forust
0859479c0f
ci / lint-compose (push) Successful in 9s
ci / lint-actionlint (push) Successful in 4s
ci / lint-shellcheck (push) Successful in 7s
ci / lint-prettier (push) Successful in 12s
ci / lint-ruff (push) Successful in 6s
ci / lint-yaml (push) Successful in 9s
ci / lint-dockerfiles (push) Successful in 5s
ci / validate (push) Successful in 5s
renovate-ci / validate-renovate (push) Successful in 7s
ci / build (push) Failing after 14m22s
Move L3 enforcement to the host firewall-bouncer (systemd, nftables): drop the Traefik plugin, its secrets volume and the crowdsec Middleware, remove bouncer refs from all IngressRoutes. Disable the http-generic-bf scenario (403-burst bans hurt legit automation under L3 enforcement). Add a Gateway API PoC for homepages prod and CrowdSec PrometheusRule alerts.
84 lines
2.8 KiB
YAML
84 lines
2.8 KiB
YAML
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: netbird-prod
|
|
namespace: netbird
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
# NO crowdsec-bouncer on the API routes. These are the mesh client's own
|
|
# endpoints: gRPC-gateway management calls plus signal/relay long-polling,
|
|
# authenticated by NetBird's token rather than by a login form. A ban here
|
|
# is self-defeating - the client needs the mesh to reach anything else, so
|
|
# CrowdSec banning it locks the peer out of the network it needs to
|
|
# function. It also backfires: a banned peer keeps retrying, every retry
|
|
# is another 403, and LePresidente/http-generic-403-bf turns five 403s in
|
|
# ten seconds into a 4h ban, so one 403 loop kept re-arming the ban.
|
|
# netbird-local below has always been exempt; this makes prod match.
|
|
- match: Host(`nb.forust.xyz`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
|
|
kind: Rule
|
|
priority: 100
|
|
services:
|
|
- name: netbird-server-service
|
|
port: 80
|
|
scheme: h2c
|
|
- match: Host(`nb.forust.xyz`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
|
|
kind: Rule
|
|
priority: 100
|
|
services:
|
|
- name: netbird-server-service
|
|
port: 80
|
|
- match: Host(`nb.forust.xyz`)
|
|
kind: Rule
|
|
priority: 1
|
|
services:
|
|
- name: netbird-dashboard-service
|
|
port: 80
|
|
tls:
|
|
secretName: netbird-prod-tls
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: netbird-local
|
|
namespace: netbird
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: (Host(`netbird.workstation.internal`) || Host(`netbird.gigaforust.internal`)) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
|
|
kind: Rule
|
|
priority: 100
|
|
services:
|
|
- name: netbird-server-service
|
|
port: 80
|
|
scheme: h2c
|
|
- match: (Host(`netbird.workstation.internal`) || Host(`netbird.gigaforust.internal`)) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
|
|
kind: Rule
|
|
priority: 100
|
|
services:
|
|
- name: netbird-server-service
|
|
port: 80
|
|
- match: Host(`netbird.workstation.internal`) || Host(`netbird.gigaforust.internal`)
|
|
kind: Rule
|
|
priority: 1
|
|
services:
|
|
- name: netbird-dashboard-service
|
|
port: 80
|
|
tls:
|
|
secretName: internal-wildcard-tls
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRouteUDP
|
|
metadata:
|
|
name: netbird-stun
|
|
namespace: netbird
|
|
spec:
|
|
entryPoints:
|
|
- netbird-stun
|
|
routes:
|
|
- services:
|
|
- name: netbird-server-service
|
|
port: 3478
|