add onlyoffice, and ingress revision

deploy/infra/onlyoffice/ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: office-limbosolutions-com
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    kubernetes.io/ingress.class: traefik
+spec:
+  entryPoints:
+    - websecure
+    - public-https
+  routes:
+    - match: Host(`office.limbosolutions.com`)
+      kind: Rule
+      services:
+        - name: onlyoffice
+          port: 80
+      middlewares:
+          - name: onlyoffice-headers
+          - name: onlyoffice-security-headers
+          - name: rate-limit
+
+  tls:
+    secretName: office-limbosolutions-com-tls

deploy/infra/onlyoffice/middlewares.yaml

@@ -0,0 +1,31 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: onlyoffice-security-headers
+spec:
+  headers:
+    stsSeconds: 31536000
+    stsIncludeSubdomains: true
+    stsPreload: true
+    browserXssFilter: true
+    contentTypeNosniff: true
+    referrerPolicy: "no-referrer"
+    customResponseHeaders:
+      X-Content-Type-Options: "nosniff"
+      X-XSS-Protection: "1; mode=block"
+      X-Frame-Options: "ALLOW-FROM https://cloud.limbosolutions.com"
+      Content-Security-Policy: "frame-ancestors https://cloud.limbosolutions.com"
+
+
+---
+# required because of only office, iframes being generated with http
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: onlyoffice-headers
+spec:
+  headers:
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+      X-Forwarded-Ssl: "on"
+      X-Forwarded-Port: "443"