Paul Payne
d9f10716b0
pretix/standalone runs gunicorn + celery + celery-beat in one container and OOMKilled at 4Gi. Increased limit to 6Gi, request to 512Mi. eventyay: add nginx sidecar to serve static files, update health probes to check a static asset at port 8080, add create-superuser script, register script in manifest. crowdsec: middleware fix (previously uncommitted). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
95 lines
2.0 KiB
YAML
95 lines
2.0 KiB
YAML
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: crowdsec-bouncer
|
|
namespace: crowdsec
|
|
labels:
|
|
app: crowdsec
|
|
managedBy: kustomize
|
|
partOf: wild-cloud
|
|
spec:
|
|
plugin:
|
|
bouncer:
|
|
crowdsecLapiScheme: http
|
|
crowdsecLapiHost: crowdsec-lapi.crowdsec.svc.cluster.local:8080
|
|
crowdsecLapiKeyFile: /etc/traefik/crowdsec/api-key
|
|
crowdsecMode: stream
|
|
updateIntervalSeconds: 15
|
|
defaultDecisionSeconds: 60
|
|
crowdsecAppsecEnabled: false
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: rate-limit
|
|
namespace: crowdsec
|
|
labels:
|
|
app: crowdsec
|
|
managedBy: kustomize
|
|
partOf: wild-cloud
|
|
spec:
|
|
rateLimit:
|
|
average: {{ .rateLimitAverage }}
|
|
burst: {{ .rateLimitBurst }}
|
|
period: 1m
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: security-headers
|
|
namespace: crowdsec
|
|
labels:
|
|
app: crowdsec
|
|
managedBy: kustomize
|
|
partOf: wild-cloud
|
|
spec:
|
|
headers:
|
|
browserXssFilter: true
|
|
contentTypeNosniff: true
|
|
forceSTSHeader: true
|
|
sslRedirect: true
|
|
stsIncludeSubdomains: true
|
|
stsPreload: true
|
|
stsSeconds: 31536000
|
|
addVaryHeader: true
|
|
accessControlAllowMethods:
|
|
- GET
|
|
- POST
|
|
- PUT
|
|
- DELETE
|
|
- OPTIONS
|
|
accessControlAllowOriginList:
|
|
- "*"
|
|
accessControlAllowHeaders:
|
|
- X-Requested-With
|
|
- Content-Type
|
|
- Authorization
|
|
- Date
|
|
accessControlMaxAge: 100
|
|
customRequestHeaders:
|
|
X-Forwarded-Proto: https
|
|
customResponseHeaders:
|
|
Server: ""
|
|
X-Frame-Options: SAMEORIGIN
|
|
X-Robots-Tag: noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: security-chain
|
|
namespace: crowdsec
|
|
labels:
|
|
app: crowdsec
|
|
managedBy: kustomize
|
|
partOf: wild-cloud
|
|
spec:
|
|
chain:
|
|
middlewares:
|
|
- name: security-headers
|
|
namespace: crowdsec
|
|
- name: rate-limit
|
|
namespace: crowdsec
|
|
- name: crowdsec-bouncer
|
|
namespace: crowdsec
|