http:
  middlewares:
    secure-headers:
      headers:
        sslRedirect: false  # EN: Disabled for local development / VI: Tắt cho local development
        stsSeconds: 31536000
        contentTypeNosniff: true
        browserXssFilter: true
        frameDeny: true

    cors:
      headers:
        accessControlAllowMethods:
          - GET
          - POST
          - PUT
          - DELETE
          - PATCH
          - OPTIONS
        accessControlAllowOriginList:
          - "http://localhost:3000"
          - "http://localhost:3001"
          - "https://goodgo.vn"
        accessControlAllowHeaders:
          - Content-Type
          - Authorization
        accessControlAllowCredentials: true
        accessControlMaxAge: 86400

    auth-ratelimit:
      rateLimit:
        average: 100
        burst: 50

    compress:
      compress: {}
