# -----------------------------------------------------------------------------
# Traefik Manager - manager.yml
# This file is managed by the app. You can also edit it manually.
# Restart the container after any manual changes.
# Full reference: https://traefik-manager.xyzlab.dev/manager-yml
#
# Secrets below are encrypted at rest. You can write one in plain text here and
# it is read as written, then encrypted in place on the next start.
#
# Some state lives in companion files next to this one and is not shown here:
#   agents.yml               registered remote servers (secrets encrypted)
#   templates.yml            custom middleware templates
#   notifications.yml        recent notification history
#   notification_queue.json  what a digest or quiet-hours window is holding
#   dashboard.yml            dashboard groups and per-card overrides
#   .secret_key, .otp_key    session signing key and the key for every secret
#   cache/, geoip/           dashboard group cache and the GeoIP database
# -----------------------------------------------------------------------------

# -- Domains ------------------------------------------------------------------
domains:
  - example.com
  - example.lan

# -- Certificate Resolver -----------------------------------------------------
# One or more names, comma-separated. The first is the default for new routes.
# Use "none" if you manage certificates externally.
cert_resolver: cloudflare

# -- Traefik API --------------------------------------------------------------
# Point at the internal API. A public dashboard URL behind auth returns 401.
traefik_api_url: http://traefik:8080

# Only if that API sits behind basic auth. Both are required together.
traefik_api_user: ""
traefik_api_password: ""

# -- File Paths ---------------------------------------------------------------
# Paths inside the container. Mount the files and set these accordingly.
# Can also be set via env vars: ACME_JSON_PATH, ACCESS_LOG_PATH, STATIC_CONFIG_PATH
#
# acme_json_path accepts several files comma-separated, or a directory whose
# .json files are all read - Traefik writes one storage file per cert resolver.
acme_json_path: ""
access_log_path: ""
static_config_path: ""

# -- Authentication -----------------------------------------------------------
# Set to false if using external auth (Authentik, Authelia, Traefik basicAuth).
# AUTH_ENABLED env var takes priority over this field.
auth_enabled: true

# -- Password Hash ------------------------------------------------------------
# Set automatically by the app. Do not edit manually unless pre-configuring.
# If left empty the app auto-generates a temporary password on startup and
# prints it to the container logs. You can also pre-set a bcrypt hash here:
#   python3 -c "import bcrypt; print(bcrypt.hashpw(b'yourpw', bcrypt.gensalt()).decode())"
# Then set setup_complete: true to skip the setup wizard entirely.
password_hash: ""

# -- Setup State --------------------------------------------------------------
# Managed automatically by the app. Do not edit unless pre-configuring.
# must_change_password: true forces a password-change on next login.
# setup_complete: true skips the setup wizard.
must_change_password: false
setup_complete: false

# -- Two-Factor Authentication (TOTP) ----------------------------------------
# Managed via Settings -> Authentication -> 2FA. Do not edit by hand.
otp_enabled: false
otp_secret: ""

# -- API Keys -----------------------------------------------------------------
# Managed via Settings -> Authentication -> API Keys. Do not edit by hand.
api_key_enabled: false
api_keys: []

# -- OIDC / SSO ---------------------------------------------------------------
# Managed via Settings -> Authentication -> OIDC, or seeded from the OIDC_*
# environment variables while the key below is absent from this file.
# Leaving oidc_allowed_emails and oidc_allowed_groups BOTH empty denies every
# login. Set oidc_allow_any_authenticated: true to admit any account instead.
oidc_enabled: false
oidc_provider_url: ""
oidc_client_id: ""
oidc_client_secret: ""
oidc_display_name: "OIDC"
oidc_allowed_emails: ""
oidc_allowed_groups: ""
oidc_groups_claim: "groups"
oidc_allow_any_authenticated: false

# Skip the login page and go straight to the provider.
oidc_auto_login: false

# -- Notification Channels ----------------------------------------------------
# Managed via Settings -> Notifications. Each channel picks a kind, the
# categories it hears, a severity floor and an optional quiet window.
# kind: discord | slack | ntfy | unifiedpush | generic | gotify | pushover |
#       pushbullet | telegram
notification_channels: []

# Epoch seconds of the last time notifications were marked read. Managed
# automatically by the bell menu.
notifications_read_until: 0

# The single-webhook fields below predate notification_channels and are migrated
# into it on load. Leave them empty on a new install.
webhook_url: ""
webhook_type: "discord"
webhook_username: ""
webhook_password: ""

# -- CrowdSec -----------------------------------------------------------------
# Managed via Settings -> Security. The bouncer key reads decisions; the machine
# login is additionally required to read alerts and to unban.
crowdsec_lapi_url: ""
crowdsec_api_key: ""
crowdsec_machine_id: ""
crowdsec_machine_password: ""

# -- Git Backup ---------------------------------------------------------------
# Managed via Settings -> Backups -> Git. https:// or ssh:// only.
# The token is stored encrypted and passed to git via an askpass helper,
# never embedded in the remote URL.
git_backup_enabled: false
git_backup_repo: ""
git_backup_branch: "main"
git_backup_username: ""
git_backup_token: ""
git_backup_auto_push: true
git_backup_commit_message: "traefik-manager: {action} at {timestamp}"

# -- Backups ------------------------------------------------------------------
# Keep only the last N backups per config file. 0 keeps everything.
backup_keep_count: 0

# -- Geolocation --------------------------------------------------------------
# Country flags and a world map on the Logs and CrowdSec tabs. Lookups run
# locally against a bundled database - no IP leaves this instance.
# Leave geoip_db_path empty to use the free DB-IP Lite database.
geoip_enabled: false
geoip_db_path: ""

# -- Interface ----------------------------------------------------------------
# default_theme: dark | light | system. Set by the theme toggle in the nav bar.
default_theme: "dark"

# Display preferences, kept here rather than in the browser so they follow you
# across browsers and devices. Set by the toggles in Settings -> Interface and
# the card/list buttons on Routes, Middlewares and Services. Unknown keys are
# dropped. Managed automatically; no need to edit by hand.
#
# ui_prefs:
#   showStatCards: true
#   compactStatCards: false
#   showEntrypoints: true
#   showDocsLink: true
#   showApiLink: false
#   showShortcutsBtn: true
#   showIpDiagBtn: true
#   showTraefikBadge: true
#   showTmBadge: true
#   showRouteIcons: false
#   statBarScope: all      # all | dashboard
#   layoutMode: classic    # classic | modern
#   dashPodDensity: list   # list | icons
#   routeViewMode: grid    # grid | list
#   mwViewMode: grid
#   svcViewMode: grid
ui_prefs: {}

# -- Agents -------------------------------------------------------------------
# Registered servers live in agents.yml, not here. This is only the rate limit
# this instance applies to its own /api/agents/* endpoints (requests/minute).
agent_api_rate_limit: 30

# -- Tab Visibility -----------------------------------------------------------
# Show or hide optional tabs. Routes, Middlewares, and Services are always on.
# Toggle in Settings -> Route Monitoring / System Monitoring, or edit here and restart.
visible_tabs:
  # Visualizations
  dashboard: false
  routemap: false
  # Infrastructure
  docker: false
  kubernetes: false
  # Orchestrators
  swarm: false
  nomad: false
  ecs: false
  consulcatalog: false
  # KV stores
  redis: false
  etcd: false
  consul: false
  zookeeper: false
  # Config providers
  http_provider: false
  file_external: false
  # System
  certs: false
  tls: false
  crowdsec: false
  plugins: false
  logs: false

# -- Self Route ---------------------------------------------------------------
# TM's own Traefik route. Set via Settings -> Connection -> Self Route.
self_route:
  domain: ""
  service_url: ""
  router_name: traefik-manager
  entry_point: websecure

# -- Disabled Routes ----------------------------------------------------------
# Stores config of disabled routes so they can be re-enabled. Managed automatically.
disabled_routes: {}

# -- Managed Middlewares ------------------------------------------------------
# Ownership ledger. Entries record the middlewares the guided route presets
# generated, and, under svc:: keys, the composite services TM authored. TM only
# updates or removes what is listed here, so a hand-written middleware or
# service of the same name is never overwritten. Managed automatically.
managed_middlewares: {}