# OpenRemote via Traefik v3 - File-based routing (CORRIGÉ 2026-05)
http:
  routers:
    openremote-manager:
      rule: "Host(`openremote.digitribe.fr`)"
      entryPoints:
        - websecure
      service: openremote-manager
      middlewares:
        - openremote-headers
      tls:
        certResolver: letsencrypt

    openremote-manager-api:
      rule: "Host(`openremote.digitribe.fr`) && PathPrefix(`/api/`)"
      entryPoints:
        - websecure
      service: openremote-manager
      middlewares:
        - openremote-headers
      priority: 100
      tls:
        certResolver: letsencrypt

    # Console app config (static file) - rewrite vers /manager/consoleappconfig/
    openremote-manager-consoleappconfig:
      rule: "Host(`openremote.digitribe.fr`) && PathPrefix(`/consoleappconfig`)"
      entryPoints:
        - websecure
      service: openremote-manager
      middlewares:
        - consoleappconfig-rewrite
        - openremote-headers
      priority: 95
      tls:
        certResolver: letsencrypt

    # Keycloak sur le même domaine pour OIDC
    openremote-keycloak:
      rule: "Host(`openremote.digitribe.fr`) && PathPrefix(`/auth`)"
      entryPoints:
        - websecure
      service: openremote-keycloak
      middlewares:
        - openremote-headers
      priority: 90
      tls:
        certResolver: letsencrypt

  middlewares:
    # Rewrite /consoleappconfig/* vers /manager/consoleappconfig/*
    consoleappconfig-rewrite:
      replacePathRegex:
        regex: "^/consoleappconfig/(.*)"
        replacement: "/manager/consoleappconfig/$1"

    # Headers requis pour OpenRemote (pas de Location: "https" !)
    openremote-headers:
      headers:
        sslRedirect: true
        customRequestHeaders:
          X-Forwarded-Proto: "https"
          X-Forwarded-Host: "openremote.digitribe.fr"
          X-Forwarded-For: "10.0.0.0/8"

  services:
    openremote-manager:
      loadBalancer:
        servers:
          - url: "http://openremote_manager_1:8080"  # CORRIGÉ: underscore au lieu de tiret

    openremote-keycloak:
      loadBalancer:
        servers:
          - url: "http://openremote_keycloak_1:8080"  # CORRIGÉ: underscore au lieu de tiret