mirror of
https://github.com/hanzoai/ingress.git
synced 2026-11-03 00:49:13 +00:00
zeekay
05e593c8b6
Image now publishes as ghcr.io/hanzoai/ingress:<branch> (e.g. :main, :v1.7.x) — matching the convention every other repo in the ecosystem uses (kms, gateway, etc.). Drops the legacy experimental- prefix that confused consumers.
73 lines
1.6 KiB
YAML
73 lines
1.6 KiB
YAML
---
|
|
# Security headers — applied globally to all services via entrypoint default
|
|
apiVersion: ingress.k8s.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: security-headers
|
|
namespace: hanzo
|
|
spec:
|
|
headers:
|
|
# HSTS (2 years, preload-ready)
|
|
stsSeconds: 63072000
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
forceSTSHeader: true
|
|
# Clickjacking
|
|
frameDeny: true
|
|
# MIME sniffing
|
|
contentTypeNosniff: true
|
|
# XSS filter
|
|
browserXssFilter: true
|
|
# Referrer
|
|
referrerPolicy: "strict-origin-when-cross-origin"
|
|
# Permissions
|
|
permissionsPolicy: "camera=(), microphone=(), geolocation=()"
|
|
# Hide server version
|
|
customResponseHeaders:
|
|
Server: ""
|
|
---
|
|
# Default CORS headers middleware
|
|
apiVersion: ingress.k8s.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: cors-allow-all
|
|
namespace: hanzo
|
|
spec:
|
|
headers:
|
|
accessControlAllowMethods:
|
|
- GET
|
|
- POST
|
|
- PUT
|
|
- PATCH
|
|
- DELETE
|
|
- OPTIONS
|
|
accessControlAllowHeaders:
|
|
- Content-Type
|
|
- Authorization
|
|
- X-Requested-With
|
|
accessControlAllowOriginList:
|
|
- "*"
|
|
accessControlMaxAge: 86400
|
|
---
|
|
# Large body uploads (50MB)
|
|
apiVersion: ingress.k8s.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: body-size-50m
|
|
namespace: hanzo
|
|
spec:
|
|
buffering:
|
|
maxRequestBodyBytes: 52428800
|
|
---
|
|
# ORM docs redirect
|
|
apiVersion: ingress.k8s.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: orm-redirect
|
|
namespace: hanzo
|
|
spec:
|
|
redirectRegex:
|
|
regex: "^https?://orm\\.hanzo\\.ai/(.*)"
|
|
replacement: "https://hanzo.ai/docs/services/orm"
|
|
permanent: true
|