Jeppe Bundgaard
29a07e652c
- Add preflight routers and attach `secure-headers` middleware in Traefik for `api.truckwash.dk` and `cloud.truckwash.dk`. - Update `secure-headers` middleware with refined CORS headers and stricter origin/method/header configurations. - Remove redundant CORS logic in Caddy, delegating CORS management entirely to Traefik.
103 lines
3.0 KiB
YAML
103 lines
3.0 KiB
YAML
http:
|
|
routers:
|
|
# Nextcloud proxy (directly from Traefik to external server)
|
|
cloud:
|
|
rule: Host(`cloud.truckwash.dk`)
|
|
entryPoints: [websecure]
|
|
service: cloud-svc
|
|
middlewares: [secure-headers]
|
|
tls:
|
|
certResolver: le
|
|
cloud-http:
|
|
rule: Host(`cloud.truckwash.dk`)
|
|
entryPoints: [web]
|
|
middlewares: [redirect-to-https, secure-headers]
|
|
service: cloud-svc
|
|
|
|
# CORS preflight handlers (Traefik generates the OPTIONS response)
|
|
# Return an empty 204 from Traefik itself and attach CORS headers via the middleware.
|
|
api-preflight:
|
|
rule: Host(`api.truckwash.dk`) && Method(`OPTIONS`)
|
|
entryPoints: [websecure]
|
|
middlewares: [secure-headers]
|
|
service: noop@internal
|
|
priority: 1000
|
|
tls:
|
|
certResolver: le
|
|
|
|
cloud-preflight:
|
|
rule: Host(`cloud.truckwash.dk`) && Method(`OPTIONS`)
|
|
entryPoints: [websecure]
|
|
middlewares: [secure-headers]
|
|
service: noop@internal
|
|
priority: 1000
|
|
tls:
|
|
certResolver: le
|
|
|
|
# Dashboard routers are declared via labels; middlewares are defined below.
|
|
|
|
middlewares:
|
|
redirect-to-https:
|
|
redirectScheme:
|
|
scheme: https
|
|
dashboard-auth:
|
|
basicAuth:
|
|
# IMPORTANT: Replace REPLACE_WITH_BCRYPT_HASH with a bcrypt/htpasswd hash for user 'truckwash'.
|
|
# Example command to generate (once Docker is available):
|
|
# docker run --rm httpd:2.4-alpine htpasswd -nbB truckwash 'w5j9MlEVz62Exm6r'
|
|
users:
|
|
- "truckwash:$2y$05$DYcMFqMPgEFWAJQioc.F3.v9ppi9bReAi/aQzoOlWqMyhIysKlDCC"
|
|
dashboard-allow-local:
|
|
ipWhiteList:
|
|
sourceRange:
|
|
- 127.0.0.1/32
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
secure-headers:
|
|
headers:
|
|
contentTypeNosniff: true
|
|
browserXssFilter: true
|
|
referrerPolicy: "strict-origin-when-cross-origin"
|
|
customFrameOptionsValue: "SAMEORIGIN"
|
|
permissionsPolicy: "geolocation=(), microphone=(), camera=(), payment=()"
|
|
addVaryHeader: true
|
|
accessControlAllowCredentials: true
|
|
accessControlMaxAge: 86400
|
|
accessControlAllowOriginList:
|
|
- "https://truckwash.io"
|
|
accessControlAllowMethods:
|
|
- GET
|
|
- POST
|
|
- PUT
|
|
- PATCH
|
|
- DELETE
|
|
- OPTIONS
|
|
accessControlAllowHeaders:
|
|
- Authorization
|
|
- Content-Type
|
|
- X-Customer-Number
|
|
api-ratelimit:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 200
|
|
|
|
services:
|
|
cloud-svc:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://94.130.142.41:11000"
|
|
|
|
tls:
|
|
options:
|
|
default:
|
|
minVersion: VersionTLS12
|
|
sniStrict: true
|
|
cipherSuites:
|
|
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
|
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
|
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
|
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
|
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
|
|
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|