# services/vault/middleware.yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-security-headers
  namespace: vault
spec:
  headers:
    contentTypeNosniff: true
    frameDeny: true
    referrerPolicy: no-referrer
    permissionsPolicy: "camera=(), geolocation=(), microphone=(), payment=(), usb=()"
    stsSeconds: 31536000
    stsIncludeSubdomains: false
    stsPreload: false

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-response-cleanup
  namespace: vault
spec:
  headers:
    customResponseHeaders:
      Server: ""
      X-Powered-By: ""
      X-Vault-Cluster: ""
      X-Vault-Namespace: ""

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-edge-rate-limit
  namespace: vault
spec:
  rateLimit:
    average: 120
    burst: 240

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-edge-inflight
  namespace: vault
spec:
  inFlightReq:
    amount: 100

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-api-forward-auth
  namespace: vault
spec:
  forwardAuth:
    address: http://oauth2-proxy.sso.svc.cluster.local/oauth2/auth
    trustForwardHeader: true
    authResponseHeaders:
      - Authorization
      - X-Auth-Request-Email
      - X-Auth-Request-User
      - X-Auth-Request-Groups

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-public-chain
  namespace: vault
spec:
  chain:
    middlewares:
      - name: vault-edge-rate-limit
      - name: vault-edge-inflight
      - name: vault-response-cleanup
      - name: vault-security-headers

---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vault-api-chain
  namespace: vault
spec:
  chain:
    middlewares:
      - name: vault-edge-rate-limit
      - name: vault-edge-inflight
      - name: vault-api-forward-auth
      - name: vault-response-cleanup
      - name: vault-security-headers