Added nextcloud headers

charts/nextcloud/templates/headers.yaml

@@ -0,0 +1,36 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: headers
+spec:
+  headers:
+    # CROSS ORIGIN SECURITY
+    accessControlAllowMethods:
+    #- "*"
+    - "GET"
+    - "OPTIONS"
+    - "PUT"
+    accessControlAllowHeaders:
+    - "*"
+    accessControlAllowOriginList:
+    - "https://nextcloud.deepcypher.me"
+    accessControlMaxAge: 100
+    addVaryHeader: true
+
+    # this modified what the requests look like when they are inbound to the cluster
+    customRequestHeaders:
+      # specifically say the forwarded traffic is https even if it is recieved as http
+      # E.G for FastAPI since it sits behind the proxy. If it ever redirects it will put
+      # in the redirect pody to go to a http route. With this set to https it will go to https
+      # instead.
+      X-Forwarded-Proto: "https"
+
+    # this modifies what the requests look like then they are outbound from the cluster
+    customResponseHeaders:
+      cross-origin-resource-policy: same-site # whether we can be loaded from another website
+      # See: https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zMEu9ySMCiTGMS9y0GU92k/edit
+      # These two headers are necessary for Cross-Origin Isolation security feature
+      # which isolates browsing context groups
+      # This is also necessary for certain browser APIs like high resolution timers
+      cross-origin-embedder-policy: require-corp
+      cross-origin-opener-policy: same-origin

charts/nextcloud/templates/nextcloud-netpol.yaml

@@ -20,7 +20,7 @@ spec:
         except:
         - 10.0.0.0/8
         - 192.168.0.0/16
-        # - 172.16.0.0/20
+        - 172.16.0.0/20
     # or allowed to go to local namespace
     - namespaceSelector:
         matchLabels:

charts/nextcloud/values.yaml

@@ -10,6 +10,7 @@ nextcloud:
         secretName: nextcloud-cert
     annotations:
       cert-manager.io/cluster-issuer: "aux-issuer"
+      traefik.ingress.kubernetes.io/router.middlewares: nextcloud-headers@kubernetescrd
       gethomepage.dev/enabled: "true"
       gethomepage.dev/name: "Nextcloud"
       gethomepage.dev/description: "Homelab storage."
@@ -52,15 +53,30 @@ nextcloud:
       logging.config.php: |-
         <?php
         $CONFIG = array (
+          #'log_type' => 'errorlog',
           'log_type' => 'file',
           'logfile' => 'nextcloud.log',
           'loglevel' => 1,
           'logdateformat' => 'F d, Y H:i:s'
           );
+      #s3.config.php: |-
+      #  <?php
+      #  $CONFIG = array (
+      #    'objectstore' => array(
+      #      'class' => 'OC\\Files\\ObjectStore\\S3',
+      #      'arguments' => array(
+      #              'bucket' => 'nextcloud', // your bucket name
+      #              'autocreate' => true,
+      #              'key'    => 'EJ39ITYZEUH5BGWDRUFY', // your key
+      #              'secret' => 'M5MrXTRjkyMaxXPe2FRXMTfTfbKEnZCu+7uRTVSj', // your secret
+      #              'use_ssl' => false,
+      #              'region' => 'eu-west-2', // your region
+      #        ),
+      #      ),
+      #    );
       #logging.config.php: |-
       #  <?php
       #  $CONFIG = array (
-      #    'log_type' => 'errorlog',
       #    );
 
     host: nextcloud.deepcypher.me