Add production-ready Traefik configuration with secure headers, TLS settings, and rate limiting

2026-02-16 11:39:28 +01:00
parent 21f64bbb5f
commit a709656ba3
3 changed files with 86 additions and 0 deletions
@@ -33,9 +33,38 @@ http:
          - 10.0.0.0/8
          - 172.16.0.0/12
          - 192.168.0.0/16
+    secure-headers:
+      headers:
+        sslRedirect: true
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: false
+        contentTypeNosniff: true
+        browserXssFilter: true
+        referrerPolicy: "strict-origin-when-cross-origin"
+        customFrameOptionsValue: "SAMEORIGIN"
+        permissionsPolicy: "geolocation=(), microphone=(), camera=(), payment=()"
+        addVaryHeader: true
+    api-ratelimit:
+      rateLimit:
+        average: 100
+        burst: 200

  services:
    cloud-svc:
      loadBalancer:
        servers:
          - url: "http://94.130.142.41:11000"
+
+tls:
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true
+      cipherSuites:
+        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305