Traefik v3 Dynamischer Konfigurations-Generator

# Traefik v3 Dynamic Configuration
# Generated 100% Client-Side by ToolsAA Traefik Config Generator
# Documentation: https://doc.traefik.io/traefik/v3.0/

http:
  routers:
    # Global automatic HTTP -> HTTPS redirect router
    global-http-redirect:
      entryPoints:
        - "web"
      rule: "PathPrefix(`/`)"
      middlewares:
        - "redirect-to-https"
      service: "noop@internal"
      priority: 1
    api-router:
      entryPoints:
        - "websecure"
      rule: "Host(`api.toolsaa.com`) && PathPrefix(`/v1`)"
      service: "api-service"
      priority: 100
      middlewares:
        - "strip-api-prefix"
        - "api-rate-limit"
        - "security-headers"
      tls:
        certResolver: "letsencrypt"
        domains:
          - main: "api.toolsaa.com"
    auth-router:
      entryPoints:
        - "websecure"
      rule: "Host(`api.toolsaa.com`) && PathPrefix(`/auth`)"
      service: "auth-service"
      priority: 110
      middlewares:
        - "api-rate-limit"
        - "security-headers"
      tls:
        certResolver: "letsencrypt"
        domains:
          - main: "api.toolsaa.com"

  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: "https"
        permanent: true
    strip-api-prefix:
      stripPrefix:
        prefixes:
          - "/v1"
          - "/api/v1"
        forceSlash: false
    api-rate-limit:
      rateLimit:
        average: 100
        burst: 50
        period: "1s"
    security-headers:
      headers:
        sslRedirect: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        customFrameOptionsValue: "SAMEORIGIN"
        contentTypeNosniff: true
        contentSecurityPolicy: "default-src 'self'"

  services:
    api-service:
      loadBalancer:
        passHostHeader: true
        servers:
          - url: "http://10.0.1.10:8080"
          - url: "http://10.0.1.11:8080"
        healthCheck:
          path: "/healthz"
          interval: "10s"
          timeout: "3s"
        sticky:
          cookie:
            name: "traefik_api_sticky"
            secure: true
            httpOnly: true
            sameSite: "lax"
    auth-service:
      loadBalancer:
        passHostHeader: true
        servers:
          - url: "http://10.0.1.20:4000"
        healthCheck:
          path: "/status"
          interval: "15s"
          timeout: "2s"

tls:
  options:
    default:
      minVersion: "VersionTLS12"
      sniStrict: true
      cipherSuites:
        - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
        - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
        - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
        - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
        - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"
        - "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"