titan-iac/services/zot/middleware.yaml

# services/zot/middleware.yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: zot-resp-headers
  namespace: zot
spec:
  headers:
    customResponseHeaders:
      Docker-Distribution-Api-Version: "registry/2.0"
    accessControlAllowOriginList:
      - "*"
    accessControlAllowCredentials: true
    accessControlAllowHeaders:
      - Authorization
      - Content-Type
      - Docker-Distribution-Api-Version
      - X-Registry-Auth
    accessControlAllowMethods:
      - GET
      - HEAD
      - OPTIONS
      - POST
      - PUT
      - PATCH
      - DELETE

---

apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: zot-forward-auth
  namespace: zot
spec:
  forwardAuth:
    address: https://auth.bstein.dev/oauth2/auth
    trustForwardHeader: true
    authResponseHeaders:
      - Authorization
      - X-Auth-Request-Email
      - X-Auth-Request-User
      - X-Auth-Request-Groups