claw
24d0ab736c
- Change ingressClassName from nginx to traefik - Replace nginx configuration-snippet annotations with Traefik router annotations - Extract security headers into dedicated Traefik Middleware CRD - Update CI/CD pipeline to apply middleware manifest - Document migration decision and deployment steps in README ADR-002: Ingress Controller Migration (nginx → Traefik) Migration strategy: in-place update
23 lines
1.1 KiB
YAML
23 lines
1.1 KiB
YAML
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: security-headers
|
|
namespace: openclaw-private
|
|
labels:
|
|
app.kubernetes.io/name: signalledger
|
|
app.kubernetes.io/component: middleware
|
|
app.kubernetes.io/part-of: signalledger
|
|
spec:
|
|
headers:
|
|
customRequestHeaders:
|
|
X-Forwarded-Proto: "https"
|
|
customResponseHeaders:
|
|
Strict-Transport-Security: "max-age=31536000; includeSubDomains; preload"
|
|
X-Frame-Options: "DENY"
|
|
X-Content-Type-Options: "nosniff"
|
|
Referrer-Policy: "strict-origin-when-cross-origin"
|
|
Content-Security-Policy: "default-src 'self'; script-src 'self' 'unsafe-inline' https://pagead2.googlesyndication.com https://partner.googleadservices.com https://tpc.googlesyndication.com; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self'; frame-src https://googleads.g.doubleclick.net; object-src 'none'; base-uri 'self'; form-action 'self';"
|
|
X-XSS-Protection: "1; mode=block"
|
|
Permissions-Policy: "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
|
|
sslRedirect: true
|