Configuración traefik

dynamic.yml · 2.2 KiB · YAML Eredeti

http: middlewares: myauth: basicAuth: usersfile: /users.txt crowdsec-bouncer: forwardauth: address: http://bouncer-traefik:8080/api/v1/forwardAuth trustForwardHeader: true oidc-auth: plugin: traefik-oidc-auth: Secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Provider: ClientId: xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxx ClientSecret: xxxxxxxxxxxxxxxx Url: https://pocketid.servidor.es/ TokenValidation: IdToken Scopes: - openid - profile - email real-ip-plugin: plugin: real-ip: Proxy: - proxyHeadername: X-From-Cdn proxyHeadervalue: mf-fun realIP: X-Forwarded-For - proxyHeadername: X-From-Cdn proxyHeadervalue: mf-bar realIP: Client-Ip OverwriteXFF: true # default: false, v1.0.2 or above - proxyHeadername: X-From-Cdn proxyHeadervalue: cf-foo realIP: Cf-Connecting-Ip OverwriteXFF: true # default: false, v1.0.2 or above - proxyHeadername: "*" realIP: RemoteAddr default: chain: middlewares: - gzip - default-security-headers gzip: compress: {} default-security-headers: headers: browserXssFilter: true # X-XSS-Protection=1; mode=block contentTypeNosniff: true # X-Content-Type-Options=nosniff customResponseHeaders: X-Robots-Tag: "all" forceSTSHeader: true # Add the Strict-Transport-Security header even when the connection is HTTP frameDeny: true # X-Frame-Options=deny referrerPolicy: "strict-origin-when-cross-origin" stsIncludeSubdomains: true # Add includeSubdomains to the Strict-Transport-Security header stsPreload: true # Add preload flag appended to the Strict-Transport-Security header stsSeconds: 63072000

1	http:
2	middlewares:
3	myauth:
4	basicAuth:
5	usersfile: /users.txt
6	crowdsec-bouncer:
7	forwardauth:
8	address: http://bouncer-traefik:8080/api/v1/forwardAuth
9	trustForwardHeader: true
10	oidc-auth:
11	plugin:
12	traefik-oidc-auth:
13	Secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
14	Provider:
15	ClientId: xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxx
16	ClientSecret: xxxxxxxxxxxxxxxx
17	Url: https://pocketid.servidor.es/
18	TokenValidation: IdToken
19	Scopes:
20	- openid
21	- profile
22	- email
23	real-ip-plugin:
24	plugin:
25	real-ip:
26	Proxy:
27	- proxyHeadername: X-From-Cdn
28	proxyHeadervalue: mf-fun
29	realIP: X-Forwarded-For
30	- proxyHeadername: X-From-Cdn
31	proxyHeadervalue: mf-bar
32	realIP: Client-Ip
33	OverwriteXFF: true # default: false, v1.0.2 or above
34	- proxyHeadername: X-From-Cdn
35	proxyHeadervalue: cf-foo
36	realIP: Cf-Connecting-Ip
37	OverwriteXFF: true # default: false, v1.0.2 or above
38	- proxyHeadername: "*"
39	realIP: RemoteAddr
40	default:
41	chain:
42	middlewares:
43	- gzip
44	- default-security-headers
45	gzip:
46	compress: {}
47	default-security-headers:
48	headers:
49	browserXssFilter: true # X-XSS-Protection=1; mode=block
50	contentTypeNosniff: true # X-Content-Type-Options=nosniff
51	customResponseHeaders:
52	X-Robots-Tag: "all"
53	forceSTSHeader: true # Add the Strict-Transport-Security header even when the connection is HTTP
54	frameDeny: true # X-Frame-Options=deny
55	referrerPolicy: "strict-origin-when-cross-origin"
56	stsIncludeSubdomains: true # Add includeSubdomains to the Strict-Transport-Security header
57	stsPreload: true # Add preload flag appended to the Strict-Transport-Security header
58	stsSeconds: 63072000

traefik.yml · 1.3 KiB · YAML Eredeti

1	api:
2	dashboard: true
3
4	entryPoints:
5	web:
6	address: ":80"
7	http:
8	redirections:
9	entryPoint:
10	to: websecure
11	scheme: https
12	permanent: true
13	websecure:
14	address: ":443"
15	forwardedHeaders:
16	trustedIPs:
17	- "127.0.0.1/32"
18	- "172.0.0.1/32"
19	http:
20	tls:
21	certResolver: letsencrypt
22
23	serversTransport:
24	maxIdleConnsPerHost: 1
25
26	providers:
27	docker:
28	endpoint: "unix:///var/run/docker.sock"
29	exposedByDefault: false
30	network: proxy
31	file:
32	filename: /dynamic.yml
33
34	log:
35	level: ERROR
36	filePath: "/var/log/traefik/traefik.log"
37	accessLog:
38	filePath: "/var/log/traefik/access.log"
39	bufferingSize: 100
40	fields:
41	defaultMode: keep
42	names:
43	ClientUsername: keep
44	headers:
45	defaultMode: keep
46	names:
47	Content-Type: keep
48	X-Forwarded-For: keep
49	filters:
50	statusCodes:
51	- "300-302"
52	- "400-409"
53	retryAttempts: true
54	minDuration: "10ms"
55
56	certificatesResolvers:
57	letsencrypt:
58	acme:
59	email: correo@correo.es
60	storage: acme.json
61	httpChallenge:
62	entryPoint: web
63	experimental:
64	plugins:
65	real-ip:
66	moduleName: github.com/Paxxs/traefik-get-real-ip
67	version: "v1.0.3"
68	traefik-oidc-auth:
69	moduleName: "github.com/sevensolutions/traefik-oidc-auth"
70	version: "v0.11.0"