271 lines
13 KiB
YAML
271 lines
13 KiB
YAML
static_resources:
|
|
listeners:
|
|
- name: forge-code
|
|
address:
|
|
socket_address:
|
|
address: 0.0.0.0
|
|
port_value: 8080
|
|
filter_chains:
|
|
- filters:
|
|
- name: envoy.filters.network.http_connection_manager
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
|
stat_prefix: forge_code
|
|
normalize_path: true
|
|
merge_slashes: true
|
|
path_with_escaped_slashes_action: REJECT_REQUEST
|
|
use_remote_address: true
|
|
access_log:
|
|
- name: envoy.access_loggers.stdout
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
|
|
log_format:
|
|
text_format_source:
|
|
inline_string: "%START_TIME% %REQ(:METHOD)% %RESPONSE_CODE% %RESPONSE_CODE_DETAILS%\n"
|
|
route_config:
|
|
name: forge-code
|
|
request_headers_to_remove:
|
|
- authorization
|
|
- cookie
|
|
- proxy-authorization
|
|
- signature
|
|
- x-ssh-certificate
|
|
- x-webauth-email
|
|
- x-webauth-fullname
|
|
- x-webauth-user
|
|
response_headers_to_remove:
|
|
- set-cookie
|
|
- www-authenticate
|
|
- proxy-authenticate
|
|
virtual_hosts:
|
|
- name: forge-code
|
|
domains:
|
|
- "*"
|
|
routes:
|
|
- match:
|
|
path: /user/login
|
|
headers:
|
|
- name: :method
|
|
string_match:
|
|
safe_regex:
|
|
regex: "GET|HEAD"
|
|
direct_response:
|
|
status: 303
|
|
response_headers_to_add:
|
|
- header:
|
|
key: location
|
|
value: /login-disabled
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
- header:
|
|
key: cache-control
|
|
value: no-store
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
typed_per_filter_config:
|
|
envoy.filters.http.rbac:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute
|
|
- match:
|
|
path: /login-disabled
|
|
headers:
|
|
- name: :method
|
|
string_match:
|
|
safe_regex:
|
|
regex: "GET|HEAD"
|
|
direct_response:
|
|
status: 200
|
|
body:
|
|
filename: /etc/envoy/login-disabled.html
|
|
response_headers_to_add:
|
|
- header:
|
|
key: content-type
|
|
value: text/html; charset=utf-8
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
- header:
|
|
key: cache-control
|
|
value: no-store
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
- header:
|
|
key: referrer-policy
|
|
value: no-referrer
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
- header:
|
|
key: x-content-type-options
|
|
value: nosniff
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
- header:
|
|
key: content-security-policy
|
|
value: "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
- match:
|
|
path: /robots.txt
|
|
headers:
|
|
- name: :method
|
|
string_match:
|
|
safe_regex:
|
|
regex: "GET|HEAD"
|
|
direct_response:
|
|
status: 200
|
|
body:
|
|
filename: /etc/envoy/robots.txt
|
|
response_headers_to_add:
|
|
- header:
|
|
key: content-type
|
|
value: text/plain; charset=utf-8
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
- header:
|
|
key: cache-control
|
|
value: public, max-age=3600
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
- header:
|
|
key: x-content-type-options
|
|
value: nosniff
|
|
append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
typed_per_filter_config:
|
|
envoy.filters.http.rbac:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBACPerRoute
|
|
- match:
|
|
prefix: /assets/
|
|
route:
|
|
cluster: forge-code
|
|
timeout: 0s
|
|
- match:
|
|
prefix: /
|
|
route:
|
|
cluster: forge-code
|
|
timeout: 0s
|
|
response_headers_to_add:
|
|
- header:
|
|
key: vary
|
|
value: Accept, Accept-Language
|
|
append_action: APPEND_IF_EXISTS_OR_ADD
|
|
http_filters:
|
|
- name: envoy.filters.http.rbac
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
|
|
rules:
|
|
action: DENY
|
|
policies:
|
|
authentication-paths:
|
|
permissions:
|
|
- header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: '^/(user|login/oauth|admin|notifications)([/?].*)?$'
|
|
principals:
|
|
- any: true
|
|
authenticated-global-pages:
|
|
permissions:
|
|
- header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: '^/(repo|issues|pulls|milestones|report_abuse)([/?].*)?$'
|
|
principals:
|
|
- any: true
|
|
authenticated-organization-pages:
|
|
permissions:
|
|
- or_rules:
|
|
rules:
|
|
- header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: '^/org/(create|invite)([/?].*)?$'
|
|
- header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: '^/org/[^/?]+/(dashboard|issues|pulls|milestones|teams|settings)([/?].*)?$'
|
|
principals:
|
|
- any: true
|
|
authenticated-repository-pages:
|
|
permissions:
|
|
- or_rules:
|
|
rules:
|
|
- header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: '^/[^/?]+/[^/?]+/(settings|action|fork)([/?].*)?$'
|
|
- header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: '^/[^/?]+/[^/?]+/(_edit|_new|_delete|_upload|_diffpatch|_cherrypick)([/?].*)?$'
|
|
- header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: '^/[^/?]+/[^/?]+/releases/(new|edit)([/?].*)?$'
|
|
principals:
|
|
- any: true
|
|
receive-pack:
|
|
permissions:
|
|
- header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: ".*(git-receive-pack|service=git-receive-pack).*"
|
|
principals:
|
|
- any: true
|
|
query-credentials:
|
|
permissions:
|
|
- header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: ".*[?&](token|access_token)=[^&]*.*"
|
|
principals:
|
|
- any: true
|
|
authenticated-methods:
|
|
permissions:
|
|
- header:
|
|
name: :method
|
|
string_match:
|
|
safe_regex:
|
|
regex: "PUT|PATCH|DELETE"
|
|
principals:
|
|
- any: true
|
|
authenticated-posts:
|
|
permissions:
|
|
- and_rules:
|
|
rules:
|
|
- header:
|
|
name: :method
|
|
string_match:
|
|
exact: POST
|
|
- not_rule:
|
|
header:
|
|
name: :path
|
|
string_match:
|
|
safe_regex:
|
|
regex: '^/[^/?]+/[^/?]+/(git-upload-pack|lastcommit/.*|archive/.*)([?].*)?$'
|
|
principals:
|
|
- any: true
|
|
- name: envoy.filters.http.router
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
|
|
clusters:
|
|
- name: forge-code
|
|
type: STRICT_DNS
|
|
load_assignment:
|
|
cluster_name: forge-code
|
|
endpoints:
|
|
- lb_endpoints:
|
|
- endpoint:
|
|
address:
|
|
socket_address:
|
|
address: forge-code-http.forgejo-public.svc.cluster.local.
|
|
port_value: 3000
|
|
overload_manager:
|
|
refresh_interval: 0.25s
|
|
resource_monitors:
|
|
- name: envoy.resource_monitors.global_downstream_max_connections
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.resource_monitors.downstream_connections.v3.DownstreamConnectionsConfig
|
|
max_active_downstream_connections: 1024
|
|
admin:
|
|
address:
|
|
socket_address:
|
|
address: 0.0.0.0
|
|
port_value: 9901
|