From cf3b4dbc99fb6ded5876f429149fd2ede63dba44 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Tue, 4 Feb 2025 15:03:22 +0100 Subject: [PATCH] Add HSTS header and discovery config 16 --- apps/templates/nextcloud-helm.yaml | 36 +----------------------------- 1 file changed, 1 insertion(+), 35 deletions(-) diff --git a/apps/templates/nextcloud-helm.yaml b/apps/templates/nextcloud-helm.yaml index 506725b..f4f6918 100644 --- a/apps/templates/nextcloud-helm.yaml +++ b/apps/templates/nextcloud-helm.yaml @@ -42,40 +42,6 @@ spec: $CONFIG = array ( 'trusted_proxies' => ['10.0.0.0/8', '192.168.1.1/32'], ); - # nginx: - # ## You need to set an fpm version of the image for nextcloud if you want to use nginx! - # enabled: true - - # image: - # repository: nginx - # tag: alpine - # pullPolicy: IfNotPresent - - # containerPort: 80 - # # This configures nginx to listen on either IPv4, IPv6 or both - # ipFamilies: - # - IPv4 - # # - IPv6 - # config: - # # This generates the default nginx config as per the nextcloud documentation - # default: true - # headers: - # # -- HSTS settings - # # WARNING: Only add the preload option once you read about - # # the consequences in https://hstspreload.org/. This option - # # will add the domain to a hardcoded list that is shipped - # # in all major browsers and getting removed from this list - # # could take several months. - # # Example: - # # "Strict-Transport-Security": "max-age=15768000; includeSubDomains; preload;" - # "Strict-Transport-Security": "max-age=15768000; includeSubDomains;" - # "Referrer-Policy": "no-referrer" - # "X-Content-Type-Options": "nosniff" - # "X-Download-Options": "noopen" - # "X-Frame-Options": "SAMEORIGIN" - # "X-Permitted-Cross-Domain-Policies": "none" - # "X-Robots-Tag": "noindex, nofollow" - # "X-XSS-Protection": "1; mode=block" phpClientHttpsFix: enabled: true protocol: https @@ -86,7 +52,7 @@ spec: nginx.ingress.kubernetes.io/proxy-body-size: 100G nginx.ingress.kubernetes.io/configuration-snippet: | more_set_headers "Strict-Transport-Security: max-age=15768001; includeSubDomains"; - more_set_headers "strict-transport-security: max-age=15552002; includeSubDomains"; + more_set_headers "X-Forwarded-Strict-Transport-Security: $upstream_http_strict_transport_security"; # kubernetes.io/tls-acme: "true" cert-manager.io/cluster-issuer: prod-cluster-issuer # # Keep this in sync with the README.md: