ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
271
vendor/workloads/forgejo-public/facade-code-config.yaml
vendored
Normal file
271
vendor/workloads/forgejo-public/facade-code-config.yaml
vendored
Normal file
|
|
@ -0,0 +1,271 @@
|
|||
static_resources:
|
||||
listeners:
|
||||
- name: forge-code
|
||||
address:
|
||||
socket_address:
|
||||
address: 0.0.0.0
|
||||
port_value: 8080
|
||||
filter_chains:
|
||||
- filters:
|
||||
- name: envoy.filters.network.http_connection_manager
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
||||
stat_prefix: forge_code
|
||||
normalize_path: true
|
||||
merge_slashes: true
|
||||
path_with_escaped_slashes_action: REJECT_REQUEST
|
||||
use_remote_address: true
|
||||
access_log:
|
||||
- name: envoy.access_loggers.stdout
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
|
||||
log_format:
|
||||
text_format_source:
|
||||
inline_string: "%START_TIME% %REQ(:METHOD)% %RESPONSE_CODE% %RESPONSE_CODE_DETAILS%\n"
|
||||
route_config:
|
||||
name: forge-code
|
||||
request_headers_to_remove:
|
||||
- authorization
|
||||
- cookie
|
||||
- proxy-authorization
|
||||
- signature
|
||||
- x-ssh-certificate
|
||||
- x-webauth-email
|
||||
- x-webauth-fullname
|
||||
- x-webauth-user
|
||||
response_headers_to_remove:
|
||||
- set-cookie
|
||||
- www-authenticate
|
||||
- proxy-authenticate
|
||||
virtual_hosts:
|
||||
- name: forge-code
|
||||
domains:
|
||||
- "*"
|
||||
routes:
|
||||
- match:
|
||||
path: /user/login
|
||||
headers:
|
||||
- name: :method
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: "GET|HEAD"
|
||||
direct_response:
|
||||
status: 303
|
||||
response_headers_to_add:
|
||||
- header:
|
||||
key: location
|
||||
value: /login-disabled
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
- header:
|
||||
key: cache-control
|
||||
value: no-store
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
typed_per_filter_config:
|
||||
envoy.filters.http.rbac:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute
|
||||
- match:
|
||||
path: /login-disabled
|
||||
headers:
|
||||
- name: :method
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: "GET|HEAD"
|
||||
direct_response:
|
||||
status: 200
|
||||
body:
|
||||
filename: /etc/envoy/login-disabled.html
|
||||
response_headers_to_add:
|
||||
- header:
|
||||
key: content-type
|
||||
value: text/html; charset=utf-8
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
- header:
|
||||
key: cache-control
|
||||
value: no-store
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
- header:
|
||||
key: referrer-policy
|
||||
value: no-referrer
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
- header:
|
||||
key: x-content-type-options
|
||||
value: nosniff
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
- header:
|
||||
key: content-security-policy
|
||||
value: "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
- match:
|
||||
path: /robots.txt
|
||||
headers:
|
||||
- name: :method
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: "GET|HEAD"
|
||||
direct_response:
|
||||
status: 200
|
||||
body:
|
||||
filename: /etc/envoy/robots.txt
|
||||
response_headers_to_add:
|
||||
- header:
|
||||
key: content-type
|
||||
value: text/plain; charset=utf-8
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
- header:
|
||||
key: cache-control
|
||||
value: public, max-age=3600
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
- header:
|
||||
key: x-content-type-options
|
||||
value: nosniff
|
||||
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
||||
typed_per_filter_config:
|
||||
envoy.filters.http.rbac:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute
|
||||
- match:
|
||||
prefix: /assets/
|
||||
route:
|
||||
cluster: forge-code
|
||||
timeout: 0s
|
||||
- match:
|
||||
prefix: /
|
||||
route:
|
||||
cluster: forge-code
|
||||
timeout: 0s
|
||||
response_headers_to_add:
|
||||
- header:
|
||||
key: vary
|
||||
value: Accept, Accept-Language
|
||||
append_action: APPEND_IF_EXISTS_OR_ADD
|
||||
http_filters:
|
||||
- name: envoy.filters.http.rbac
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
|
||||
rules:
|
||||
action: DENY
|
||||
policies:
|
||||
authentication-paths:
|
||||
permissions:
|
||||
- header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: '^/(user|login/oauth|admin|notifications)([/?].*)?$'
|
||||
principals:
|
||||
- any: true
|
||||
authenticated-global-pages:
|
||||
permissions:
|
||||
- header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: '^/(repo|issues|pulls|milestones|report_abuse)([/?].*)?$'
|
||||
principals:
|
||||
- any: true
|
||||
authenticated-organization-pages:
|
||||
permissions:
|
||||
- or_rules:
|
||||
rules:
|
||||
- header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: '^/org/(create|invite)([/?].*)?$'
|
||||
- header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: '^/org/[^/?]+/(dashboard|issues|pulls|milestones|teams|settings)([/?].*)?$'
|
||||
principals:
|
||||
- any: true
|
||||
authenticated-repository-pages:
|
||||
permissions:
|
||||
- or_rules:
|
||||
rules:
|
||||
- header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: '^/[^/?]+/[^/?]+/(settings|action|fork)([/?].*)?$'
|
||||
- header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: '^/[^/?]+/[^/?]+/(_edit|_new|_delete|_upload|_diffpatch|_cherrypick)([/?].*)?$'
|
||||
- header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: '^/[^/?]+/[^/?]+/releases/(new|edit)([/?].*)?$'
|
||||
principals:
|
||||
- any: true
|
||||
receive-pack:
|
||||
permissions:
|
||||
- header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: ".*(git-receive-pack|service=git-receive-pack).*"
|
||||
principals:
|
||||
- any: true
|
||||
query-credentials:
|
||||
permissions:
|
||||
- header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: ".*[?&](token|access_token)=[^&]*.*"
|
||||
principals:
|
||||
- any: true
|
||||
authenticated-methods:
|
||||
permissions:
|
||||
- header:
|
||||
name: :method
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: "PUT|PATCH|DELETE"
|
||||
principals:
|
||||
- any: true
|
||||
authenticated-posts:
|
||||
permissions:
|
||||
- and_rules:
|
||||
rules:
|
||||
- header:
|
||||
name: :method
|
||||
string_match:
|
||||
exact: POST
|
||||
- not_rule:
|
||||
header:
|
||||
name: :path
|
||||
string_match:
|
||||
safe_regex:
|
||||
regex: '^/[^/?]+/[^/?]+/(git-upload-pack|lastcommit/.*|archive/.*)([?].*)?$'
|
||||
principals:
|
||||
- any: true
|
||||
- name: envoy.filters.http.router
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
|
||||
clusters:
|
||||
- name: forge-code
|
||||
type: STRICT_DNS
|
||||
load_assignment:
|
||||
cluster_name: forge-code
|
||||
endpoints:
|
||||
- lb_endpoints:
|
||||
- endpoint:
|
||||
address:
|
||||
socket_address:
|
||||
address: forge-code-http.forgejo-public.svc.cluster.local.
|
||||
port_value: 3000
|
||||
overload_manager:
|
||||
refresh_interval: 0.25s
|
||||
resource_monitors:
|
||||
- name: envoy.resource_monitors.global_downstream_max_connections
|
||||
typed_config:
|
||||
"@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
|
||||
max_active_downstream_connections: 1024
|
||||
admin:
|
||||
address:
|
||||
socket_address:
|
||||
address: 0.0.0.0
|
||||
port_value: 9901
|
||||
Loading…
Reference in a new issue