# services/vault/middleware.yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-security-headers
  namespace: vault
spec:
  headers:
    contentSecurityPolicy: "default-src 'none'; connect-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'unsafe-inline' 'self'; form-action 'none'; frame-ancestors 'none'; font-src 'self'"
    contentTypeNosniff: true
    frameDeny: true
    referrerPolicy: no-referrer
    permissionsPolicy: "camera=(), geolocation=(), microphone=(), payment=(), usb=()"
    stsSeconds: 31536000
    stsIncludeSubdomains: false
    stsPreload: false

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-response-cleanup
  namespace: vault
spec:
  headers:
    customResponseHeaders:
      Server: ""
      Cross-Origin-Resource-Policy: same-origin
      X-Download-Options: noopen
      X-Permitted-Cross-Domain-Policies: none
      X-Powered-By: ""
      X-Robots-Tag: "noindex, nofollow, noarchive"
      X-Vault-Cluster: ""
      X-Vault-Index: ""
      X-Vault-Known-Leader: ""
      X-Vault-Namespace: ""

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-edge-rate-limit
  namespace: vault
spec:
  rateLimit:
    average: 120
    burst: 240

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-edge-inflight
  namespace: vault
spec:
  inFlightReq:
    amount: 100

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-public-chain
  namespace: vault
spec:
  chain:
    middlewares:
      - name: vault-edge-rate-limit
      - name: vault-edge-inflight
      - name: vault-response-cleanup
      - name: vault-security-headers