add middlewares (source nginx template on source helm values), and default_phone_region

deploy/infra/ingress-web-public.yaml

@@ -25,7 +25,6 @@ spec:
           - name: nextcloud-security-headers
           - name: rate-limit
 
-
     # PUBLIC SHARES (NO SSO)
     - match: Host(`cloud.limbosolutions.com`) &&
             (PathPrefix(`/s/`) ||
@@ -39,6 +38,7 @@ spec:
       middlewares:
         - name: rate-limit
         - name: nextcloud-security-headers
+        - name: nextcloud-deny-paths
 
     # Sync clients + mobile app (no SSO)
     - match: Host(`cloud.limbosolutions.com`) &&
@@ -58,6 +58,8 @@ spec:
       middlewares:
         - name: webdav-strip-auth
         - name: rate-limit
+        - name: nextcloud-deny-paths
+        - name: nextcloud-dav
 
     # 3) EVERYTHING ELSE (SSO REQUIRED)
     - match: Host(`cloud.limbosolutions.com`)
@@ -69,7 +71,9 @@ spec:
         # - name: authentik-forward-auth
          - name: nextcloud-security-headers
          - name: rate-limit
-
+         - name: nextcloud-deny-paths
+         - name: nextcloud-wellknown
+         - name: nextcloud-hostmeta
 
 
 

deploy/infra/ingress-web.yaml

@@ -22,6 +22,8 @@ spec:
       middlewares:
          - name: nextcloud-security-headers
          - name: rate-limit
-
-
+         - name: nextcloud-deny-paths
+         - name: nextcloud-wellknown
+         - name: nextcloud-hostmeta
+         - name: nextcloud-dav
 

deploy/infra/middlewares.yaml

@@ -36,6 +36,7 @@ spec:
     stsIncludeSubdomains: true
     stsPreload: true
     customResponseHeaders:
+      X-Powered-By: ""
       X-Content-Type-Options: "nosniff"
       X-Frame-Options: "SAMEORIGIN"
       X-XSS-Protection: "1; mode=block"
@@ -63,4 +64,59 @@ spec:
       - X-authentik-meta-provider
       - X-authentik-meta-app
       - X-authentik-meta-version
----
+---
+
+
+piVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-deny-paths
+spec:
+  redirectRegex:
+    regex: "^/(build|tests|config|lib|3rdparty|templates|data|autotest|occ|issue|indie|db_|console)"
+    replacement: "/"
+    permanent: false
+
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-dav
+spec:
+  redirectRegex:
+    regex: "^/.well-known/(carddav|caldav)$"
+    replacement: "/remote.php/dav"
+    permanent: true
+
+---
+
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-wellknown
+spec:
+  redirectRegex:
+    regex: "^/.well-known/(webfinger|nodeinfo)$"
+    replacement: "/index.php/.well-known/${1}"
+    permanent: true
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-hostmeta
+spec:
+  redirectRegex:
+    regex: "^/.well-known/host-meta$"
+    replacement: "/public.php?service=host-meta"
+    permanent: true
+---
+
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-hostmeta-json
+spec:
+  redirectRegex:
+    regex: "^/.well-known/host-meta.json$"
+    replacement: "/public.php?service=host-meta-json"
+    permanent: true