# Configuración dinámica para amigos.nucleoriofrio.com
# Proxy a amigos-app:3001 con autenticación Authentik

http:
  routers:
    amigos-nucleoriofrio:
      rule: "Host(`amigos.nucleoriofrio.com`)"
      entryPoints:
        - websecure
      service: amigos-nucleoriofrio-service
      tls:
        certResolver: letsencrypt
      middlewares:
        - authentik-forward-auth
        - amigos-headers

  services:
    amigos-nucleoriofrio-service:
      loadBalancer:
        servers:
          - url: "http://amigos-app:3001"
        passHostHeader: true

  middlewares:
    # Forward Auth con Authentik
    authentik-forward-auth:
      forwardAuth:
        address: "http://authentiknucleo-server-1:9000/outpost.goauthentik.io/auth/traefik"
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-email
          - X-authentik-uid
          - Set-Cookie

    # Headers personalizados para amigos
    amigos-headers:
      headers:
        customRequestHeaders:
          X-Forwarded-Proto: "https"
          X-Forwarded-Scheme: "https"