traefik: harden websecure defaults (crowdsec, headers, tls12)

dynamic.d/routers/label.yml

@@ -0,0 +1,18 @@
+http:
+  routers:
+    label:
+      rule: Host(`label.gbanyan.net`)
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+        - label-auth
+      service: label
+
+  services:
+    label:
+      loadBalancer:
+        passHostHeader: true
+        servers:
+          - url: "http://127.0.0.1:5004"

dynamic.d/routers/usher.yml

@@ -0,0 +1,16 @@
+http:
+  routers:
+    usher:
+      rule: Host(`member.usher.org.tw`)
+      entryPoints:
+        - websecure
+      tls:
+        certResolver: letsencrypt
+      service: usher
+
+  services:
+    usher:
+      loadBalancer:
+        passHostHeader: true
+        servers:
+          - url: "http://10.0.0.225:8000"