stacks/traefik/dynamic/security.yaml

tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
        - TLS_AES_128_GCM_SHA256
        - TLS_AES_256_GCM_SHA384
        - TLS_CHACHA20_POLY1305_SHA256
      curvePreferences:
        - CurveP521
        - CurveP384
      sniStrict: true

http:
  middlewares:
    security-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        customFrameOptionsValue: "SAMEORIGIN"
        browserXssFilter: true
        contentTypeNosniff: true
        referrerPolicy: "strict-origin-when-cross-origin"
        customResponseHeaders:
          Permissions-Policy: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), accelerometer=(), gyroscope=()"
          X-Content-Type-Options: "nosniff"
          X-Frame-Options: "SAMEORIGIN"
    no-index:
      headers:
        customResponseHeaders:
          X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex"
    rate-limit:
      rateLimit:
        average: 100
        burst: 50
        period: 1s
    api-rate-limit:
      rateLimit:
        average: 30
        burst: 15
        period: 1s
    # Only let traffic through whose source IP is inside the Tailscale/Headscale
    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48) or on falcon_network itself
    # (172.18.0.0/16) - the latter so containers on our own internal docker
    # network (e.g. pulsenode calling this router directly to reach
    # api@internal) count as trusted the same way a tailnet peer does. Public
    # DNS can still resolve these hostnames, but anyone reaching them over the
    # open internet gets a 403.
    vpn-only:
      ipAllowList:
        sourceRange:
          - "100.64.0.0/10"
          - "fd7a:115c:a1e0::/48"
          - "172.18.0.0/16"