---
apiVersion: v1
kind: ConfigMap
metadata:
  name: traefik-configs
  namespace: networking
  labels:
    app.kubernetes.io/name: traefik
data:
  config.yaml: |
    http:
      middlewares:
        headers:
          headers:
            sslRedirect: true
            sslHost: "${SECRET_DOMAIN}"
            stsSeconds: 315360000
            stsIncludeSubdomains: true
            stsPreload: true
            forceSTSHeader: true
            frameDeny: true
            customFrameOptionsValue: SAMEORIGIN
            customRequestHeaders:
              X-Forwarded-Proto: https
            contentTypeNosniff: true
            browserXSSFilter: true
        local-headers:
            sslRedirect: true
            sslHost: "${SECRET_LOCAL_DOMAIN}"
            stsSeconds: 315360000
            stsIncludeSubdomains: true
            stsPreload: true
            forceSTSHeader: true
            frameDeny: true
            customFrameOptionsValue: SAMEORIGIN
            customRequestHeaders:
              X-Forwarded-Proto: https
            contentTypeNosniff: true
            browserXSSFilter: true
        dashboard-headers:
          headers:
            sslRedirect: true
            sslHost: "${SECRET_DOMAIN}"
            stsSeconds: 315360000
            stsIncludeSubdomains: true
            stsPreload: true
            forceSTSHeader: true
            frameDeny: false
            customFrameOptionsValue: SAMEORIGIN
            contentTypeNosniff: true
            browserXSSFilter: true
        site-headers:
          headers:
            sslRedirect: true
            sslHost: "${SECRET_DOMAIN}"
            stsSeconds: 315360000
            stsIncludeSubdomains: true
            stsPreload: true
            forceSTSHeader: true
            frameDeny: false
            contentTypeNosniff: true
            browserXSSFilter: true
        local-only:
          ipWhiteList:
            sourceRange:
              - 10.244.0.0/16
              - 10.10.0.0/24
              - 10.0.8.0/24
              - 192.168.0.0/16
