valknar
318f48036d
falcon-vpn-only was defined inline in falcon.yaml even though it's a generic ipAllowList restriction with nothing falcon-specific about it - security.yaml is where the other reusable middlewares (security- headers, no-index, rate-limit) already live. Renamed to vpn-only to match their bare naming style now that it's not tied to one file, and updated falcon.yaml's two router references to vpn-only@file (same cross-file pattern already used there for security-headers@file). Also applies it to the pulsenode stack: it's a dashboard surfacing container names/health for every service here, and there's no auth in front of it yet, so gating it to the tailnet is a real mitigation for that gap rather than leaving it open on the public hostname.
41 lines
1.1 KiB
YAML
41 lines
1.1 KiB
YAML
# Routes for apps running on the local machine "falcon", reached over the
|
|
# Tailscale/Headscale mesh (falcon's tailnet IP: 100.64.0.1). DNS for
|
|
# *.falcon.pivoine.art points here (the VPS), which terminates TLS and
|
|
# forwards over the tunnel — falcon itself is never exposed directly.
|
|
#
|
|
# To add another app: duplicate the <name>-web / <name>-web-secure routers
|
|
# and the service block below, swap the hostname and backend port.
|
|
|
|
http:
|
|
middlewares:
|
|
triggershell-redirect-web-secure:
|
|
redirectScheme:
|
|
scheme: https
|
|
|
|
routers:
|
|
triggershell-web:
|
|
rule: "Host(`triggershell.falcon.pivoine.art`)"
|
|
entrypoints:
|
|
- web
|
|
middlewares:
|
|
- vpn-only@file
|
|
- triggershell-redirect-web-secure
|
|
service: triggershell
|
|
|
|
triggershell-web-secure:
|
|
rule: "Host(`triggershell.falcon.pivoine.art`)"
|
|
entrypoints:
|
|
- web-secure
|
|
tls:
|
|
certResolver: resolver
|
|
middlewares:
|
|
- vpn-only@file
|
|
- security-headers@file
|
|
service: triggershell
|
|
|
|
services:
|
|
triggershell:
|
|
loadBalancer:
|
|
servers:
|
|
- url: "http://100.64.0.1:4173"
|