config.example.yml

# NetworkOptimizer-Proxy - Example Dynamic Configuration
#
# Copy this file to config.yml and update the hostnames to match your setup:
#   cp config.example.yml config.yml
#
# The key feature: speedtest uses the "h1only" TLS option, which forces HTTP/1.1
# on the client connection via ALPN negotiation. This is required for accurate
# speed test results - HTTP/2 multiplexing and flow control interfere with
# throughput measurements.

# ---------------------------------------------------------------------------
# TLS Options
# ---------------------------------------------------------------------------
tls:
  options:
    default:
      minVersion: VersionTLS12
    # Speed test: HTTP/1.1 only, lightweight TLS for minimal CPU at high throughput.
    # TLS is only needed for browser geolocation (secure context requirement).
    # AES-128-GCM is ~30% faster than AES-256 with AES-NI; X25519 is fastest ECDHE.
    h1only:
      minVersion: VersionTLS12
      maxVersion: VersionTLS12
      alpnProtocols:
        - "http/1.1"
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      curvePreferences:
        - X25519

# ---------------------------------------------------------------------------
# HTTP Configuration
# ---------------------------------------------------------------------------
http:

  # --- Middlewares -----------------------------------------------------------
  middlewares:
    # Security headers with HSTS (main app and most services)
    security-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        customFrameOptionsValue: "SAMEORIGIN"
        contentTypeNosniff: true
        browserXssFilter: true
        customResponseHeaders:
          Server: ""

    # Security headers for speedtest (SAMEORIGIN instead of DENY for <object> SVG loading)
    speedtest-security-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        customFrameOptionsValue: "SAMEORIGIN"
        contentTypeNosniff: true
        browserXssFilter: true
        customResponseHeaders:
          Server: ""

    # gzip compression for normal services
    compress:
      compress: {}

    # HTTP -> HTTPS redirect
    https-redirect:
      redirectScheme:
        scheme: https
        permanent: true

    # Strip Accept-Encoding to prevent transparent compression (skews speed results)
    speedtest-headers:
      headers:
        customRequestHeaders:
          Accept-Encoding: ""

    # Example: restrict to LAN only (customize these subnets for your network)
    lan-only:
      ipAllowList:
        sourceRange:
          - "192.168.0.0/16"
          - "10.0.0.0/8"
          - "172.16.0.0/12"

  # --- Routers ---------------------------------------------------------------
  routers:
    # HTTP -> HTTPS redirect
    http-catchall:
      rule: "PathPrefix(`/`)"
      entryPoints:
        - web
      service: noop
      middlewares:
        - https-redirect
      priority: 1

    # Network Optimizer - main app (HTTP/2, default TLS)
    optimizer:
      rule: "Host(`optimizer.example.com`)"
      entryPoints:
        - websecure
      service: optimizer
      tls:
        certResolver: letsencrypt
      middlewares:
        - security-headers
        - compress
        - lan-only

    # Speed Test - forced HTTP/1.1 via h1only TLS option
    # HTTP/1.1 is required for accurate speed test results (HTTP/2 multiplexing inflates speeds)
    speedtest:
      rule: "Host(`speedtest.example.com`)"
      entryPoints:
        - websecure
      service: speedtest
      tls:
        certResolver: letsencrypt
        options: h1only
      middlewares:
        - speedtest-security-headers
        - speedtest-headers

    # WAN Speed Test - external OpenSpeedTest server for internet speed testing
    # Same HTTP/1.1 + speed test config as the LAN speed test, but points to a
    # remote server (VPS). Clients on your LAN test through this to measure WAN speed.
    # Results post back to Network Optimizer automatically.
    # See: https://github.com/Ozark-Connect/NetworkOptimizer/blob/main/docker/DEPLOYMENT.md
    #
    # speedtest-wan:
    #   rule: "Host(`speedtest-wan.example.com`)"
    #   entryPoints:
    #     - websecure
    #   service: speedtest-wan
    #   tls:
    #     certResolver: letsencrypt
    #     options: h1only
    #   middlewares:
    #     - speedtest-security-headers
    #     - speedtest-headers

    # Site Agents (multi-site) - active by default; harmless with no agents.
    # If you turn on Network Optimizer's multi-site management, each remote site
    # runs an on-site agent that dials home over a long-lived gRPC tunnel. It uses
    # the SAME hostname as the app, split off by the gRPC service path, and points
    # at the app's HTTP/2 listener on port 8043. That listener serves TLS with an
    # ephemeral self-signed cert, so the backend is https:// with verification
    # skipped (see the serversTransport below) - this keeps the proxy-to-app hop
    # encrypted when Traefik runs on a separate box from the app.
    #
    # This route ships enabled because it's a no-op without agents: the app only
    # opens the 8043 listener when multi-site is enabled (and after a restart), and
    # nothing hits this path until an agent enrolls, so the backend is never dialed.
    # If you DO enable multi-site, restart the app so the 8043 listener binds (until
    # it does, this path returns 502). Requires readTimeout: 0 on the websecure
    # entrypoint (already set in the shipped Traefik config) so the tunnel isn't
    # severed at 60s.
    agents:
      rule: "Host(`optimizer.example.com`) && PathPrefix(`/networkoptimizer.agent.v1.AgentTunnel/`)"
      priority: 100        # must beat the host-only optimizer router so the path wins
      entryPoints:
        - websecure
      service: agents
      tls:
        certResolver: letsencrypt
      middlewares:
        - security-headers

  # --- Services --------------------------------------------------------------
  services:
    # Noop backend - Traefik's own ping endpoint (for redirects / cert-only domains)
    noop:
      loadBalancer:
        servers:
          - url: "http://127.0.0.1:8099"

    # Network Optimizer web UI
    optimizer:
      loadBalancer:
        servers:
          - url: "http://localhost:8042"

    # OpenSpeedTest (runs inside the Network Optimizer container on a separate port)
    speedtest:
      loadBalancer:
        responseForwarding:
          flushInterval: "-1ms"
        servers:
          - url: "http://localhost:3005"

    # WAN Speed Test - remote OpenSpeedTest server (uncomment to enable)
    # Replace with the hostname or IP of your VPS running the speed test container
    #
    # speedtest-wan:
    #   loadBalancer:
    #     responseForwarding:
    #       flushInterval: "-1ms"
    #     servers:
    #       - url: "http://your-vps-hostname:3005"

    # Site agent tunnel - gRPC over HTTP/2 to the app's 8043 listener. The
    # listener serves TLS with an ephemeral self-signed cert, so the backend URL
    # is https:// and verification is skipped via the serversTransport below.
    agents:
      loadBalancer:
        servers:
          - url: "https://127.0.0.1:8043"
        serversTransport: agent-tunnel-insecure

  # --- ServersTransports -------------------------------------------------------
  # Backend transport tuning. The agent tunnel's self-signed cert requires
  # skipping verification on the proxy-to-app hop.
  serversTransports:
    agent-tunnel-insecure:
      insecureSkipVerify: true