tcp:
  serversTransports:
    pp-v2:
      proxyProtocol:
        version: 2

tls:
  certificates:
    - certFile: /letsencrypt/fullchain.crt
      keyFile: /letsencrypt/privkey.key
    - certFile: /letsencrypt/blog.fullchain.crt
      keyFile: /letsencrypt/blog.privkey.key
    - certFile: /letsencrypt/trmnl.fullchain.crt
      keyFile: /letsencrypt/trmnl.privkey.key
    - certFile: /letsencrypt/sso.fullchain.crt
      keyFile: /letsencrypt/sso.privkey.key
    - certFile: /letsencrypt/media.fullchain.crt
      keyFile: /letsencrypt/media.privkey.key
    - certFile: /letsencrypt/paperless.fullchain.crt
      keyFile: /letsencrypt/paperless.privkey.key

http:
  serversTransports:
    caddy-hubris:
      serverName: mcp.hubris.network
    proxmox:
      serverName: proxmox.hubris.network
      insecureSkipVerify: true

  routers:
    artifacto-public:
      rule: 'Host(`artifacto.hubris.network`) && (PathPrefix(`/p/`) || PathPrefix(`/static/`) || Path(`/healthz`))'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - artifacto-strip-sso
        - artifacto-ratelimit
      service: artifacto-public
    blog-public:
      rule: 'Host(`blog.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - blog-ratelimit
      service: blog-public
    trmnl-public:
      rule: 'Host(`trmnl.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - trmnl-ratelimit
      service: trmnl-public
    matrix-public:
      rule: 'Host(`matrix.hubris.network`) && !PathPrefix(`/.well-known/matrix/`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - matrix-ratelimit
      service: matrix-public
    matrix-wellknown:
      rule: 'Host(`matrix.hubris.network`) && (PathPrefix(`/.well-known/matrix/`) || PathPrefix(`/.well-known/acme-challenge/`))'
      entryPoints:
        - websecure
      priority: 20
      tls:
        certResolver: letsencrypt
      service: matrix-wellknown-svc
    house-public:
      rule: 'Host(`house.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - house-ratelimit
      service: house-public
    sso-public:
      rule: 'Host(`sso.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - sso-ratelimit
      service: sso-public
    media-public:
      rule: 'Host(`media.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - media-ratelimit
      service: media-public
    paperless-api-public:
      rule: 'Host(`paperless.hubris.network`) && PathPrefix(`/api/`)'
      entryPoints:
        - websecure
      priority: 20
      tls:
        certResolver: letsencrypt
      middlewares:
        - paperless-ratelimit
      service: paperless-public
    paperless-public:
      rule: 'Host(`paperless.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - authentik-forwardauth
        - paperless-ratelimit
      service: paperless-public
    git-public:
      rule: 'Host(`git.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - git-ratelimit
      service: git-public
    mcp-public:
      rule: 'Host(`mcp.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - mcp-ratelimit
      service: mcp-public
    oikos-public:
      rule: 'Host(`oikos.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - oikos-ratelimit
      service: oikos-public
    proxmox-public:
      rule: 'Host(`proxmox.hubris.network`)'
      entryPoints:
        - websecure
      priority: 10
      tls:
        certResolver: letsencrypt
      middlewares:
        - proxmox-ratelimit
      service: proxmox-public

  middlewares:
    admin-allowlist:
      ipAllowList:
        sourceRange:
          - "5.61.168.0/24"
    artifacto-strip-sso:
      headers:
        customRequestHeaders:
          X-Artifacto-Gateway: ""
          X-Authentik-Username: ""
          X-Authentik-Groups: ""
          X-Authentik-Email: ""
          X-Authentik-Name: ""
          X-Authentik-Uid: ""
          X-Authentik-Jwt: ""
          X-Authentik-Meta-Jwks: ""
          X-Authentik-Meta-Outpost: ""
          X-Authentik-Meta-Provider: ""
          X-Authentik-Meta-App: ""
          X-Authentik-Meta-Version: ""
    artifacto-ratelimit:
      rateLimit:
        average: 50
        period: 1s
        burst: 100
    blog-ratelimit:
      rateLimit:
        average: 100
        period: 1s
        burst: 200
    trmnl-ratelimit:
      rateLimit:
        average: 20
        period: 1s
        burst: 40
    matrix-ratelimit:
      rateLimit:
        average: 30
        period: 1s
        burst: 60
    house-ratelimit:
      rateLimit:
        average: 30
        period: 1s
        burst: 60
    sso-ratelimit:
      rateLimit:
        average: 30
        period: 1s
        burst: 60
    media-ratelimit:
      rateLimit:
        average: 30
        period: 1s
        burst: 60
    paperless-ratelimit:
      rateLimit:
        average: 20
        period: 1s
        burst: 40
    authentik-forwardauth:
      forwardAuth:
        address: "http://192.168.8.6:9000/outpost.goauthentik.io/auth/traefik"
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version
    git-ratelimit:
      rateLimit:
        average: 30
        period: 1s
        burst: 60
    mcp-ratelimit:
      rateLimit:
        average: 30
        period: 1s
        burst: 60
    oikos-ratelimit:
      rateLimit:
        average: 30
        period: 1s
        burst: 60
    proxmox-ratelimit:
      rateLimit:
        average: 20
        period: 1s
        burst: 40

  services:
    artifacto-public:
      loadBalancer:
        servers:
          - url: 'http://192.168.8.205:3100'
    blog-public:
      loadBalancer:
        servers:
          - url: 'http://192.168.8.205:8080'
    trmnl-public:
      loadBalancer:
        servers:
          - url: 'http://192.168.8.211:9851'
    matrix-public:
      loadBalancer:
        servers:
          - url: 'http://192.168.8.242:8008'
    matrix-wellknown-svc:
      loadBalancer:
        servers:
          - url: 'http://matrix-wellknown:80'
    house-public:
      loadBalancer:
        servers:
          - url: 'http://192.168.8.244:3000'
    sso-public:
      loadBalancer:
        servers:
          - url: 'http://192.168.8.6:9000'
    media-public:
      loadBalancer:
        servers:
          - url: 'http://192.168.8.246:8096'
    paperless-public:
      loadBalancer:
        servers:
          - url: 'http://192.168.8.130:8000'
    git-public:
      loadBalancer:
        servers:
          - url: 'http://192.168.8.121:3000'
    mcp-public:
      loadBalancer:
        serversTransport: caddy-hubris
        servers:
          - url: 'https://192.168.8.175:443'
    oikos-public:
      loadBalancer:
        serversTransport: caddy-hubris
        servers:
          - url: 'https://192.168.8.175:443'
    proxmox-public:
      loadBalancer:
        serversTransport: proxmox
        servers:
          - url: 'https://192.168.8.77:8006'