59 lines
2.0 KiB
YAML
59 lines
2.0 KiB
YAML
{{- if not .Values.host }}
|
|
{{- fail "ingressroute: .Values.host est requis (ex: vitrine-abc12.vitrine-omnex.club)" }}
|
|
{{- end }}
|
|
# Routage HTTPS. Le certificat est celui de `tls.secretName` (SNI) ; sans
|
|
# secretName, Traefik retombe sur le certificat par défaut du TLSStore
|
|
# partagé. Le redirect HTTP -> HTTPS est géré au niveau de l'entrypoint
|
|
# Traefik (pas dupliqué ici).
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: {{ .Release.Namespace }}-routes
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "ingressroute.labels" . | nindent 4 }}
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
# API backend — WAF + headers + rate limit (middlewares partagés, définis
|
|
# dans le namespace du Traefik commun, référencés cross-namespace).
|
|
- match: Host(`{{ .Values.host }}`) && (PathPrefix(`/api/`))
|
|
kind: Rule
|
|
priority: 20
|
|
middlewares:
|
|
- name: waf-chain
|
|
namespace: {{ .Values.traefikNamespace }}
|
|
services:
|
|
- name: {{ include "ingressroute.backendService" . }}
|
|
port: {{ .Values.backend.servicePort }}
|
|
|
|
# Fichiers uploadés — WAF désactivé dans les règles Coraza pour ce path
|
|
- match: Host(`{{ .Values.host }}`) && PathPrefix(`/uploads/`)
|
|
kind: Rule
|
|
priority: 15
|
|
middlewares:
|
|
- name: security-headers
|
|
namespace: {{ .Values.traefikNamespace }}
|
|
services:
|
|
- name: {{ include "ingressroute.backendService" . }}
|
|
port: {{ .Values.backend.servicePort }}
|
|
|
|
# Frontend SPA — WAF + headers + rate limit
|
|
- match: Host(`{{ .Values.host }}`)
|
|
kind: Rule
|
|
priority: 1
|
|
middlewares:
|
|
- name: waf-chain
|
|
namespace: {{ .Values.traefikNamespace }}
|
|
services:
|
|
- name: {{ include "ingressroute.frontendService" . }}
|
|
port: {{ .Values.frontend.servicePort }}
|
|
|
|
{{- if .Values.tls.secretName }}
|
|
tls:
|
|
secretName: {{ .Values.tls.secretName }}
|
|
{{- else }}
|
|
tls: {}
|
|
{{- end }}
|