forust
0859479c0f
ci / lint-compose (push) Successful in 9s
ci / lint-actionlint (push) Successful in 4s
ci / lint-shellcheck (push) Successful in 7s
ci / lint-prettier (push) Successful in 12s
ci / lint-ruff (push) Successful in 6s
ci / lint-yaml (push) Successful in 9s
ci / lint-dockerfiles (push) Successful in 5s
ci / validate (push) Successful in 5s
renovate-ci / validate-renovate (push) Successful in 7s
ci / build (push) Failing after 14m22s
Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.
70 lines
1.5 KiB
YAML
70 lines
1.5 KiB
YAML
# PoC: homepages prod hosts via Gateway API.
|
|
# Runs alongside k8s/ingress.yaml - delete the prod IngressRoutes only after verification.
|
|
# There are no local .internal hosts here, they stay on the local IngressRoute.
|
|
# No per-route security middlewares: L3 enforcement moved to the host
|
|
# firewall bouncer, so HTTPRoutes stay clean.
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: homepages-http-redirect
|
|
namespace: homepages
|
|
spec:
|
|
parentRefs:
|
|
- name: homepages
|
|
kind: Gateway
|
|
sectionName: http
|
|
hostnames:
|
|
- forust.xyz
|
|
- www.forust.xyz
|
|
- xdfnx.cfd
|
|
rules:
|
|
- filters:
|
|
- type: RequestRedirect
|
|
requestRedirect:
|
|
scheme: https
|
|
statusCode: 301
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: forust-homepage-https
|
|
namespace: homepages
|
|
spec:
|
|
parentRefs:
|
|
- name: homepages
|
|
kind: Gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- forust.xyz
|
|
- www.forust.xyz
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: forust-homepage-service
|
|
port: 80
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: xdfnx-homepage-https
|
|
namespace: homepages
|
|
spec:
|
|
parentRefs:
|
|
- name: homepages
|
|
kind: Gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- xdfnx.cfd
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: xdfnx-homepage-service
|
|
port: 80
|