http:
  routers:
    # ── Hub (Portfolio SPA) ──
    hub:
      rule: 'Host(`asepharyana.my.id`) || Host(`www.asepharyana.my.id`) || Host(`asepharyana.web.id`) || Host(`www.asepharyana.web.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: hub-service

    # ── Scraper API ──
    scraper:
      rule: 'Host(`scraper.asepharyana.my.id`) || Host(`api.asepharyana.my.id`) || Host(`scraper.asepharyana.web.id`) || Host(`api.asepharyana.web.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: scraper-service

    # ── LLM API (MiniCPM-V) ──
    llm-api:
      rule: 'Host(`ai.asepharyana.my.id`) || Host(`ai.asepharyana.web.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - llm-chain@file
      service: llm-api-service

    # ── Tools (Document Scanner & Media Processing) ──
    tools:
      rule: 'Host(`tools.asepharyana.my.id`) || Host(`tools.asepharyana.web.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: tools-service

    # ── Jaeger UI ──
    jaeger:
      rule: 'Host(`jaeger.asepharyana.my.id`) || Host(`jaeger.asepharyana.web.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: jaeger-service

    # ── 9Router (AI routing gateway) ──
    9router:
      rule: 'Host(`9router.asepharyana.my.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: 9router-service

    # ── PR-Agent (GitHub App webhook) ──
    pr-agent:
      rule: 'Host(`pr-agent.asepharyana.my.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: pr-agent-service

    # ── LIDM Frontend ──
    lidm-frontend:
      rule: 'Host(`lidm.asepharyana.my.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: lidm-frontend-service

    # ── LIDM Backend API ──
    lidm-backend:
      rule: 'Host(`lidm-api.asepharyana.my.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: lidm-backend-service

    # ── ZeaVis Edu Frontend ──
    zeavisedu:
      rule: 'Host(`zeavisedu.asepharyana.my.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: zeavisedu-service

    # ── ZeaVis Edu API ──
    api-zeavisedu:
      rule: 'Host(`api-zeavisedu.asepharyana.my.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: api-zeavisedu-service

    # ── ZeaVis Edu ML Service ──
    ml-zeavisedu:
      rule: 'Host(`ml-zeavisedu.asepharyana.my.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: ml-zeavisedu-service

    # ── Hermes Dashboard ──
    hermes-dashboard:
      rule: 'Host(`dashboard.asepharyana.my.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: hermes-dashboard-service

    # ── GMW Discord Automod Dashboard (Nix: gmw-proxy on 8080) ──
    gmw:
      rule: 'Host(`imphnen.asepharyana.my.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - common-chain@file
      service: gmw-service

    # ── TeleUploader (S3 to Telegram Bridge, Nix: bun on 3000) ──
    teleuploader:
      rule: 'Host(`upload.asepharyana.my.id`) || Host(`upload.asepharyana.web.id`)'
      entryPoints:
        - websecure
      tls: {}
      middlewares:
        - upload-chain@file
      service: teleuploader-service

  services:
    hub-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:3099'

    scraper-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:4091'

    tools-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:3500'

    llm-api-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:8082'

    jaeger-service:
      loadBalancer:
        servers:
          - url: 'http://jaeger:16686'

    9router-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:20128'

    pr-agent-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:3002'

    lidm-frontend-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:3100'

    lidm-backend-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:3101'

    zeavisedu-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:8088'

    api-zeavisedu-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:3200'

    ml-zeavisedu-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:8200'

    hermes-dashboard-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:9119'

    gmw-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:8080'

    teleuploader-service:
      loadBalancer:
        servers:
          - url: 'http://host.docker.internal:3000'