84 lines
2.8 KiB
YAML
84 lines
2.8 KiB
YAML
http:
|
|
middlewares:
|
|
# ── Redirect ──────────────────────────────────────────────
|
|
redirect-to-https:
|
|
redirectScheme:
|
|
scheme: https
|
|
permanent: true
|
|
|
|
# ── Real IP (Cloudflare) ──────────────────────────────────
|
|
real-ip:
|
|
plugin:
|
|
traefik-warp:
|
|
provider: auto
|
|
autoRefresh: true
|
|
refreshInterval: 24h
|
|
debug: false
|
|
|
|
# ── Geo Block ─────────────────────────────────────────────
|
|
geoblock:
|
|
plugin:
|
|
geoblock:
|
|
silentStartUp: false
|
|
allowLocalRequests: true
|
|
logLocalRequests: false
|
|
logAllowedRequests: false
|
|
logApiRequests: false
|
|
api: "https://get.geojs.io/v1/ip/country/{ip}"
|
|
apiTimeoutMs: 500
|
|
cacheSize: 25
|
|
forceMonthlyUpdate: true
|
|
allowUnknownCountries: false
|
|
unknownCountryApiResponse: "nil"
|
|
countries:
|
|
- "US"
|
|
|
|
# ── CrowdSec ──────────────────────────────────────────────
|
|
crowdsec-bouncer:
|
|
plugin:
|
|
crowdsec-bouncer:
|
|
enabled: true
|
|
crowdsecMode: stream
|
|
crowdsecLapiKey: '{{ env "CROWDSEC_BOUNCER_API_KEY" }}'
|
|
crowdsecLapiHost: "crowdsec:8080"
|
|
crowdsecLapiScheme: "http"
|
|
crowdsecAppsecEnabled: true
|
|
crowdsecAppsecHost: "crowdsec:7422"
|
|
crowdsecAppsecFailureBlock: true
|
|
crowdsecAppsecUnreachableBlock: true
|
|
|
|
# ── Security Headers ──────────────────────────────────────
|
|
security-headers:
|
|
headers:
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
forceSTSHeader: true
|
|
contentTypeNosniff: true
|
|
browserXssFilter: true
|
|
referrerPolicy: "strict-origin-when-cross-origin"
|
|
permissionsPolicy: "camera=(), microphone=(), geolocation=()"
|
|
customFrameOptionsValue: "SAMEORIGIN"
|
|
|
|
# ── Rate Limit ────────────────────────────────────────────
|
|
rate-limit:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 50
|
|
period: 1s
|
|
|
|
routers:
|
|
http-catchall:
|
|
rule: "HostRegexp(`{host:.+}`)"
|
|
entrypoints:
|
|
- web
|
|
middlewares:
|
|
- redirect-to-https
|
|
service: dummy-svc
|
|
priority: 1
|
|
|
|
services:
|
|
dummy-svc:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://localhost" |