# Traefik Dynamic Configuration - Multi-tenant Routing Rules
http:
  middlewares:
    security-headers:
      headers:
        customResponseHeaders:
          X-Content-Type-Options: nosniff
          X-Frame-Options: SAMEORIGIN
          X-XSS-Protection: "1; mode=block"

  routers:
    # API Backend Router (only api.localhost)
    api-router:
      entryPoints:
        - web
      rule: "Host(`api.localhost`)"
      middlewares:
        - security-headers
      service: api-service
    
    # Dashboard Router (dash.localhost for SUPERADMIN)
    dashboard-main-router:
      entryPoints:
        - web
      rule: "Host(`dash.localhost`)"
      priority: 2
      middlewares:
        - security-headers
      service: dashboard-service
    
    # Agency Router (tenant subdomains)
    agency-router:
      entryPoints:
        - web
      rule: "HostRegexp(`^.+\\.localhost$`)"
      priority: 1
      middlewares:
        - security-headers
      service: agency-service

    # Institucional site (aggios.local and localhost)
    institucional-router:
      entryPoints:
        - web
      rule: "Host(`aggios.local`) || Host(`localhost`)"
      priority: 3
      middlewares:
        - security-headers
      service: institucional-service

  services:
    api-service:
      loadBalancer:
        servers:
          - url: http://backend:8080
    
    dashboard-service:
      loadBalancer:
        servers:
          - url: http://dashboard:3000

    agency-service:
      loadBalancer:
        servers:
          - url: http://agency:3000

    institucional-service:
      loadBalancer:
        servers:
          - url: http://institucional:3000