stacks/traefik/dynamic/security.yaml

tls:
  options:
    default:
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
        - TLS_AES_128_GCM_SHA256
        - TLS_AES_256_GCM_SHA384
        - TLS_CHACHA20_POLY1305_SHA256
      curvePreferences:
        - CurveP521
        - CurveP384
      sniStrict: true

http:
  middlewares:
    security-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        stsPreload: true
        forceSTSHeader: true
        customFrameOptionsValue: "SAMEORIGIN"
        browserXssFilter: true
        contentTypeNosniff: true
        referrerPolicy: "strict-origin-when-cross-origin"
        customResponseHeaders:
          Permissions-Policy: "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), accelerometer=(), gyroscope=()"
          X-Content-Type-Options: "nosniff"
          X-Frame-Options: "SAMEORIGIN"
    no-index:
      headers:
        customResponseHeaders:
          X-Robots-Tag: "none,noarchive,nosnippet,notranslate,noimageindex"
    rate-limit:
      rateLimit:
        average: 100
        burst: 50
        period: 1s
    api-rate-limit:
      rateLimit:
        average: 30
        burst: 15
        period: 1s
    # Only let traffic through whose source IP is inside the Tailscale/Headscale
    # mesh (100.64.0.0/10, fd7a:115c:a1e0::/48) or on falcon_network/coolify
    # (172.18.0.0/16, 172.19.0.0/16) - the latter two so containers on our own
    # internal docker networks (e.g. pulsenode calling this router directly to
    # reach api@internal) count as trusted the same way a tailnet peer does.
    # Traefik is also joined to the coolify network (for routing to
    # Coolify-managed containers), and Docker masquerades externally-arriving
    # connections - including real tailnet traffic - through whichever of
    # Traefik's networks ends up handling NAT, which can surface as the
    # coolify bridge gateway (172.19.0.1) instead of the real source IP. So
    # 172.19.0.0/16 needs the same trust as 172.18.0.0/16 for tailnet clients
    # to reliably reach vpn-only routes. Public DNS can still resolve these
    # hostnames, but anyone reaching them over the open internet gets a 403.
    vpn-only:
      ipAllowList:
        sourceRange:
          - "100.64.0.0/10"
          - "fd7a:115c:a1e0::/48"
          - "172.18.0.0/16"
          - "172.19.0.0/16"