Traefik: HSTS

2023-09-25 22:34:28 +02:00 · 2023-09-25 22:34:28 +02:00 · b9ca14a4e1
commit b9ca14a4e1
parent ddefcdb550
2 changed files with 14 additions and 0 deletions
--- a/ansible/plays/services/traefik/dynamic.yaml
+++ b/ansible/plays/services/traefik/dynamic.yaml
@ -37,3 +37,13 @@ http:
      replacePathRegex:
        regex: "^/metrics$"
        replacement: "/"
+    hsts:
+      headers:
+        frameDeny: true
+        contentTypeNosniff: true
+        browserXssFilter: true
+        forceSTSHeader: true
+        sslRedirect: true
+        stsPreload: true
+        stsSeconds: 315360000
+        stsIncludeSubdomains: true
--- a/ansible/plays/services/traefik/traefik.yaml
+++ b/ansible/plays/services/traefik/traefik.yaml
@ -20,6 +20,8 @@ entryPoints:
          to: websecure
          scheme: https
          permanent: true
+      middlewares:
+        - "hsts@file"
  metrics:
    address: ":9091"
    http:
@ -28,6 +30,8 @@ entryPoints:
  websecure:
    address: ":443"
    http:
+      middlewares:
+        - "hsts@file"
      tls:
        certResolver: letsencrypt