Paul Payne
9687fad812
Convert all 15 cluster services from embedded API format to wild-directory packages using the unified manifest format: - metallb, traefik, cert-manager, longhorn, snapshot-controller - nfs, smtp, coredns, node-feature-discovery, nvidia-device-plugin - externaldns, docker-registry, headlamp, crowdsec, utils Changes: - wild-manifest.yaml → manifest.yaml with is, defaultConfig, requires - Eliminated configReferences and serviceConfig fields - Flattened kustomize.template/ to package root - Template vars use flat defaultConfig keys - install.sh paths updated for apps/ layout - Updated 9 app manifests: cloud.smtp.* → apps.smtp.* with requires - Removed dead install: true field from 6 app manifests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
90 lines
1.9 KiB
YAML
90 lines
1.9 KiB
YAML
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: crowdsec-bouncer
|
|
namespace: crowdsec
|
|
labels:
|
|
app: crowdsec
|
|
managedBy: kustomize
|
|
partOf: wild-cloud
|
|
spec:
|
|
plugin:
|
|
bouncer:
|
|
crowdsecLapiScheme: http
|
|
crowdsecLapiHost: crowdsec-lapi.crowdsec.svc.cluster.local:8080
|
|
crowdsecLapiKeyFile: /etc/traefik/crowdsec/api-key
|
|
crowdsecMode: stream
|
|
updateIntervalSeconds: 15
|
|
defaultDecisionSeconds: 60
|
|
crowdsecAppsecEnabled: false
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: rate-limit
|
|
namespace: crowdsec
|
|
labels:
|
|
app: crowdsec
|
|
managedBy: kustomize
|
|
partOf: wild-cloud
|
|
spec:
|
|
rateLimit:
|
|
average: {{ .rateLimitAverage }}
|
|
burst: {{ .rateLimitBurst }}
|
|
period: 1m
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: security-headers
|
|
namespace: crowdsec
|
|
labels:
|
|
app: crowdsec
|
|
managedBy: kustomize
|
|
partOf: wild-cloud
|
|
spec:
|
|
headers:
|
|
browserXssFilter: true
|
|
contentTypeNosniff: true
|
|
forceSTSHeader: true
|
|
frameDeny: true
|
|
sslRedirect: true
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
stsSeconds: 31536000
|
|
addVaryHeader: true
|
|
accessControlAllowMethods:
|
|
- GET
|
|
- POST
|
|
- PUT
|
|
- DELETE
|
|
- OPTIONS
|
|
accessControlAllowOriginList:
|
|
- "*"
|
|
accessControlMaxAge: 100
|
|
customRequestHeaders:
|
|
X-Forwarded-Proto: https
|
|
customResponseHeaders:
|
|
Server: ""
|
|
X-Robots-Tag: noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: security-chain
|
|
namespace: crowdsec
|
|
labels:
|
|
app: crowdsec
|
|
managedBy: kustomize
|
|
partOf: wild-cloud
|
|
spec:
|
|
chain:
|
|
middlewares:
|
|
- name: security-headers
|
|
namespace: crowdsec
|
|
- name: rate-limit
|
|
namespace: crowdsec
|
|
- name: crowdsec-bouncer
|
|
namespace: crowdsec
|