http:
  routers:
    kopia:
      rule: Host(`kopia.sherlockhomeless.net`)
      entryPoints:
        - websecure
      tls:
        certResolver: letsencrypt
      middlewares:
        - crowdsec-bouncer@file
      - ths-authentik@docker
        - kopia-inject-auth
      service: kopia

  middlewares:
    kopia-inject-auth:
      headers:
        customRequestHeaders:
          Authorization: "Basic <redacted-kopia-basic-auth>"

  services:
    kopia:
      loadBalancer:
        servers:
          - url: "http://host.docker.internal:51515"