traefik.yaml

http:
  services:
    grist:
      loadBalancer:
        servers:
          - url: 'http://127.0.0.1:{{ env "GRIST_PORT" }}'
    dex:
      loadBalancer:
        servers:
          - url: 'http://127.0.0.1:{{ env "DEX_PORT" }}'
    tfa:
      loadBalancer:
        servers:
          - url: 'http://127.0.0.1:{{ env "TFA_PORT" }}'
    whoami:
      loadBalancer:
        servers:
          - url: 'http://127.0.0.1:{{ env "WHOAMI_PORT" }}'

  middlewares:
    tfa:
      forwardauth:
        address: 'http://127.0.0.1:{{ env "TFA_PORT" }}'
        authResponseHeaders: [ '{{ env "GRIST_FORWARD_AUTH_HEADER" }}' ]
        trustForwardHeader: '{{ env "TFA_TRUST_FORWARD_HEADER" }}'
    no-fwd:
      headers:
        customRequestHeaders:
          '{{ env "GRIST_FORWARD_AUTH_HEADER" }}': ""

  routers:
    route-grist-login:
      rule: "PathPrefix(`/auth/login`) || PathPrefix(`/_oauth`)"
      service: grist
      middlewares:
        - tfa
      entryPoints:
        - web

    route-grist:
      rule: "PathPrefix(`/`)"
      priority: 1   # Set a lower priority than the other rules
      service: grist
      middlewares:
        - no-fwd
      entryPoints:
        - web

    route-dex:
      rule: "PathPrefix(`/dex/`) || Path(`/dex`)"
      service: dex
      entryPoints:
        - web

    route-who:
      rule: "Path(`/who`)"
      service: whoami
      entryPoints:
        - web

{{ $use_https := env "USE_HTTPS" }}
{{if eq $use_https "true" }}
    https-route-grist-login:
      rule: "Host(`{{ env "APP_HOST" }}`) && (PathPrefix(`/auth/login`) || PathPrefix(`/_oauth`))"
      service: grist
      middlewares:
        - tfa
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}

    https-route-grist:
      rule: "Host(`{{ env "APP_HOST" }}`) && PathPrefix(`/`)"
      priority: 1   # Set a lower priority than the other rules
      service: grist
      middlewares:
        - no-fwd
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}

    https-route-dex:
      rule: "Host(`{{ env "APP_HOST" }}`) && (PathPrefix(`/dex/`) || Path(`/dex`))"
      service: dex
      entryPoints:
        - websecure
      tls: {{ env "TLS" }}

    https-route-who:
      rule: "Host(`{{ env "APP_HOST" }}`) && Path(`/who`)"
      service: whoami
      entryPoints:
        - websecure
      tls: true
{{end}}


{{ $https := env "HTTPS" }}
{{if eq $https "manual"}}
tls:
  stores:
    default:
      defaultCertificate:
        certFile: /custom/grist.crt
        keyFile: /custom/grist.key
{{end}}