http:
  routers:
    traefik-secure:
      service: noop@internal
      rule: Host(`{{ traefik.main_domain }}`)
      entryPoints:
        - https
        - http
      tls:
        certResolver: hetzner
        domains:
          - main: "arpa.{{ arpa_top_level }}"
            sans:
              - "*.arpa.{{ arpa_top_level }}"
          - main: "{{ traefik.main_domain }}"
            sans:
              - "*.{{ traefik.main_domain }}"
    {% if traefik.duckdns_api_token -%}
    forward-duckdns:
      service: noop@internal
      rule: HostRegexp(`(.+\.)?urmel\.duckdns\.org`)
      priority: 1
      middlewares: redirect-duckdns@file
      tls:
        certResolver: duckdns
        domains:
          - main: "urmel.duckdns.org"
            sans:
              - "*.urmel.duckdns.org"
      entryPoints:
        - https
        - http
    {%- endif %}

  middlewares:
    traefik-auth:
      basicauth:
        users: '{% raw %}{{ env "AUTH_STRING" }}{% endraw %}'

    {% if traefik.duckdns_api_token %}
    redirect-duckdns:
      redirectRegex:
        regex: "^http(s?)://(.+\\.)?urmel\\.duckdns\\.org(:[0-9]+)?(/.*$|$)"
        replacement: "http${1}://${2}urmel.de${3}${4}"
    {% endif %}

    local-only:
      ipAllowList:
        sourceRange:
          - "10.0.0.0/8"
          - "172.16.0.0/12"
          - "192.168.0.0/16"

    secure-only:
      ipAllowList:
          sourceRange:
            - "172.24.2.0/24"
            - "10.99.0.4/24"