34553f3bec
Mirrors the prod deploy-k3s/ setup but runs all services in-cluster on a single node: PostgreSQL (replaces Neon), MinIO S3-compatible storage (replaces B2), Redis, API, worker, and admin. Includes fully automated setup scripts (00-init through 04-verify), server hardening (SSH, fail2ban, ufw), Let's Encrypt TLS via Traefik, network policies, RBAC, and security contexts matching prod. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
46 lines
1.1 KiB
YAML
46 lines
1.1 KiB
YAML
# Traefik CRD middleware for rate limiting
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: rate-limit
|
|
namespace: honeydue
|
|
spec:
|
|
rateLimit:
|
|
average: 100
|
|
burst: 200
|
|
period: 1m
|
|
|
|
---
|
|
# Security headers
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: security-headers
|
|
namespace: honeydue
|
|
spec:
|
|
headers:
|
|
frameDeny: true
|
|
contentTypeNosniff: true
|
|
browserXssFilter: true
|
|
referrerPolicy: "strict-origin-when-cross-origin"
|
|
customResponseHeaders:
|
|
X-Content-Type-Options: "nosniff"
|
|
X-Frame-Options: "DENY"
|
|
Strict-Transport-Security: "max-age=31536000; includeSubDomains"
|
|
Content-Security-Policy: "default-src 'self'; frame-ancestors 'none'"
|
|
Permissions-Policy: "camera=(), microphone=(), geolocation=()"
|
|
X-Permitted-Cross-Domain-Policies: "none"
|
|
|
|
---
|
|
# Admin basic auth — additional auth layer for admin panel
|
|
# Secret created by 02-setup-secrets.sh from config.yaml credentials
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: admin-auth
|
|
namespace: honeydue
|
|
spec:
|
|
basicAuth:
|
|
secret: admin-basic-auth
|
|
realm: "honeyDue Admin"
|