# Exposes Traefik's own API/dashboard (api@internal is a built-in service,
# not something defined below) on traefik.pivoine.art, gated by vpn-only.
# Path prefixes match Traefik's own documented self-referencing pattern:
# /api serves the JSON pulsenode's traefik widget reads, /dashboard serves
# the browsable UI.
http:
  middlewares:
    traefik-redirect-web-secure:
      redirectScheme:
        scheme: https

  routers:
    traefik-dashboard-web:
      rule: "Host(`traefik.pivoine.art`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      entrypoints:
        - web
      middlewares:
        - vpn-only@file
        - traefik-redirect-web-secure
      service: api@internal

    traefik-dashboard-web-secure:
      rule: "Host(`traefik.pivoine.art`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      entrypoints:
        - web-secure
      tls:
        certResolver: resolver
      middlewares:
        - vpn-only@file
        - security-headers@file
        - no-index@file
      service: api@internal