - "103.22.200.0/22"
          - "103.31.4.0/22"
          - "141.101.64.0/18"
          - "108.162.192.0/18"
          - "190.93.240.0/20"
          - "188.114.96.0/20"
          - "197.234.240.0/22"
          - "198.41.128.0/17"
          - "162.158.0.0/15"
          - "104.16.0.0/13"
          - "104.24.0.0/14"
          - "172.64.0.0/13"
          - "131.0.72.0/22"

    # Security Headers
    security-headers:
      headers:
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
        customFrameOptionsValue: "SAMEORIGIN"
        customResponseHeaders:
          X-Content-Type-Options: "nosniff"
          Referrer-Policy: "strict-origin-when-cross-origin"

    # Nextcloud specific headers
    nextcloud-secure-headers:
      headers:
        hostsProxyHeaders:
          - "X-Forwarded-Host"
          - "X-Forwarded-Proto"
        referrerPolicy: "same-origin"
        customFrameOptionsValue: "SAMEORIGIN"

    # Rate limiting
    rate-limit:
      rateLimit:
        average: 100
        burst: 50
        period: 1m

    # Nextcloud chain
    nextcloud-chain:
      chain:
        middlewares:
          - nextcloud-secure-headers
          - security-headers

# TLS Configuration
tls:
  certificates:
    # Cloudflare Origin CA *.forust.xyz
    - certFile: /certs/cloudflare.pem
      keyFile: /certs/cloudflare.key
    # Local certificate
    - certFile: /certs/workstation+1.pem
      keyFile: /certs/workstation+1-key.pem
  
  stores:
    default:
      defaultCertificate:
        # Fallback local certificate
        certFile: /certs/workstation+1.pem
        keyFile: /certs/workstation+1-key.pem
  
  options:
    default:
      minVersion: VersionTLS12
      sniStrict: true
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305