http:
  routers:
    # Postiz API (backend) - without SSO protection
    postiz-api:
      rule: "Host(`social.ai-impress.com`) && PathPrefix(`/api`)"
      service: postiz-api
      entryPoints:
        - websecure
      tls:
        certResolver: cloudflare

    # Postiz frontend - with Authentik
    postiz:
      rule: "Host(`social.ai-impress.com`) && !PathPrefix(`/api`)"
      service: postiz
      entryPoints:
        - websecure
      tls:
        certResolver: cloudflare
      middlewares:
        - authentik@file

    mirotalk:
      rule: "Host(`webinar.ai-impress.com`)"
      service: mirotalk
      entryPoints:
        - websecure
      tls:
        certResolver: cloudflare

  services:
    postiz-api:
      loadBalancer:
        servers:
          - url: "http://postiz:5000"

    postiz:
      loadBalancer:
        servers:
          - url: "http://postiz:5000"

    mirotalk:
      loadBalancer:
        servers:
          - url: "http://mirotalk-sfu:3011"

  middlewares:
    security-headers:
      headers:
        frameDeny: true
        sslRedirect: true
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000

    authentik:
      forwardAuth:
        address: http://authentik-proxy:9000/outpost.goauthentik.io/auth/traefik
        trustForwardHeader: true
        authResponseHeaders:
        - X-authentik-username
        - X-authentik-groups
        - X-authentik-email
        - X-authentik-name
        - X-authentik-uid
        - X-authentik-jwt
        - X-authentik-meta-jwks
        - X-authentik-meta-outpost
        - X-authentik-meta-provider
        - X-authentik-meta-app
        - X-authentik-meta-version

    buffering:
      buffering:
        maxRequestBodyBytes: 10485760
        memRequestBodyBytes: 2097152
        maxResponseBodyBytes: 10485760
        memResponseBodyBytes: 2097152
        retryExpression: IsNetworkError() && Attempts() < 2

tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
      - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
      - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
