traefik: harden websecure defaults (crowdsec, headers, tls12)

2026-02-07 02:15:13 +08:00
parent 2d7c788202
commit dc2c7f46ae
10 changed files with 90 additions and 1 deletions
--- a/dynamic.d/middlewares/label-auth.yml
+++ b/dynamic.d/middlewares/label-auth.yml
@@ -0,0 +1,6 @@
+http:
+  middlewares:
+    label-auth:
+      basicAuth:
+        # Keep actual user hashes out of git.
+        usersFile: /secrets/label.htpasswd
--- a/dynamic.d/middlewares/secure-headers.yml
+++ b/dynamic.d/middlewares/secure-headers.yml
@@ -0,0 +1,12 @@
+http:
+  middlewares:
+    secure-headers:
+      headers:
+        contentTypeNosniff: true
+        frameDeny: true
+        referrerPolicy: "strict-origin-when-cross-origin"
+        # Intentionally no HSTS (per requirement).
+        customResponseHeaders:
+          server: ""
+          x-powered-by: ""
+