apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-ingress-ingress-nginx-controller
  namespace: ingress-nginx
data:
  use-http2: "true"
  enable-brotli: "true"
  brotli-level: "4"
  use-forwarded-headers: "true"
  compute-full-forwarded-for: "true"
  ssl-ciphers: 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384'
  ssl-ecdh-curve: 'X25519:secp521r1:secp384r1:prime256v1'
  ssl-dh-param: "ingress-nginx/dhparam"
  ssl-protocols: "TLSv1.3"
  ssl-early-data: "true"
  ssl-session-cache: "shared:SSL:10m"
  ssl-session-tickets: "false"
  ssl-session-timeout: "10m"
  ssl-buffer-size: "4k"
  ssl-redirect: 'true'
  http-snippet: |
    add_header Strict-Transport-Security "max-age=0;includeSubDomains;preload" always;
    add_header Content-Security-Policy "default-src 'self' https: blob: 'unsafe-inline'" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS_Protection "1; mode=block" always;
    add_header X-Robots-Tag "none" always;

    server {
      listen 18080;
      location /nginx_status {
        allow all;
        stub_status on;
      }
    }
  nginx-config: |-
    ad_identifiers:
      - nginx
    init_config:
    instances:
      - name: "nginx_status_url"
        url: "http://%%host%%:18080/nginx_status"
        timeout: 1
      - name: "prometheus_url"
        url: "http://%%host%%:10254/metrics"
        timeout: 1
