SECURITY - PLATFORM: add staging hardening baseline

2026-05-12 12:57:56 +03:00
parent 95072586b9
commit 0e462012da
5 changed files with 377 additions and 2 deletions
@@ -0,0 +1,57 @@
+{
+	email {$ACME_EMAIL}
+}
+
+http://{$AUTH_DOMAIN} {
+	redir https://{host}{uri} permanent
+}
+
+http://{$LAUNCHER_DOMAIN} {
+	redir https://{host}{uri} permanent
+}
+
+http://{$TASK_DOMAIN} {
+	redir https://{host}{uri} permanent
+}
+
+{$AUTH_DOMAIN} {
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+	}
+
+	@auth_root path /
+	redir @auth_root https://{$LAUNCHER_DOMAIN}/ 302
+
+	@auth_user_dashboard path /if/user /if/user/*
+	redir @auth_user_dashboard https://{$LAUNCHER_DOMAIN}/ 302
+
+	reverse_proxy authentik-server:9000 {
+		header_up Host {host}
+		header_up X-Forwarded-Proto {scheme}
+		header_up X-Forwarded-For {remote_host}
+	}
+}
+
+{$LAUNCHER_DOMAIN} {
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+	}
+
+	reverse_proxy {$STAGING_LAUNCHER_UPSTREAM} {
+		header_up Host {host}
+		header_up X-Forwarded-Proto {scheme}
+		header_up X-Forwarded-For {remote_host}
+	}
+}
+
+{$TASK_DOMAIN} {
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+	}
+
+	reverse_proxy {$STAGING_TASK_MANAGER_UPSTREAM} {
+		header_up Host {host}
+		header_up X-Forwarded-Proto {scheme}
+		header_up X-Forwarded-For {remote_host}
+	}
+}