Jeppe Bundgaard
dd33fa2b19
- Add origin-specific CORS settings to Traefik for `truckwash.io` with credentials support. - Simplify and standardize CORS headers in Caddy, removing upstream duplication and adjusting preflight logic.
85 lines
2.5 KiB
YAML
85 lines
2.5 KiB
YAML
http:
|
|
routers:
|
|
# Nextcloud proxy (directly from Traefik to external server)
|
|
cloud:
|
|
rule: Host(`cloud.truckwash.dk`)
|
|
entryPoints: [websecure]
|
|
service: cloud-svc
|
|
tls:
|
|
certResolver: le
|
|
cloud-http:
|
|
rule: Host(`cloud.truckwash.dk`)
|
|
entryPoints: [web]
|
|
middlewares: [redirect-to-https]
|
|
service: cloud-svc
|
|
|
|
# Dashboard routers are declared via labels; middlewares are defined below.
|
|
|
|
middlewares:
|
|
redirect-to-https:
|
|
redirectScheme:
|
|
scheme: https
|
|
dashboard-auth:
|
|
basicAuth:
|
|
# IMPORTANT: Replace REPLACE_WITH_BCRYPT_HASH with a bcrypt/htpasswd hash for user 'truckwash'.
|
|
# Example command to generate (once Docker is available):
|
|
# docker run --rm httpd:2.4-alpine htpasswd -nbB truckwash 'w5j9MlEVz62Exm6r'
|
|
users:
|
|
- "truckwash:$2y$05$DYcMFqMPgEFWAJQioc.F3.v9ppi9bReAi/aQzoOlWqMyhIysKlDCC"
|
|
dashboard-allow-local:
|
|
ipWhiteList:
|
|
sourceRange:
|
|
- 127.0.0.1/32
|
|
- 10.0.0.0/8
|
|
- 172.16.0.0/12
|
|
- 192.168.0.0/16
|
|
secure-headers:
|
|
headers:
|
|
sslRedirect: true
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: false
|
|
contentTypeNosniff: true
|
|
browserXssFilter: true
|
|
referrerPolicy: "strict-origin-when-cross-origin"
|
|
customFrameOptionsValue: "SAMEORIGIN"
|
|
permissionsPolicy: "geolocation=(), microphone=(), camera=(), payment=()"
|
|
addVaryHeader: true
|
|
# CORS: allow all origins (with credentials). Attach this middleware where needed.
|
|
accessControlAllowOriginList:
|
|
- "https://truckwash.io"
|
|
accessControlAllowMethods:
|
|
- GET
|
|
- POST
|
|
- PUT
|
|
- PATCH
|
|
- DELETE
|
|
- OPTIONS
|
|
accessControlAllowHeaders:
|
|
- "*"
|
|
accessControlAllowCredentials: true
|
|
accessControlMaxAge: 86400
|
|
api-ratelimit:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 200
|
|
|
|
services:
|
|
cloud-svc:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://94.130.142.41:11000"
|
|
|
|
tls:
|
|
options:
|
|
default:
|
|
minVersion: VersionTLS12
|
|
sniStrict: true
|
|
cipherSuites:
|
|
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
|
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
|
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
|
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
|
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
|
|
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|