static_resources: listeners: - name: forge-code address: socket_address: address: 0.0.0.0 port_value: 8080 filter_chains: - filters: - name: envoy.filters.network.http_connection_manager typed_config: "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager stat_prefix: forge_code normalize_path: true merge_slashes: true path_with_escaped_slashes_action: REJECT_REQUEST use_remote_address: true access_log: - name: envoy.access_loggers.stdout typed_config: "@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog log_format: text_format_source: inline_string: "%START_TIME% %REQ(:METHOD)% %RESPONSE_CODE% %RESPONSE_CODE_DETAILS%\n" route_config: name: forge-code request_headers_to_remove: - authorization - cookie - proxy-authorization - signature - x-ssh-certificate - x-webauth-email - x-webauth-fullname - x-webauth-user response_headers_to_remove: - set-cookie - www-authenticate - proxy-authenticate virtual_hosts: - name: forge-code domains: - "*" routes: - match: path: /user/login headers: - name: :method string_match: safe_regex: regex: "GET|HEAD" direct_response: status: 303 response_headers_to_add: - header: key: location value: /login-disabled append_action: OVERWRITE_IF_EXISTS_OR_ADD - header: key: cache-control value: no-store append_action: OVERWRITE_IF_EXISTS_OR_ADD typed_per_filter_config: envoy.filters.http.rbac: "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute - match: path: /login-disabled headers: - name: :method string_match: safe_regex: regex: "GET|HEAD" direct_response: status: 200 body: filename: /etc/envoy/login-disabled.html response_headers_to_add: - header: key: content-type value: text/html; charset=utf-8 append_action: OVERWRITE_IF_EXISTS_OR_ADD - header: key: cache-control value: no-store append_action: OVERWRITE_IF_EXISTS_OR_ADD - header: key: referrer-policy value: no-referrer append_action: OVERWRITE_IF_EXISTS_OR_ADD - header: key: x-content-type-options value: nosniff append_action: OVERWRITE_IF_EXISTS_OR_ADD - header: key: content-security-policy value: "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'" append_action: OVERWRITE_IF_EXISTS_OR_ADD - match: path: /robots.txt headers: - name: :method string_match: safe_regex: regex: "GET|HEAD" direct_response: status: 200 body: filename: /etc/envoy/robots.txt response_headers_to_add: - header: key: content-type value: text/plain; charset=utf-8 append_action: OVERWRITE_IF_EXISTS_OR_ADD - header: key: cache-control value: public, max-age=3600 append_action: OVERWRITE_IF_EXISTS_OR_ADD - header: key: x-content-type-options value: nosniff append_action: OVERWRITE_IF_EXISTS_OR_ADD typed_per_filter_config: envoy.filters.http.rbac: "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute - match: prefix: /assets/ route: cluster: forge-code timeout: 0s - match: prefix: / route: cluster: forge-code timeout: 0s response_headers_to_add: - header: key: vary value: Accept, Accept-Language append_action: APPEND_IF_EXISTS_OR_ADD http_filters: - name: envoy.filters.http.rbac typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC rules: action: DENY policies: authentication-paths: permissions: - header: name: :path string_match: safe_regex: regex: '^/(user|login/oauth|admin|notifications)([/?].*)?$' principals: - any: true authenticated-global-pages: permissions: - header: name: :path string_match: safe_regex: regex: '^/(repo|issues|pulls|milestones|report_abuse)([/?].*)?$' principals: - any: true authenticated-organization-pages: permissions: - or_rules: rules: - header: name: :path string_match: safe_regex: regex: '^/org/(create|invite)([/?].*)?$' - header: name: :path string_match: safe_regex: regex: '^/org/[^/?]+/(dashboard|issues|pulls|milestones|teams|settings)([/?].*)?$' principals: - any: true authenticated-repository-pages: permissions: - or_rules: rules: - header: name: :path string_match: safe_regex: regex: '^/[^/?]+/[^/?]+/(settings|action|fork)([/?].*)?$' - header: name: :path string_match: safe_regex: regex: '^/[^/?]+/[^/?]+/(_edit|_new|_delete|_upload|_diffpatch|_cherrypick)([/?].*)?$' - header: name: :path string_match: safe_regex: regex: '^/[^/?]+/[^/?]+/releases/(new|edit)([/?].*)?$' principals: - any: true receive-pack: permissions: - header: name: :path string_match: safe_regex: regex: ".*(git-receive-pack|service=git-receive-pack).*" principals: - any: true query-credentials: permissions: - header: name: :path string_match: safe_regex: regex: ".*[?&](token|access_token)=[^&]*.*" principals: - any: true authenticated-methods: permissions: - header: name: :method string_match: safe_regex: regex: "PUT|PATCH|DELETE" principals: - any: true authenticated-posts: permissions: - and_rules: rules: - header: name: :method string_match: exact: POST - not_rule: header: name: :path string_match: safe_regex: regex: '^/[^/?]+/[^/?]+/(git-upload-pack|lastcommit/.*|archive/.*)([?].*)?$' principals: - any: true - name: envoy.filters.http.router typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router clusters: - name: forge-code type: STRICT_DNS load_assignment: cluster_name: forge-code endpoints: - lb_endpoints: - endpoint: address: socket_address: address: forge-code-http.forgejo-public.svc.cluster.local. port_value: 3000 overload_manager: refresh_interval: 0.25s resource_monitors: - name: envoy.resource_monitors.global_downstream_max_connections typed_config: "@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig max_active_downstream_connections: 1024 admin: address: socket_address: address: 0.0.0.0 port_value: 9901