http:
  middlewares:
    default-headers:
      headers:
        frameDeny: true
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 15552000
        customFrameOptionsValue: SAMEORIGIN
        customResponseHeaders:
          X-Robots-Tag: "noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex"
          X-Powered-By: "Traefik"
          Server: "Traefik"

    rate-limit:
      rateLimit:
        average: 100
        burst: 50

    secure-headers:
      headers:
        accessControlAllowMethods:
          - GET
          - OPTIONS
          - PUT
          - POST
          - DELETE
        accessControlMaxAge: 100
        hostsProxyHeaders:
          - "X-Forwarded-Host"
        customRequestHeaders:
          X-Forwarded-Proto: "https"

    auth:
      basicAuth:
        users:
          - "admin:$2y$05$pxTmyNXFWcL4fpqqxwWoRuX5549vaSuSJkLz6g/EZgoaoSkmgLw4W"

  routers:
    ping:
      rule: "PathPrefix(`/ping`)"
      service: ping@internal
      middlewares:
        - default-headers

  services:
    dummy:
      loadBalancer:
        servers:
          - url: "http://localhost"

tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
        - TLS_AES_128_GCM_SHA256
        - TLS_AES_256_GCM_SHA384
        - TLS_CHACHA20_POLY1305_SHA256