From f39c7e968f096aa6dea0c7ac70800a7bc8de1cff Mon Sep 17 00:00:00 2001 From: Kjeld Schouten-Lebbing Date: Wed, 8 Sep 2021 15:38:31 +0200 Subject: [PATCH] feat: Add IPWhitelist, redirectRegex and (internal) nextcloud middlewares (#929) * feat: Add IPWhitelist and redirectRegex middlewares to traefik * fix: add nextcloud middlewares * fix nextcloud cronjob --- .../stable/nextcloud/templates/_cronjob.tpl | 2 +- charts/stable/nextcloud/templates/common.yaml | 9 +- charts/stable/traefik/Chart.yaml | 2 +- charts/stable/traefik/SCALE/questions.yaml | 87 +++++++++++++++++++ .../templates/middlewares/ipwhitelist.yaml | 33 +++++++ .../templates/middlewares/redirectregex.yaml | 20 +++++ .../templates/middlewares/tc-nextcloud.yaml | 65 ++++++++++++++ charts/stable/traefik/values.yaml | 27 ++++-- 8 files changed, 233 insertions(+), 12 deletions(-) create mode 100644 charts/stable/traefik/templates/middlewares/ipwhitelist.yaml create mode 100644 charts/stable/traefik/templates/middlewares/redirectregex.yaml create mode 100644 charts/stable/traefik/templates/middlewares/tc-nextcloud.yaml diff --git a/charts/stable/nextcloud/templates/_cronjob.tpl b/charts/stable/nextcloud/templates/_cronjob.tpl index c2ed1ca20f8..96a0b6145c6 100644 --- a/charts/stable/nextcloud/templates/_cronjob.tpl +++ b/charts/stable/nextcloud/templates/_cronjob.tpl @@ -1,6 +1,6 @@ {{/* Define the cronjob */}} {{- define "nextcloud.cronjob" -}} -{{- $jobName := include "common.names.fullname" . -}} +{{- $jobName := include "common.names.fullname" . }} --- apiVersion: batch/v1beta1 diff --git a/charts/stable/nextcloud/templates/common.yaml b/charts/stable/nextcloud/templates/common.yaml index 8e72c538b1d..53b4b7b25be 100644 --- a/charts/stable/nextcloud/templates/common.yaml +++ b/charts/stable/nextcloud/templates/common.yaml @@ -1,14 +1,17 @@ {{/* Make sure all variables are set properly */}} {{- include "common.values.setup" . }} -{{/* Render the templates */}} -{{ include "common.all" . }} - {{/* Render configmap for nextcloud */}} {{- include "nextcloud.configmap" . }} {{/* Render secrets for nextcloud */}} {{- include "nextcloud.secrets" . }} +{{- $newMiddlewares := append .Values.ingress.main.fixedMiddlewares "tc-nextcloud-chain" }} +{{- $_ := set .Values.ingress.main "fixedMiddlewares" $newMiddlewares -}} + {{/* Render cronjob for nextcloud */}} {{- include "nextcloud.cronjob" . }} + +{{/* Render the templates */}} +{{ include "common.all" . }} diff --git a/charts/stable/traefik/Chart.yaml b/charts/stable/traefik/Chart.yaml index cfb5521732e..4b84bf6daa2 100644 --- a/charts/stable/traefik/Chart.yaml +++ b/charts/stable/traefik/Chart.yaml @@ -22,4 +22,4 @@ sources: - https://github.com/traefik/traefik-helm-chart - https://traefik.io/ type: application -version: 7.0.11 +version: 7.1.0 diff --git a/charts/stable/traefik/SCALE/questions.yaml b/charts/stable/traefik/SCALE/questions.yaml index 947bbae5946..047d70d5c75 100644 --- a/charts/stable/traefik/SCALE/questions.yaml +++ b/charts/stable/traefik/SCALE/questions.yaml @@ -563,6 +563,93 @@ questions: type: int required: true default: 200 + - variable: redirectRegex + label: "redirectRegex" + schema: + type: list + default: [] + items: + - variable: redirectRegexEntry + label: "" + schema: + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: regex + label: "Regex" + schema: + type: string + required: true + default: "" + - variable: replacement + label: "Replacement" + schema: + type: string + required: true + default: "" + - variable: permanent + label: "Permanent" + schema: + type: boolean + required: true + default: false + + - variable: ipWhiteList + label: "ipWhiteList" + schema: + type: list + default: [] + items: + - variable: ipWhiteListEntry + label: "" + schema: + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + default: "" + - variable: sourceRange + label: "Source Range" + schema: + type: list + default: [] + items: + - variable: sourceRangeEntry + label: "" + schema: + type: string + required: true + default: "" + - variable: ipStrategy + label: "IP Strategy" + schema: + type: dict + attrs: + - variable: depth + label: "Depth" + schema: + type: int + required: true + - variable: excludedIPs + label: "Excluded IPs" + schema: + type: list + default: [] + items: + - variable: excludedIPsEntry + label: "" + schema: + type: string + required: true + default: "" + - variable: hostNetwork group: "Networking and Services" diff --git a/charts/stable/traefik/templates/middlewares/ipwhitelist.yaml b/charts/stable/traefik/templates/middlewares/ipwhitelist.yaml new file mode 100644 index 00000000000..82467dea0b9 --- /dev/null +++ b/charts/stable/traefik/templates/middlewares/ipwhitelist.yaml @@ -0,0 +1,33 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.ipWhiteList }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + ipWhiteList: + sourceRange: + {{- range $middlewareData.sourceRange }} + - {{ . }} + {{- end }} + {{- if $middlewareData.ipStrategy }} + ipStrategy: + {{- if $middlewareData.ipStrategy.depth }} + depth: {{ $middlewareData.ipStrategy.depth }} + {{- end }} + {{- if $middlewareData.ipStrategy.excludedIPs }} + excludedIPs: + {{- range $middlewareData.ipStrategy.excludedIPs }} + - {{ . }} + {{- end }} + {{- end }} + {{- end }} +{{ end }} diff --git a/charts/stable/traefik/templates/middlewares/redirectregex.yaml b/charts/stable/traefik/templates/middlewares/redirectregex.yaml new file mode 100644 index 00000000000..683aec93d72 --- /dev/null +++ b/charts/stable/traefik/templates/middlewares/redirectregex.yaml @@ -0,0 +1,20 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.redirectRegex }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + redirectRegex: + regex: {{ $middlewareData.regex | quote }} + replacement: {{ $middlewareData.replacement | quote }} + permanent: {{ $middlewareData.replacement }} +{{ end }} diff --git a/charts/stable/traefik/templates/middlewares/tc-nextcloud.yaml b/charts/stable/traefik/templates/middlewares/tc-nextcloud.yaml new file mode 100644 index 00000000000..68acb00d210 --- /dev/null +++ b/charts/stable/traefik/templates/middlewares/tc-nextcloud.yaml @@ -0,0 +1,65 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-headers + namespace: {{ $namespace }} +spec: + headers: + stsSeconds: 63072000 + forceSTSHeader: true +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-redirectregex-dav +spec: + redirectRegex: + regex: "https://(.*)/.well-known/(card|cal)dav" + replacement: "https://${1}/remote.php/dav/" +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-redirectregex-finger +spec: + redirectRegex: + regex: "https://(.*)/.well-known/webfinger" + replacement: "https://${1}/public.php?service=webfinger" +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-redirectregex-hostmeta +spec: + redirectRegex: + regex: "https://(.*)/.well-known/host-meta" + replacement: "https://${1}/public.php?service=host-meta" +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-redirectregex-hostmetajson +spec: + redirectRegex: + regex: "https://(.*)/.well-known/host-meta.json" + replacement: "https://${1}/public.php?service=host-meta-json" +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-chain + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: tc-nextcloud-headers + - name: tc-nextcloud-redirectregex-dav + - name: tc-nextcloud-redirectregex-finger + - name: tc-nextcloud-redirectregex-hostmetajson + - name: tc-nextcloud-redirectregex-hostmeta diff --git a/charts/stable/traefik/values.yaml b/charts/stable/traefik/values.yaml index e349ea62298..349679eabbb 100644 --- a/charts/stable/traefik/values.yaml +++ b/charts/stable/traefik/values.yaml @@ -306,15 +306,28 @@ middlewares: # authResponseHeadersRegex: "^X-" # trustForwardHeader: true chain: [] - # name: chainname - # middlewares: - # - name: compress + # - name: chainname + # middlewares: + # - name: compress redirectScheme: [] - # scheme: https - # permanent: true + # - name: redirectSchemeName + # scheme: https + # permanent: true rateLimit: [] - # average: 300 - # burst: 200 + # - name: rateLimitName + # average: 300 + # burst: 200 + redirectRegex: [] + # - name: redirectRegexName + # regex: putregexhere + # replacement: replacementurlhere + # permanent: false + ipWhiteList: [] + # - name: ipWhiteListName + # sourceRange: [] + # ipStrategy: + # depth: 2 + # excludedIPs: [] portalhook: enabled: true