stacks/traefik/dynamic/falcon.yaml

# Routes for apps running on the local machine "falcon", reached over the
# Tailscale/Headscale mesh (falcon's tailnet IP: 100.64.0.1). DNS for
# *.falcon.pivoine.art points here (the VPS), which terminates TLS and
# forwards over the tunnel — falcon itself is never exposed directly.
#
# To add another app: duplicate the <name>-web / <name>-web-secure routers
# and the service block below, swap the hostname and backend port.

http:
  middlewares:
    triggershell-redirect-web-secure:
      redirectScheme:
        scheme: https

  routers:
    triggershell-web:
      rule: "Host(`triggershell.falcon.pivoine.art`)"
      entrypoints:
        - web
      middlewares:
        - vpn-only@file
        - triggershell-redirect-web-secure
      service: triggershell

    triggershell-web-secure:
      rule: "Host(`triggershell.falcon.pivoine.art`)"
      entrypoints:
        - web-secure
      tls:
        certResolver: resolver
      middlewares:
        - vpn-only@file
        - security-headers@file
      service: triggershell

  services:
    triggershell:
      loadBalancer:
        servers:
          - url: "http://100.64.0.1:4173"