85 lines
2.2 KiB
YAML
85 lines
2.2 KiB
YAML
---
|
|
# HTTP → HTTPS redirect
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: gestion-http
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "gestion-traefik.labels" . | nindent 4 }}
|
|
spec:
|
|
entryPoints:
|
|
- web
|
|
routes:
|
|
- match: Host(`{{ .Values.domain }}`)
|
|
kind: Rule
|
|
middlewares:
|
|
- name: redirect-https
|
|
services:
|
|
- name: noop@internal
|
|
kind: TraefikService
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: redirect-https
|
|
namespace: {{ .Release.Namespace }}
|
|
spec:
|
|
redirectScheme:
|
|
scheme: https
|
|
permanent: true
|
|
---
|
|
# HTTPS — routes principales
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: gestion-https
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "gestion-traefik.labels" . | nindent 4 }}
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
# API backend — WAF + headers + rate limit
|
|
- match: Host(`{{ .Values.domain }}`) && (PathPrefix(`/api/`) || PathPrefix(`/webhook/`))
|
|
kind: Rule
|
|
priority: 20
|
|
middlewares:
|
|
- name: waf-chain
|
|
services:
|
|
- name: {{ .Values.backend.serviceName }}
|
|
namespace: {{ .Values.servicesNamespace }}
|
|
port: {{ .Values.backend.servicePort }}
|
|
|
|
# Fichiers uploadés — WAF désactivé dans les règles Coraza pour ce path
|
|
- match: Host(`{{ .Values.domain }}`) && PathPrefix(`/uploads/`)
|
|
kind: Rule
|
|
priority: 15
|
|
middlewares:
|
|
- name: security-headers
|
|
services:
|
|
- name: {{ .Values.backend.serviceName }}
|
|
namespace: {{ .Values.servicesNamespace }}
|
|
port: {{ .Values.backend.servicePort }}
|
|
|
|
# Frontend SPA — WAF + headers + rate limit
|
|
- match: Host(`{{ .Values.domain }}`)
|
|
kind: Rule
|
|
priority: 1
|
|
middlewares:
|
|
- name: waf-chain
|
|
services:
|
|
- name: {{ .Values.frontend.serviceName }}
|
|
namespace: {{ .Values.servicesNamespace }}
|
|
port: {{ .Values.frontend.servicePort }}
|
|
|
|
tls:
|
|
{{- if eq .Values.tls.mode "letsencrypt" }}
|
|
certResolver: letsencrypt
|
|
{{- else }}
|
|
secretName: {{ .Values.tls.secretName }}
|
|
{{- end }}
|
|
domains:
|
|
- main: {{ .Values.domain }}
|