# Traefik dynamic configuration — hot-reloaded by Traefik on change.
#
# TLS: private CA server cert + mandatory client cert (mTLS).
# Any connection without a valid client cert signed by ca.crt is rejected
# at the TLS handshake — before any HTTP reaches EMS.

tls:
  certificates:
    - certFile: /certs/server.crt
      keyFile:  /certs/server.key

  options:
    mtls:
      clientAuth:
        caFiles:
          - /certs/ca.crt
        clientAuthType: RequireAndVerifyClientCert
      # Minimum TLS 1.2; prefer 1.3
      minVersion: VersionTLS12
      sniStrict: true

http:
  routers:
    ems:
      rule: "Host(`ems.famfi.dyndns.org`)"
      entryPoints:
        - websecure
      tls:
        options: mtls
      service: ems

  services:
    ems:
      loadBalancer:
        servers:
          - url: "http://ems:9099"
        passHostHeader: true