46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
|
# Shared Traefik middlewares (file provider).
|
||
|
|
# Applied via Docker labels / IngressRoute references.
|
||
|
|
|
||
|
|
http:
|
||
|
|
middlewares:
|
||
|
|
redirect-https:
|
||
|
|
redirectScheme:
|
||
|
|
scheme: https
|
||
|
|
permanent: true
|
||
|
|
|
||
|
|
security-headers:
|
||
|
|
headers:
|
||
|
|
stsSeconds: 31536000
|
||
|
|
stsIncludeSubdomains: true
|
||
|
|
stsPreload: false
|
||
|
|
contentTypeNosniff: true
|
||
|
|
browserXssFilter: true
|
||
|
|
frameDeny: true
|
||
|
|
referrerPolicy: strict-origin-when-cross-origin
|
||
|
|
permissionsPolicy: "camera=(), microphone=(), geolocation=()"
|
||
|
|
customResponseHeaders:
|
||
|
|
Server: ""
|
||
|
|
Content-Security-Policy: >-
|
||
|
|
default-src 'self'; base-uri 'self'; form-action 'self';
|
||
|
|
frame-ancestors 'none'; object-src 'none';
|
||
|
|
script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';
|
||
|
|
img-src 'self' data: blob:; font-src 'self' data:;
|
||
|
|
media-src 'self' blob:; connect-src 'self' ws: wss:;
|
||
|
|
worker-src 'self' blob:
|
||
|
|
|
||
|
|
compress:
|
||
|
|
compress: {}
|
||
|
|
|
||
|
|
noindex:
|
||
|
|
headers:
|
||
|
|
customResponseHeaders:
|
||
|
|
X-Robots-Tag: "noindex, nofollow, noarchive"
|
||
|
|
|
||
|
|
# Strip client-supplied forwarding headers before Traefik re-adds trusted ones.
|
||
|
|
# Backend trusts X-Forwarded-* only from TRUSTED_PROXY_CIDRS (Docker/k8s nets).
|
||
|
|
strip-forwarded:
|
||
|
|
headers:
|
||
|
|
customRequestHeaders:
|
||
|
|
X-Real-IP: ""
|
||
|
|
X-Forwarded-For: ""
|