mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-09 00:54:42 +02:00
ALI YESILKAYA
fe0aa89ffa
- Traefik externalTrafficPolicy: Local → IP client réelle (fin du SNAT kube-proxy) - middleware ratelimit par IP (100/min, burst 200) sur les 6 routes publiques - middleware security-headers (HSTS, nosniff, X-Frame SAMEORIGIN, Referrer-Policy) - TLSOption globale : plancher TLS 1.2 + ciphers modernes - Guacamole REMOTE_IP_VALVE → ban anti-bruteforce par IP (fin du piège n°5) - nftables : fermeture des ports Internet legacy 9080/9081 (HTTP clair redondant) - allowCrossNamespace pour mutualiser les middlewares depuis infra - docs : section Durcissement (public-domain.md) + CAA OVH + pièges à jour Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
23 lines
578 B
YAML
23 lines
578 B
YAML
# Accès public HTTPS — auth.funklab.online (cert Let's Encrypt auto).
|
|
# S'ajoute à la route interne auth.lab.local (non destructif).
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: authentik-public
|
|
namespace: auth
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`auth.funklab.online`)
|
|
kind: Rule
|
|
middlewares:
|
|
- name: security-headers
|
|
namespace: infra
|
|
- name: ratelimit
|
|
namespace: infra
|
|
services:
|
|
- name: authentik
|
|
port: 9000
|
|
tls:
|
|
certResolver: letsencrypt
|