http: 
  routers:
    traefik-secure:
      service: noop@internal
      rule: Host(`urmel.de`)
      entryPoints:
        - https
        - http
      tls:
        certResolver: hetzner
        domains:
          - main: "arpa.urmel.de"
            sans: 
              - "*.arpa.urmel.de"
          - main: "urmel.de"
            sans: 
              - "*.urmel.de"
    forward-duckdns:
      service: noop@internal
      rule: HostRegexp(`(.+\.)?urmel\.duckdns\.org`)
      priority: 1
      middlewares: redirect-duckdns@file
      tls: 
        certResolver: duckdns
        domains:
          - main: "urmel.duckdns.org"
            sans: 
              - "*.urmel.duckdns.org"
      entryPoints:
        - https
        - http

  middlewares:
    traefik-auth:
      basicauth:
        users: '{{ env "AUTH_STRING" }}'
    redirect-duckdns:
      redirectRegex:
        regex: "^http(s?)://(.+\\.)?urmel\\.duckdns\\.org(:[0-9]+)?(/.*$|$)"
        replacement: "http${1}://${2}urmel.de${3}${4}"
    local-only:
      ipAllowList:
        sourceRange:
          - "10.0.0.0/8"
          - "172.16.0.0/12"
          - "168.168.0.0/16"
    secure-only:
      ipAllowList:
          sourceRange:
            - "172.24.2.0/24"
            - "10.99.0.4/24"