Improve SSL rating #8

2020-10-27T11:58:29Z

decentral1se commented

2020-10-27 11:58:29 +00:00

Following https://git.autonomic.zone/coop-cloud/traefik/issues/4.

According to https://tferdinand.net/en/traefik-2-tls-configuration/.

I'm refactoring the FILE_PROVIDER_ENABLED out to a new env var:

KEYCLOAK_MIDDLEWARE_ENABLED=1/0

Because now, we'll always want to use this new label:

- "traefik.http.routers.${STACK_NAME}.tls.options=default@file"
- "traefik.http.routers.${STACK_NAME}.middlewares=security@file"

Because it gives us good SSL ratings. This means, we'll always want to include the file-provider.yml in whatever Traefik deployment we have. And sometimes disable the Keycloak support.

I'm currently deploying this for our swarm traefik + autonomic.zone...

Will report back...

Following https://git.autonomic.zone/coop-cloud/traefik/issues/4. According to https://tferdinand.net/en/traefik-2-tls-configuration/. I'm refactoring the `FILE_PROVIDER_ENABLED` out to a new env var: - `KEYCLOAK_MIDDLEWARE_ENABLED=1/0` Because now, we'll *always* want to use this new label: - `- "traefik.http.routers.${STACK_NAME}.tls.options=default@file"` - `- "traefik.http.routers.${STACK_NAME}.middlewares=security@file"` Because it gives us good SSL ratings. This means, we'll always want to include the `file-provider.yml` in whatever Traefik deployment we have. And sometimes disable the Keycloak support. I'm currently deploying this for our swarm traefik + autonomic.zone... Will report back...

decentral1se commented

2020-10-27 12:20:43 +00:00

Was working with this env vars diff:

diff --git a/traefik.autonomic.zone.env b/traefik.autonomic.zone.env
index f772ae0..eb8555a 100644
--- a/traefik.autonomic.zone.env
+++ b/traefik.autonomic.zone.env
@@ -14,9 +14,9 @@ export TRAEFIK_YML_VERSION=v1
 
 # Enable Keycloak
 export COMPOSE_FILE="compose.yml:compose.keycloak.yml:compose.smtp.yml"
-export FILE_PROVIDER_ENABLED=1
 
 # Options for file-provider / Keycloak SSO
+export KEYCLOAK_MIDDLEWARE_ENABLED=1
 export FILE_PROVIDER_YML_VERSION=v1
 
 # SMTP setup enabled

Was working with this env vars diff: ```diff diff --git a/traefik.autonomic.zone.env b/traefik.autonomic.zone.env index f772ae0..eb8555a 100644 --- a/traefik.autonomic.zone.env +++ b/traefik.autonomic.zone.env @@ -14,9 +14,9 @@ export TRAEFIK_YML_VERSION=v1 # Enable Keycloak export COMPOSE_FILE="compose.yml:compose.keycloak.yml:compose.smtp.yml" -export FILE_PROVIDER_ENABLED=1 # Options for file-provider / Keycloak SSO +export KEYCLOAK_MIDDLEWARE_ENABLED=1 export FILE_PROVIDER_YML_VERSION=v1 # SMTP setup enabled ```

decentral1se changed title from ~~WIP: improve SSL rating~~ to Improve SSL rating

2020-10-27 12:45:55 +00:00

decentral1se commented

2020-10-27 12:46:30 +00:00