traefik/traefik/conf.d/middlewares.yaml

http:
  middlewares:
    default:
      chain:
        middlewares:
          - csp-strict-header
          - frame-deny-header
          - gzip
          - hsts-header
          - security-headers
    # middlewares
    authentik-no-cache:
      headers:
        customResponseHeaders:
          Cache-Control: "no-store, no-cache, must-revalidate, max-age=0"
          Pragma: "no-cache"
          Expires: "0"
    authentik-outpost:
      forwardAuth:
        address: "https://outpost.mifi.holdings/outpost.goauthentik.io/auth/traefik"
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-entitlements
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version
    authentik-static-immutable:
      headers:
        customResponseHeaders:
          Cache-Control: "public, max-age=31536000, immutable"
    cross-origin-opener-strict-policy:
      headers:
        customResponseHeaders:
          Cross-Origin-Opener-Policy: "same-origin"
    csp-open-header:
      headers:
        customResponseHeaders:
          Content-Security-Policy: "default-src * data: blob: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; style-src * data: blob: 'unsafe-inline'; img-src * data: blob:; font-src * data: blob:; frame-src *; frame-ancestors *; base-uri *; form-action *; frame-src *; connect-src 'self'; worker-src 'self' blob:;"
    csp-lax-header:
      headers:
        customResponseHeaders:
          Content-Security-Policy: "default-src 'self'; img-src 'self' data: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self' data: https:; frame-ancestors 'self'; frame-src 'self' https:; base-uri 'self'; form-action 'self' https:; connect-src 'self'; worker-src 'self' blob:;"
    csp-permissive-header:
      headers:
        customResponseHeaders:
          Content-Security-Policy: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; connect-src 'self'; worker-src 'self';"
    csp-balanced-header:
      headers:
        customResponseHeaders:
          Content-Security-Policy: "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://unpkg.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com data:; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; connect-src 'self'; worker-src 'self';"
    csp-strict-header:
      headers:
        customResponseHeaders:
          Content-Security-Policy: "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; connect-src 'self'; worker-src 'self';"
    csp-strict-header-with-ga:
      headers:
        customResponseHeaders:
          Content-Security-Policy: "default-src 'self'; script-src 'self' https://analytics.mifi.holdings https://scripts.clarity.ms https://www.clarity.ms https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' https://analytics.mifi.holdings https://*.clarity.ms https://c.bing.com https://www.google-analytics.com https://www.googletagmanager.com https://stats.g.doubleclick.net; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; connect-src 'self' https://analytics.mifi.holdings https://*.clarity.ms https://c.bing.com https://www.google.com https://www.google-analytics.com https://region1.google-analytics.com https://stats.g.doubleclick.net; worker-src 'self'; require-trusted-types-for 'script'; trusted-types default forceInner goog#html mifi-ventures-policy svelte-trusted-html 'allow-duplicates';"
    frame-deny-header:
      headers:
        frameDeny: true                  # X-Frame-Options: DENY
    frame-sameorigin-header:
      headers:
        customResponseHeaders:
          X-Frame-Options: "SAMEORIGIN"
    gzip:
      compress: {}
    hsts-header:
      headers:
        # Enable HSTS (Strict Transport Security)
        stsSeconds: 63072000           # 2 years
        stsIncludeSubdomains: true
        stsPreload: true               # for preload list
    internal-ips:
      ipWhiteList:
        sourceRange:
        - 127.0.0.1/32
        - 192.168.50.1/32
        - 50.116.61.55
        - 173.255.238.101
        - 72.93.250.18
    redirect-postfixadmin:
      redirectRegex:
        regex: "^https://mail\\.mifi\\.holdings/settings/?(.*)"
        replacement: "https://postmaster.mifi.holdings/$1"
        permanent: true
    redirect-www-to-non-www:
      redirectRegex:
        regex: "^https://www\\.(.*)"
        replacement: "https://${1}"
        permanent: true
    redirect-non-www-to-www:
      redirectregex:
        permanent: true
        regex: "^https?://(?:www\\.)?(.+)"
        replacement: "https://www.${1}"
    referrer-open-header:
      headers:
        customResponseHeaders:
          Referrer-Policy: "unsafe-url"
    referrer-lax-header:
      headers:
        customResponseHeaders:
          Referrer-Policy: "origin-when-cross-origin"
    referrer-permissive-header:
      headers:
        customResponseHeaders:
          Referrer-Policy: "strict-origin-when-cross-origin"
    referrer-medium-header:
      headers:
        customResponseHeaders:
          Referrer-Policy: "same-origin"
    referrer-supermax-header:
      headers:
        customResponseHeaders:
          Referrer-Policy: "no-referrer"
    security-headers:
      headers:
        contentTypeNosniff: true          # X-Content-Type-Options: nosniff
        customResponseHeaders:
          X-XSS-Protection: "0"           # Disable legacy browser XSS filter (modern best practice)
    secure-all:
      chain:
        middlewares:
          - csp-permissive-header
          - frame-sameorigin-header
          - hsts-header
          - security-headers
    security-mallcop:
      chain:
        middlewares:
          - referrer-open-header
          - csp-open-header
          - hsts-header
          - security-headers
    security-lax:
      chain:
        middlewares:
          - referrer-lax-header
          - csp-lax-header
          - hsts-header
          - security-headers
    security-medium:
      chain:
        middlewares:
          - referrer-permissive-header
          - csp-permissive-header
          - frame-sameorigin-header
          - hsts-header
          - security-headers
    security-prison:
      chain:
        middlewares:
          - referrer-medium-header
          - csp-balanced-header
          - frame-sameorigin-header
          - hsts-header
          - security-headers
    security-supermax:
      chain:
        middlewares:
          - referrer-supermax-header
          - csp-strict-header
          - frame-deny-header
          - hsts-header
          - security-headers
    security-supermax-with-analytics:
      chain:
        middlewares:
          - referrer-supermax-header
          - cross-origin-opener-strict-policy
          - csp-strict-header-with-ga
          - frame-deny-header
          - hsts-header
          - security-headers
    strip-server-path:
      stripPrefix:
        prefixes:
          - "/db"
          - "/server"
          - "/traefik"