jeremy
27f6d95bf6
Removals: openwebui and netclaw compose + Traefik routes (both decommissioned). Updates: litellm, n8n, vaultwarden, ai-agents, media, traefik routes, CLAUDE.md (nodes/ports/known-issues), agent definitions. Additions: Rongorongo tree, LinkedStorm plan, rename-bart spec, vllm brief, tls-options and security-headers Traefik config. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
61 lines
2.1 KiB
YAML
61 lines
2.1 KiB
YAML
http:
|
|
middlewares:
|
|
security-headers:
|
|
headers:
|
|
# HSTS - force browsers to use HTTPS for 1 year, include subdomains
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
# Prevent MIME-type sniffing
|
|
contentTypeNosniff: true
|
|
# Block rendering in iframes from other origins
|
|
frameDeny: true
|
|
# Referrer policy - send origin only on cross-origin requests
|
|
referrerPolicy: "strict-origin-when-cross-origin"
|
|
# Permissions policy - restrict browser features
|
|
permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
|
|
# Prevent browsers from caching sensitive responses
|
|
browserXssFilter: true
|
|
# Remove server identity header
|
|
customResponseHeaders:
|
|
X-Powered-By: ""
|
|
Server: ""
|
|
|
|
# Variant that allows microphone (for VoiceCoach)
|
|
security-headers-allow-mic:
|
|
headers:
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
contentTypeNosniff: true
|
|
frameDeny: true
|
|
referrerPolicy: "strict-origin-when-cross-origin"
|
|
permissionsPolicy: "camera=(), microphone=(self), geolocation=(), payment=()"
|
|
browserXssFilter: true
|
|
customResponseHeaders:
|
|
X-Powered-By: ""
|
|
Server: ""
|
|
|
|
# BasicAuth for sensitive services (Guacamole)
|
|
solo-basicauth:
|
|
basicAuth:
|
|
users:
|
|
- "glyptic:$2y$05$6AcmRIjMX6YrxY3fACeDhui4ghBGZtjmiPHbzWDb.qZ.8Fdip4GM."
|
|
realm: "Restricted"
|
|
|
|
# Variant that allows framing (for Guacamole, Home Assistant embeds)
|
|
security-headers-allow-frames:
|
|
headers:
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
contentTypeNosniff: true
|
|
frameDeny: false
|
|
customFrameOptionsValue: "SAMEORIGIN"
|
|
referrerPolicy: "strict-origin-when-cross-origin"
|
|
permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
|
|
browserXssFilter: true
|
|
customResponseHeaders:
|
|
X-Powered-By: ""
|
|
Server: ""
|