42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: security-headers
|
|
namespace: towerops
|
|
spec:
|
|
headers:
|
|
# HSTS - Force HTTPS for 1 year, include subdomains, allow preloading
|
|
# WARNING: Only enable after confirming HTTPS works correctly!
|
|
# Once set, browsers will REFUSE to connect via HTTP for 1 year
|
|
customResponseHeaders:
|
|
Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
|
|
|
|
# Permissions-Policy - Disable unnecessary browser features
|
|
# Adjust based on your needs (e.g., if you use geolocation, remove it from the deny list)
|
|
Permissions-Policy: "geolocation=(), microphone=(), camera=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()"
|
|
|
|
# X-Permitted-Cross-Domain-Policies - Prevent Adobe Flash/PDF from loading data
|
|
X-Permitted-Cross-Domain-Policies: "none"
|
|
---
|
|
# Example: How to apply this middleware to your IngressRoute
|
|
# You would add this to your existing IngressRoute in k8s/ingressroute.yaml
|
|
#
|
|
# apiVersion: traefik.io/v1alpha1
|
|
# kind: IngressRoute
|
|
# metadata:
|
|
# name: towerops-web
|
|
# namespace: towerops
|
|
# spec:
|
|
# entryPoints:
|
|
# - websecure
|
|
# routes:
|
|
# - kind: Rule
|
|
# match: Host(`towerops.net`) || Host(`www.towerops.net`)
|
|
# middlewares:
|
|
# - name: security-headers # <-- Add this line
|
|
# services:
|
|
# - name: towerops-web
|
|
# port: 4000
|
|
# tls:
|
|
# certResolver: letsencrypt
|