5acca5d4c7
All checks were successful
/ continuous-deploy (push) Successful in 23s
ingress/public: disabled authentik-forward-auth (problems with phone clients) middlewares/rate-limit: increase values middlewares/security-headers:- added sts - fix nextcloud warning Some headers are not set correctly on your instance - The Strict-Transport-Security HTTP header is not set (should be at least 15552000 seconds). For enhanced security, it is recommended to enable HSTS
66 lines
1.5 KiB
YAML
66 lines
1.5 KiB
YAML
# Strip Authorization header for WebDAV so Authentik doesn't try to interpret Basic Auth
|
|
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: webdav-strip-auth
|
|
spec:
|
|
headers:
|
|
customRequestHeaders:
|
|
Authorization: ""
|
|
|
|
---
|
|
# Rate limit to protect from brute force / bots
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: rate-limit
|
|
spec:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 500
|
|
|
|
---
|
|
# Optional: security headers for UI
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: nextcloud-security-headers
|
|
spec:
|
|
headers:
|
|
browserXssFilter: true
|
|
contentTypeNosniff: true
|
|
frameDeny: false
|
|
referrerPolicy: "no-referrer"
|
|
stsSeconds: 15552000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
customResponseHeaders:
|
|
X-Content-Type-Options: "nosniff"
|
|
X-Frame-Options: "SAMEORIGIN"
|
|
X-XSS-Protection: "1; mode=block"
|
|
---
|
|
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: authentik-forward-auth
|
|
spec:
|
|
forwardAuth:
|
|
address: "http://ak-outpost-authentik-embedded-outpost.id-limbosolutions-com.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik"
|
|
trustForwardHeader: true
|
|
|
|
authResponseHeaders:
|
|
- X-authentik-username
|
|
- X-authentik-groups
|
|
- X-authentik-entitlements
|
|
- X-authentik-email
|
|
- X-authentik-name
|
|
- X-authentik-uid
|
|
- X-authentik-jwt
|
|
- X-authentik-meta-jwks
|
|
- X-authentik-meta-outpost
|
|
- X-authentik-meta-provider
|
|
- X-authentik-meta-app
|
|
- X-authentik-meta-version
|
|
--- |