70 lines
2.1 KiB
YAML
70 lines
2.1 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: homer
|
|
namespace: homer
|
|
annotations:
|
|
# ingress
|
|
kubernetes.io/ingress.class: nginx
|
|
cert-manager.io/cluster-issuer: letsencrypt
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
|
|
# security headers
|
|
nginx.ingress.kubernetes.io/hsts: "true"
|
|
nginx.ingress.kubernetes.io/hsts-max-age: "31536000"
|
|
nginx.ingress.kubernetes.io/hsts-include-subdomains: "true"
|
|
nginx.ingress.kubernetes.io/hsts-preload: "true"
|
|
nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
|
# light caching for static UI; adjust or remove if you serve dynamic content
|
|
add_header Cache-Control "public, max-age=600" always;
|
|
|
|
# timeouts reasonable for UI
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
|
|
spec:
|
|
tls:
|
|
- hosts: [homer.apps.undercloud.dev]
|
|
secretName: homer-tls
|
|
rules:
|
|
- host: homer.apps.undercloud.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: homer
|
|
port:
|
|
number: 80
|
|
---
|
|
# Redirect www.apps.undercloud.dev -> homer.apps.undercloud.dev (308)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: www-redirect
|
|
namespace: homer
|
|
annotations:
|
|
kubernetes.io/ingress.class: nginx
|
|
cert-manager.io/cluster-issuer: letsencrypt
|
|
nginx.ingress.kubernetes.io/permanent-redirect: "https://homer.apps.undercloud.dev$request_uri"
|
|
nginx.ingress.kubernetes.io/permanent-redirect-code: "308"
|
|
spec:
|
|
tls:
|
|
- hosts: [www.apps.undercloud.dev]
|
|
secretName: www-tls
|
|
rules:
|
|
- host: www.apps.undercloud.dev
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: homer
|
|
port:
|
|
number: 80
|