110 lines
2.8 KiB
YAML
110 lines
2.8 KiB
YAML
http:
|
|
middlewares:
|
|
# HTTPS Redirect
|
|
redirect-https:
|
|
redirectScheme:
|
|
scheme: https
|
|
permanent: true
|
|
|
|
# Metube Basic Auth
|
|
metube-auth:
|
|
basicAuth:
|
|
users:
|
|
- "vv:$2y$05$JdT8AGUO9bd.E/PiCmKaoOJS1RFlXkrrmZ5mJ4f8/a1bEW39L3FbS"
|
|
|
|
realm: "MeTube Access"
|
|
|
|
# Basic Auth Traefik Dashboard
|
|
auth:
|
|
basicAuth:
|
|
users:
|
|
- "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
|
|
realm: "Traefik Dashboard"
|
|
|
|
# Basic Auth Dockmon
|
|
dockmon-auth:
|
|
basicAuth:
|
|
users:
|
|
- "admin:$2y$05$.CKDD82sNUxcpaRrLbHuK.dopqt1fgurc2yfTKAT5OFzT7RvPrJHK"
|
|
realm: "Dockmon Access"
|
|
|
|
# Cloudflare IP Whitelist
|
|
cloudflare-ipwhitelist:
|
|
ipWhiteList:
|
|
sourceRange:
|
|
- "173.245.48.0/20"
|
|
- "103.21.244.0/22"
|
|
- "103.22.200.0/22"
|
|
- "103.31.4.0/22"
|
|
- "141.101.64.0/18"
|
|
- "108.162.192.0/18"
|
|
- "190.93.240.0/20"
|
|
- "188.114.96.0/20"
|
|
- "197.234.240.0/22"
|
|
- "198.41.128.0/17"
|
|
- "162.158.0.0/15"
|
|
- "104.16.0.0/13"
|
|
- "104.24.0.0/14"
|
|
- "172.64.0.0/13"
|
|
- "131.0.72.0/22"
|
|
|
|
# Authentik + secure headers
|
|
security-chain:
|
|
chain:
|
|
middlewares:
|
|
- authentik@file
|
|
- security-headers@file
|
|
authentik:
|
|
forwardAuth:
|
|
address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
|
|
trustForwardHeader: true
|
|
authResponseHeaders:
|
|
- X-authentik-username
|
|
- X-authentik-groups
|
|
- X-authentik-email
|
|
- X-authentik-name
|
|
- X-authentik-uid
|
|
- X-authentik-jwt
|
|
- X-authentik-meta-jwks
|
|
- X-authentik-meta-outpost
|
|
- X-authentik-meta-provider
|
|
- X-authentik-meta-app
|
|
- X-authentik-meta-version
|
|
|
|
# Security Headers
|
|
security-headers:
|
|
headers:
|
|
browserXssFilter: true
|
|
contentTypeNosniff: true
|
|
forceSTSHeader: true
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
stsSeconds: 31536000
|
|
customFrameOptionsValue: "SAMEORIGIN"
|
|
customResponseHeaders:
|
|
X-Content-Type-Options: "nosniff"
|
|
Referrer-Policy: "strict-origin-when-cross-origin"
|
|
|
|
# Nextcloud specific headers
|
|
nextcloud-secure-headers:
|
|
headers:
|
|
hostsProxyHeaders:
|
|
- "X-Forwarded-Host"
|
|
- "X-Forwarded-Proto"
|
|
referrerPolicy: "same-origin"
|
|
customFrameOptionsValue: "SAMEORIGIN"
|
|
|
|
# Rate limiting
|
|
rate-limit:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 50
|
|
period: 1m
|
|
|
|
# Nextcloud chain
|
|
nextcloud-chain:
|
|
chain:
|
|
middlewares:
|
|
- nextcloud-secure-headers@file
|
|
- security-headers@file
|