traefik.yaml

http:
  services:
    grist:
      loadBalancer:
        servers:
          - url: 'http://127.0.0.1:{{ env "GRIST_PORT" }}'
    dex:
      loadBalancer:
        servers:
          - url: 'http://127.0.0.1:{{ env "DEX_PORT" }}'
    tfa:
      loadBalancer:
        servers:
          - url: 'http://127.0.0.1:{{ env "TFA_PORT" }}'
    whoami:
      loadBalancer:
        servers:
          - url: 'http://127.0.0.1:{{ env "WHOAMI_PORT" }}'

  middlewares:
    tfa:
      forwardauth:
        address: 'http://127.0.0.1:{{ env "TFA_PORT" }}'
        authResponseHeaders: [ '{{ env "GRIST_FORWARD_AUTH_HEADER" }}' ]

  routers:
    route-grist-login:
      rule: "PathPrefix(`/auth/login`)"
      service: grist
      middlewares:
        - tfa
      entryPoints:
        - web
    route-grist-auth:
      rule: "PathPrefix(`/_oauth`)"
      service: grist
      middlewares:
        - tfa
      entryPoints:
        - web
    route-grist:
      rule: "PathPrefix(`/`)"
      service: grist
      entryPoints:
        - web
    route-signed-out:
      rule: "Path(`/signed-out`)"
      service: grist
      entryPoints:
        - web
    route-api:
      rule: "PathPrefix(`/api/`)"
      service: grist
      entryPoints:
        - web
    route-api-org:
      rule: "PathPrefix(`/o/{org:[^/]+}/api/`)"
      service: grist
      entryPoints:
        - web
    route-assets:
      rule: "PathPrefix(`/v/unknown/`)"
      service: grist
      entryPoints:
        - web
    route-dex:
      rule: "PathPrefix(`/dex/`)"
      service: dex
      entryPoints:
        - web
    route-dex-bare:
      rule: "Path(`/dex`)"
      service: dex
      entryPoints:
        - web
    route-who:
      rule: "Path(`/who`)"
      service: whoami
      entryPoints:
        - web

{{ $use_https := env "USE_HTTPS" }}
{{if eq $use_https "true" }}
    https-route-grist-login:
      rule: "Host(`{{ env "APP_HOST" }}`) && PathPrefix(`/auth/login`)"
      service: grist
      middlewares:
        - tfa
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}
    https-route-grist-auth:
      rule: "Host(`{{ env "APP_HOST" }}`) && PathPrefix(`/_oauth`)"
      service: grist
      middlewares:
        - tfa
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}
    https-route-grist:
      rule: "Host(`{{ env "APP_HOST" }}`) && PathPrefix(`/`)"
      service: grist
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}
    https-route-signed-out:
      rule: "Host(`{{ env "APP_HOST" }}`) && Path(`/signed-out`)"
      service: grist
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}
    https-route-api:
      rule: "Host(`{{ env "APP_HOST" }}`) && PathPrefix(`/api/`)"
      service: grist
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}
    https-route-api-org:
      rule: "Host(`{{ env "APP_HOST" }}`) && PathPrefix(`/o/{org:[^/]+}/api/`)"
      service: grist
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}
    https-route-assets:
      rule: "Host(`{{ env "APP_HOST" }}`) && PathPrefix(`/v/unknown/`)"
      service: grist
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}
    https-route-dex:
      rule: "Host(`{{ env "APP_HOST" }}`) && PathPrefix(`/dex/`)"
      service: dex
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}
    https-route-dex-bare:
      rule: "Host(`{{ env "APP_HOST" }}`) && Path(`/dex`)"
      service: dex
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}
    https-route-who:
      rule: "Host(`{{ env "APP_HOST" }}`) && Path(`/who`)"
      service: whoami
      entryPoints:
        - websecure
      tls: true
{{end}}


{{ $https := env "HTTPS" }}
{{if eq $https "manual"}}
tls:
  stores:
    default:
      defaultCertificate:
        certFile: /custom/grist.crt
        keyFile: /custom/grist.key
{{end}}