http:
  routers:
    dashboard:
      rule: "Host(`traefik.${DOMAIN_NAME}`)"
      service: "api@internal"
      entryPoints:
        - websecure
      middlewares:
        - dashboard-auth
        - internal-only
      tls:
        certResolver: cloudflare

  middlewares:
    crowdsec-bouncer:
      forwardAuth:
        address: http://bouncer-traefik:8080/api/v1/forwardAuth
        trustForwardHeader: true

    dashboard-auth:
      basicAuth:
        users:
          - "admin:$apr1$..."
    internal-only:
      ipAllowList:
        sourceRange:
          - "192.168.0.0/24"
          - "127.0.0.1/32"