{ config, ... }:

{
  # These endpoints use the already-issued domain2 wildcard certificate from
  # acme.nix. They stay behind Traefik; Dex, Headscale and LLDAP bind to
  # loopback. LLDAP is reachable through both the public and Tailnet entrypoint
  # because its web board is needed for account administration from either
  # network.
  services.traefik.dynamicConfigOptions.http = {
    routers = {
      dex-pinix = {
        rule = "Host(`dex.${config.domain2}`)";
        entryPoints = [ "websecure" ];
        service = "dex-pinix";
        tls = { };
      };
      headscale-pinix = {
        rule = "Host(`head.${config.domain2}`)";
        entryPoints = [ "websecure" ];
        service = "headscale-pinix";
        tls = { };
      };
      lldap-pinix = {
        rule = "Host(`lldap.${config.domain2}`)";
        entryPoints = [ "websecure" "web-internal" ];
        service = "lldap-pinix";
        tls = { };
      };
    };

    services = {
      dex-pinix.loadBalancer.servers = [
        { url = "http://127.0.0.1:5556"; }
      ];
      headscale-pinix.loadBalancer.servers = [
        { url = "http://127.0.0.1:3001"; }
      ];
      lldap-pinix.loadBalancer.servers = [
        { url = "http://127.0.0.1:17170"; }
      ];
    };
  };
}