stacks/traefik/dynamic/falcon.yaml

# Routes for apps running on the local machine "falcon", reached over the
# Tailscale/Headscale mesh (falcon's tailnet IP: 100.64.0.1). DNS for
# *.falcon.pivoine.art points here (the VPS), which terminates TLS and
# forwards over the tunnel — falcon itself is never exposed directly.
#
# To add another app: duplicate the <name>-web / <name>-web-secure routers
# and the service block below, swap the hostname and backend port.

http:
  middlewares:
    triggershell-redirect-web-secure:
      redirectScheme:
        scheme: https
    # Only let traffic through whose source IP is inside the Tailscale/Headscale
    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48). Public DNS still resolves these
    # hostnames, but anyone reaching them over the open internet gets a 403 —
    # this range is only reachable by actually being a peer on the tailnet.
    falcon-vpn-only:
      ipAllowList:
        sourceRange:
          - "100.64.0.0/10"
          - "fd7a:115c:a1e0::/48"

  routers:
    triggershell-web:
      rule: "Host(`triggershell.falcon.pivoine.art`)"
      entrypoints:
        - web
      middlewares:
        - falcon-vpn-only
        - triggershell-redirect-web-secure
      service: triggershell

    triggershell-web-secure:
      rule: "Host(`triggershell.falcon.pivoine.art`)"
      entrypoints:
        - web-secure
      tls:
        certResolver: resolver
      middlewares:
        - falcon-vpn-only
        - security-headers@file
      service: triggershell

  services:
    triggershell:
      loadBalancer:
        servers:
          - url: "http://100.64.0.1:4173"