http:
  routers:
    auth:
      rule: "Host(`auth.hobbs.farm`)"
      service: mas
      entryPoints:
        - websecure
      middlewares:
        - security-headers
      tls:
        certResolver: letsencrypt

    # 2026-08-20: under MAS, Synapse no longer serves the login endpoints
    # (it returns M_UNRECOGNIZED). These three compat paths must reach MAS or
    # no client can sign in. Explicit high priority so it wins over `mess`.
    mess-auth-compat:
      rule: "Host(`mess.hobbs.farm`) && PathRegexp(`^/_matrix/client/(r0|v3|v1|unstable)/(login|logout|refresh)`)"
      priority: 1000
      service: mas
      entryPoints:
        - websecure
      middlewares:
        - security-headers
      tls:
        certResolver: letsencrypt

    yoda:
      rule: "Host(`yoda.hobbs.farm`)"
      service: yoda
      entryPoints:
        - websecure
      middlewares:
        - security-headers-allow-frames
      tls:
        certResolver: letsencrypt

    mess:
      rule: "Host(`mess.hobbs.farm`)"
      service: mess
      entryPoints:
        - websecure
      middlewares:
        - security-headers
      tls:
        certResolver: letsencrypt

    mess-federation:
      rule: "Host(`mess.hobbs.farm`) && PathPrefix(`/_matrix/federation`)"
      service: mess
      entryPoints:
        - websecure
      middlewares:
        - security-headers
      tls:
        certResolver: letsencrypt

    wellknown:
      rule: "Host(`hobbs.farm`) && PathPrefix(`/.well-known/matrix`)"
      service: wellknown
      entryPoints:
        - websecure
      middlewares:
        - security-headers
      tls:
        certResolver: letsencrypt

    solo:
      rule: "Host(`solo.hobbs.farm`)"
      service: solo
      entryPoints:
        - websecure
      middlewares:
        - solo-basicauth
        - security-headers-allow-frames
      tls:
        certResolver: letsencrypt

  services:
    mas:
      loadBalancer:
        servers:
          - url: "http://192.168.86.192:8020"

    yoda:
      loadBalancer:
        servers:
          - url: "http://192.168.86.192:8123"

    mess:
      loadBalancer:
        servers:
          - url: "http://192.168.86.192:8008"

    wellknown:
      loadBalancer:
        servers:
          - url: "http://192.168.86.192:8010"

    solo:
      loadBalancer:
        servers:
          - url: "http://192.168.86.192:8199"