---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: security-headers
  namespace: towerops
spec:
  headers:
    # HSTS - Force HTTPS for 1 year, include subdomains, allow preloading
    # WARNING: Only enable after confirming HTTPS works correctly!
    # Once set, browsers will REFUSE to connect via HTTP for 1 year
    customResponseHeaders:
      Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"

      # Permissions-Policy - Disable unnecessary browser features
      # Adjust based on your needs (e.g., if you use geolocation, remove it from the deny list)
      Permissions-Policy: "geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()"

      # X-Permitted-Cross-Domain-Policies - Prevent Adobe Flash/PDF from loading data
      X-Permitted-Cross-Domain-Policies: "none"
---
# Example: How to apply this middleware to your IngressRoute
# You would add this to your existing IngressRoute in k8s/ingressroute.yaml
#
# apiVersion: traefik.io/v1alpha1
# kind: IngressRoute
# metadata:
#   name: towerops-web
#   namespace: towerops
# spec:
#   entryPoints:
#     - websecure
#   routes:
#     - kind: Rule
#       match: Host(`towerops.net`) || Host(`www.towerops.net`)
#       middlewares:
#         - name: security-headers  # <-- Add this line
#       services:
#         - name: towerops-web
#           port: 4000
#   tls:
#     certResolver: letsencrypt