# Replaces traefik/xmpp-web.nix (TCP-TLS passthrough for the web
# frontends) and upload-prosody.nix (HTTP loadbalancer to pinix) now that
# Prosody and its web frontends run locally (docs/intent/
# xmpp-umzug-pinix-blunix.md, 2026-09-06). Both were remote-backend
# passthroughs; a normal HTTP router is enough for a local one, the same
# shape as traefik/forgejo.nix.
{ config, ... }:
{
  services.traefik.dynamicConfigOptions.http = {
    routers = {
      xmpp-web-plaza = {
        rule = "Host(`plaza.${config.domain}`)";
        tls.certResolver = "cloudflare";
        service = "xmpp-web";
        entryPoints = [ "websecure" ];
      };

      xmpp-web-chat = {
        rule = "Host(`chat.${config.domain}`)";
        tls.certResolver = "cloudflare";
        service = "xmpp-web";
        entryPoints = [ "websecure" ];
      };

      upload = {
        rule = "Host(`upload.${config.domain}`)";
        tls.certResolver = "cloudflare";
        service = "upload";
        entryPoints = [ "websecure" ];
      };
    };

    services = {
      # Both hostnames terminate on the same nginx, name-based (Host
      # header) vhosting on one loopback port -- one shared backend
      # service is enough, as it was with SNI before.
      xmpp-web.loadBalancer.servers = [
        { url = "http://127.0.0.1:8080/"; }
      ];

      upload.loadBalancer.servers = [
        { url = "http://127.0.0.1:5280/"; }
      ];
    };
  };
}