72 lines
1.7 KiB
YAML
72 lines
1.7 KiB
YAML
# services/vault/middleware.yaml
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-security-headers
|
|
namespace: vault
|
|
spec:
|
|
headers:
|
|
contentSecurityPolicy: "default-src 'none'; connect-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'unsafe-inline' 'self'; form-action 'none'; frame-ancestors 'none'; font-src 'self'"
|
|
contentTypeNosniff: true
|
|
frameDeny: true
|
|
referrerPolicy: no-referrer
|
|
permissionsPolicy: "camera=(), geolocation=(), microphone=(), payment=(), usb=()"
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: false
|
|
stsPreload: false
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-response-cleanup
|
|
namespace: vault
|
|
spec:
|
|
headers:
|
|
customResponseHeaders:
|
|
Server: ""
|
|
Cross-Origin-Resource-Policy: same-origin
|
|
X-Download-Options: noopen
|
|
X-Permitted-Cross-Domain-Policies: none
|
|
X-Powered-By: ""
|
|
X-Robots-Tag: "noindex, nofollow, noarchive"
|
|
X-Vault-Cluster: ""
|
|
X-Vault-Index: ""
|
|
X-Vault-Known-Leader: ""
|
|
X-Vault-Namespace: ""
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-edge-rate-limit
|
|
namespace: vault
|
|
spec:
|
|
rateLimit:
|
|
average: 120
|
|
burst: 240
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-edge-inflight
|
|
namespace: vault
|
|
spec:
|
|
inFlightReq:
|
|
amount: 100
|
|
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: vault-public-chain
|
|
namespace: vault
|
|
spec:
|
|
chain:
|
|
middlewares:
|
|
- name: vault-edge-rate-limit
|
|
- name: vault-edge-inflight
|
|
- name: vault-response-cleanup
|
|
- name: vault-security-headers
|