# HexaHost GameCloud — Traefik dynamic configuration
# Shared middleware and optional file-based routers for the control plane stack.
# Primary routing is defined via Docker labels in deploy/compose/compose.prod.yml.

http:
  middlewares:
    gamecloud-redirect-https:
      redirectScheme:
        scheme: https
        permanent: true

    gamecloud-api-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        contentTypeNosniff: true
        frameDeny: true
        referrerPolicy: strict-origin-when-cross-origin
        customRequestHeaders:
          X-Forwarded-Proto: https

    gamecloud-web-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        contentTypeNosniff: true
        frameDeny: true
        referrerPolicy: strict-origin-when-cross-origin
        customRequestHeaders:
          X-Forwarded-Proto: https

    gamecloud-rate-limit:
      rateLimit:
        average: 100
        burst: 200
        period: 1s

  routers:
    # File-provider routers — useful when Traefik runs outside the compose project
    # or when you prefer centralised routing. Disable duplicate Docker labels if you
    # rely exclusively on these definitions.
    gamecloud-api:
      rule: Host(`api.example.net`)
      entryPoints:
        - websecure
      service: gamecloud-api
      middlewares:
        - gamecloud-api-headers
        - gamecloud-rate-limit
      tls:
        certResolver: letsencrypt

    gamecloud-web:
      rule: Host(`panel.example.net`)
      entryPoints:
        - websecure
      service: gamecloud-web
      middlewares:
        - gamecloud-web-headers
      tls:
        certResolver: letsencrypt

  services:
    gamecloud-api:
      loadBalancer:
        servers:
          - url: http://api:3001
        passHostHeader: true
        healthCheck:
          path: /api/v1/health/live
          interval: 15s
          timeout: 5s

    gamecloud-web:
      loadBalancer:
        servers:
          - url: http://web:3000
        passHostHeader: true
        healthCheck:
          path: /de
          interval: 15s
          timeout: 5s

tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305