forust
36922a177c
traefik, gitea, adguard, nextcloud, errorpages, homepages, uptime-kuma, kener, checkmk, headscale, dockmon, metube, downtify, portainer, netronome, userbot Includes Helm values, deployments, services, ingress routes, configmaps, secrets (placeholders), postgres statefulsets, kustomize overlays, and Traefik dynamic configuration.
125 lines
3.4 KiB
YAML
125 lines
3.4 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: traefik
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: traefik-dynamic
|
|
namespace: traefik
|
|
data:
|
|
dynamic.yml: |
|
|
http:
|
|
serversTransports:
|
|
insecureTransport:
|
|
insecureSkipVerify: true
|
|
middlewares.yml: |
|
|
http:
|
|
middlewares:
|
|
# HTTPS Redirect
|
|
redirect-https:
|
|
redirectScheme:
|
|
scheme: https
|
|
permanent: true
|
|
# Cloudflare IP Whitelist
|
|
cloudflare-ipwhitelist:
|
|
ipWhiteList:
|
|
sourceRange:
|
|
- "173.245.48.0/20"
|
|
- "103.21.244.0/22"
|
|
- "103.22.200.0/22"
|
|
- "103.31.4.0/22"
|
|
- "141.101.64.0/18"
|
|
- "108.162.192.0/18"
|
|
- "190.93.240.0/20"
|
|
- "188.114.96.0/20"
|
|
- "197.234.240.0/22"
|
|
- "198.41.128.0/17"
|
|
- "162.158.0.0/15"
|
|
- "104.16.0.0/13"
|
|
- "104.24.0.0/14"
|
|
- "172.64.0.0/13"
|
|
- "131.0.72.0/22"
|
|
|
|
# Authentik + secure headers
|
|
security-chain:
|
|
chain:
|
|
middlewares:
|
|
- authentik@file
|
|
- security-headers@file
|
|
authentik:
|
|
forwardAuth:
|
|
address: "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik"
|
|
trustForwardHeader: true
|
|
maxResponseBodySize: 1048576
|
|
authResponseHeaders:
|
|
- X-authentik-username
|
|
- X-authentik-groups
|
|
- X-authentik-email
|
|
- X-authentik-name
|
|
- X-authentik-uid
|
|
- X-authentik-jwt
|
|
- X-authentik-meta-jwks
|
|
- X-authentik-meta-outpost
|
|
- X-authentik-meta-provider
|
|
- X-authentik-meta-app
|
|
- X-authentik-meta-version
|
|
|
|
# Security Headers
|
|
security-headers:
|
|
headers:
|
|
browserXssFilter: true
|
|
contentTypeNosniff: true
|
|
forceSTSHeader: true
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
stsSeconds: 31536000
|
|
customFrameOptionsValue: "SAMEORIGIN"
|
|
customResponseHeaders:
|
|
X-Content-Type-Options: "nosniff"
|
|
Referrer-Policy: "strict-origin-when-cross-origin"
|
|
|
|
# Nextcloud specific headers
|
|
nextcloud-secure-headers:
|
|
headers:
|
|
hostsProxyHeaders:
|
|
- "X-Forwarded-Host"
|
|
- "X-Forwarded-Proto"
|
|
referrerPolicy: "same-origin"
|
|
customFrameOptionsValue: "SAMEORIGIN"
|
|
|
|
# Rate limiting
|
|
rate-limit:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 50
|
|
period: 1m
|
|
|
|
# Nextcloud chain
|
|
nextcloud-chain:
|
|
chain:
|
|
middlewares:
|
|
- nextcloud-secure-headers@file
|
|
- security-headers@file
|
|
|
|
# Error pages
|
|
error-pages:
|
|
errors:
|
|
status:
|
|
- "400"
|
|
- "402-599"
|
|
service: error-pages-service.error-pages@kubernetescrd
|
|
query: /{status}.html
|
|
tls.yml: |
|
|
# TLS Configuration
|
|
tls:
|
|
options:
|
|
default:
|
|
minVersion: VersionTLS12
|
|
sniStrict: false
|
|
cipherSuites:
|
|
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
|
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
|
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|