expose only a specific endpoint to internet

services:
  backend:
    build:
      context: .
      target: webapp
    expose:
      - 8000
    depends_on:
      celery-worker:
        condition: service_healthy

    labels:
      - "traefik.http.services.backend-svc.loadbalancer.server.port=8000"
      - "traefik.enable=true"
      - "traefik.http.routers.backend-public.rule=Host(`api.saral.club`) && PathPrefix(`/mnemonics/v1/info`)"
      - "traefik.http.routers.backend-public.entrypoint=websecure"
      - "traefik.http.routers.backend-public.tls.certresolver=letsencrypt"
      - "traefik.http.routers.backend-public.priority=100"
      - "traefik.http.routers.backend-public.service=backend-svc"
      - "traefik.http.routers.backend-internal.rule=Host(`api.saral.club`)"
      - "traefik.http.routers.backend-internal.entrypoints=websecure"
      - "traefik.http.routers.backend-internal.tls.certresolver=letsencrypt"
      - "traefik.http.routers.backend-internal.service=backend-svc"
      - "traefik.http.routers.backend-internal.middlewares=internal-only"
      - "traefik.http.routers.backend-internal.priority=10"
      - "traefik.http.middlewares.internal-only.ipwhitelist.sourcerange=172.16.0.0/12,192.168.0.0/16,10.0.0.0/8"
    networks:
      - dokploy-network
      - default