http:
  middlewares:
    myauth:
      basicAuth:
        usersfile: /users.txt
    crowdsec-bouncer:
      forwardauth:
        address: http://bouncer-traefik:8080/api/v1/forwardAuth
        trustForwardHeader: true
    oidc-auth:
      plugin:
        traefik-oidc-auth:
          Secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
          Provider:
            ClientId: xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxx
            ClientSecret: xxxxxxxxxxxxxxxx
            Url: https://pocketid.servidor.es/
            TokenValidation: IdToken
          Scopes:
            - openid
            - profile
            - email
    real-ip-plugin:
      plugin:
        real-ip:
          Proxy:
            - proxyHeadername: X-From-Cdn
              proxyHeadervalue: mf-fun
              realIP: X-Forwarded-For
            - proxyHeadername: X-From-Cdn
              proxyHeadervalue: mf-bar
              realIP: Client-Ip
              OverwriteXFF: true # default: false, v1.0.2 or above
            - proxyHeadername: X-From-Cdn
              proxyHeadervalue: cf-foo
              realIP: Cf-Connecting-Ip
              OverwriteXFF: true # default: false, v1.0.2 or above
            - proxyHeadername: "*"
              realIP: RemoteAddr
    default:
      chain:
        middlewares:
          - gzip
          - default-security-headers
    gzip:
      compress: {}
    default-security-headers:
      headers:
        browserXssFilter: true                            # X-XSS-Protection=1; mode=block
        contentTypeNosniff: true                          # X-Content-Type-Options=nosniff
        customResponseHeaders:
          X-Robots-Tag: "all"
        forceSTSHeader: true                              # Add the Strict-Transport-Security header even when the connection is HTTP
        frameDeny: true                                   # X-Frame-Options=deny
        referrerPolicy: "strict-origin-when-cross-origin"
        stsIncludeSubdomains: true                        # Add includeSubdomains to the Strict-Transport-Security header
        stsPreload: true                                  # Add preload flag appended to the Strict-Transport-Security header
        stsSeconds: 63072000