forked from coop-cloud/traefik
dannygroenewegen
9a46c85735
* [x] I have deployed and tested my changes * [x] I have [updated relevant versions in `abra.sh`](https://docs.coopcloud.tech/maintainers/upgrade/#updating-versions-in-the-abrash) * [x] I have made my environment variable changes [backwards compatible](https://docs.coopcloud.tech/maintainers/upgrade/#backwards-compatible-environment-variable-changes) * [x] I have added a [release note entry](https://docs.coopcloud.tech/maintainers/upgrade/#creating-new-release-notes) This fixes #94 . The monitoring-ng recipe uses this metrics endpoint and is updated to use the secure endpoint with coop-cloud/monitoring-ng#17 Reviewed-on: coop-cloud/traefik#95 Reviewed-by: p4u1 <p4u1@noreply.git.coopcloud.tech> Reviewed-by: decentral1se <decentral1se@noreply.git.coopcloud.tech> Co-authored-by: Danny Groenewegen <mail@dannygroenewegen.nl> Co-committed-by: Danny Groenewegen <mail@dannygroenewegen.nl>
64 lines
1.7 KiB
Cheetah
64 lines
1.7 KiB
Cheetah
---
|
|
http:
|
|
middlewares:
|
|
{{ if eq (env "KEYCLOAK_MIDDLEWARE_ENABLED") "1" }}
|
|
keycloak:
|
|
forwardAuth:
|
|
address: "http://{{ env "KEYCLOAK_TFA_SERVICE" }}:4181"
|
|
trustForwardHeader: true
|
|
authResponseHeaders:
|
|
- X-Forwarded-User
|
|
{{ end }}
|
|
{{ if eq (env "KEYCLOAK_MIDDLEWARE_2_ENABLED") "1" }}
|
|
keycloak2:
|
|
forwardAuth:
|
|
address: "http://{{ env "KEYCLOAK_TFA_SERVICE_2" }}:4181"
|
|
trustForwardHeader: true
|
|
authResponseHeaders:
|
|
- X-Forwarded-User
|
|
{{ end }}
|
|
{{ if eq (env "BASIC_AUTH") "1" }}
|
|
basicauth:
|
|
basicAuth:
|
|
usersFile: "/run/secrets/usersfile"
|
|
{{ end }}
|
|
security:
|
|
headers:
|
|
frameDeny: true
|
|
browserXssFilter: true
|
|
contentTypeNosniff: true
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
stsSeconds: "31536000"
|
|
{{ if eq (env "METRICS_ENABLED") "1" }}
|
|
routers:
|
|
traefik-metrics:
|
|
rule: "Host(`{{ env "METRICS_FQDN" }}`)"
|
|
entrypoints:
|
|
- web-secure
|
|
tls:
|
|
certResolver: {{ env "LETS_ENCRYPT_ENV" }}
|
|
middlewares:
|
|
- basicauth@file
|
|
service: prometheus@internal
|
|
{{ end }}
|
|
|
|
tls:
|
|
options:
|
|
default:
|
|
minVersion: VersionTLS12
|
|
cipherSuites:
|
|
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
|
|
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 # TLS 1.2
|
|
- TLS_AES_256_GCM_SHA384 # TLS 1.3
|
|
- TLS_CHACHA20_POLY1305_SHA256 # TLS 1.3
|
|
curvePreferences:
|
|
- CurveP521
|
|
- CurveP384
|
|
- CurveP256
|
|
sniStrict: true
|
|
{{ if eq (env "WILDCARDS_ENABLED") "1" }}
|
|
certificates:
|
|
- certFile: /run/secrets/ssl_cert
|
|
keyFile: /run/secrets/ssl_key
|
|
{{ end }} |