---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: authentik-forward-auth
  namespace: syncthing
spec:
  forwardAuth:
    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
    trustForwardHeader: true
    authResponseHeaders:
      - X-authentik-username
      - X-authentik-groups
      - X-authentik-email
      - X-authentik-name
      - X-authentik-uid
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: strip-prefix-nas
  namespace: syncthing
spec:
  stripPrefix:
    prefixes:
      - /nas
    forceSlash: false
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: strip-prefix-master
  namespace: syncthing
spec:
  stripPrefix:
    prefixes:
      - /master
    forceSlash: false
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: strip-prefix-iris
  namespace: syncthing
spec:
  stripPrefix:
    prefixes:
      - /iris
    forceSlash: false
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: syncthing-headers-nas
  namespace: syncthing
spec:
  headers:
    customRequestHeaders:
      X-Forwarded-Prefix: "/nas"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: syncthing-headers-master
  namespace: syncthing
spec:
  headers:
    customRequestHeaders:
      X-Forwarded-Prefix: "/master"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: syncthing-headers-iris
  namespace: syncthing
spec:
  headers:
    customRequestHeaders:
      X-Forwarded-Prefix: "/iris"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: set-cookie-nas
  namespace: syncthing
spec:
  headers:
    customResponseHeaders:
      Set-Cookie: "syncthing_instance=nas; Path=/; HttpOnly"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: set-cookie-master
  namespace: syncthing
spec:
  headers:
    customResponseHeaders:
      Set-Cookie: "syncthing_instance=master; Path=/; HttpOnly"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: set-cookie-iris
  namespace: syncthing
spec:
  headers:
    customResponseHeaders:
      Set-Cookie: "syncthing_instance=iris; Path=/; HttpOnly"
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: asset-router
  namespace: syncthing
spec:
  plugin:
    simplerouter:
      routes:
        - match: Header(`Referer`, `.*\/nas.*`)
          service: syncthing-nas
        - match: Header(`Referer`, `.*\/master.*`)
          service: syncthing-master
        - match: Header(`Referer`, `.*\/iris.*`)
          service: syncthing-khv