# Traefik Dynamic Middlewares
# Security headers, rate limiting, and common middleware

http:
  middlewares:
    # Security headers for all routes
    security-headers:
      headers:
        browserXssFilter: true
        contentTypeNosniff: true
        frameDeny: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
        customFrameOptionsValue: "SAMEORIGIN"
        customResponseHeaders:
          X-Robots-Tag: "noindex, nofollow"
          server: ""

    # Rate limiting for subdomain routes
    rate-limit:
      rateLimit:
        average: 100
        burst: 200
        period: 1s

    # Rate limiting for API routes (stricter)
    api-rate-limit:
      rateLimit:
        average: 30
        burst: 50
        period: 1s

    # Compress responses
    gzip:
      compress:
        excludedContentTypes:
          - "text/event-stream"

    # Strip prefix for API routing
    strip-api-prefix:
      stripPrefix:
        prefixes:
          - "/api"
