# Traefik dynamic config (file provider) — shared middlewares.
# The HTTP→HTTPS redirect is attached from docker-compose.prod.yml so that
# local development (http://localhost) keeps working without TLS.
http:
  middlewares:
    redirect-https:
      redirectScheme:
        scheme: https
        permanent: true

    # Baseline security headers for every public router (attached in the
    # prod overlay; local http://localhost stays untouched).
    secure-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        contentTypeNosniff: true
        referrerPolicy: strict-origin-when-cross-origin
        customFrameOptionsValue: DENY
        browserXssFilter: true
        customResponseHeaders:
          X-Powered-By: ""
          Server: ""

    # Edge rate limiting — coarse abuse brake for the API host
    # (average 50 req/s sustained, burst 150). Fine-grained login limiting
    # lives in the app (slowapi).
    api-ratelimit:
      rateLimit:
        average: 50
        burst: 150

    # Cap request bodies at the edge (attachments are ≤5 MB per file;
    # 12 MB leaves room for multipart overhead).
    api-bodylimit:
      buffering:
        maxRequestBodyBytes: 12582912