110 lines
4 KiB
YAML
110 lines
4 KiB
YAML
|
{{- define "jupyterhub.dynamic.yaml" -}}
|
||
|
|
# Content of dynamic.yaml to be merged merged with
|
||
|
|
# proxy.traefik.extraDynamicConfig.
|
||
|
|
# ----------------------------------------------------------------------------
|
||
|
|
http:
|
||
|
|
# Middlewares tweaks requests. We define them here and reference them in
|
||
|
|
# our routers. We use them to redirect http traffic and headers to proxied
|
||
|
|
# web requests.
|
||
|
|
#
|
||
|
|
# ref: https://docs.traefik.io/middlewares/overview/
|
||
|
|
middlewares:
|
||
|
|
hsts:
|
||
|
|
# A middleware to add a HTTP Strict-Transport-Security (HSTS) response
|
||
|
|
# header, they function as a request for browsers to enforce HTTPS on
|
||
|
|
# their end in for a given time into the future, and optionally
|
||
|
|
# subdomains for requests to subdomains as well.
|
||
|
|
#
|
||
|
|
# ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
|
||
|
|
headers:
|
||
|
|
stsIncludeSubdomains: {{ .Values.proxy.traefik.hsts.includeSubdomains }}
|
||
|
|
stsPreload: {{ .Values.proxy.traefik.hsts.preload }}
|
||
|
|
stsSeconds: {{ .Values.proxy.traefik.hsts.maxAge }}
|
||
|
|
# A middleware to redirect to https
|
||
|
|
redirect:
|
||
|
|
redirectScheme:
|
||
|
|
permanent: true
|
||
|
|
scheme: https
|
||
|
|
# A middleware to add a X-Scheme (X-Forwarded-Proto) header that
|
||
|
|
# JupyterHub's Tornado web-server needs if expecting to serve https
|
||
|
|
# traffic. Without it we would run into issues like:
|
||
|
|
# https://github.com/jupyterhub/jupyterhub/issues/2284
|
||
|
|
scheme:
|
||
|
|
headers:
|
||
|
|
customRequestHeaders:
|
||
|
|
# DISCUSS ME: Can we use the X-Forwarded-Proto header instead? It
|
||
|
|
# seems more recognized. Mozilla calls it the de-facto standard
|
||
|
|
# header for this purpose, and Tornado recognizes both.
|
||
|
|
#
|
||
|
|
# ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto
|
||
|
|
# ref: https://www.tornadoweb.org/en/stable/httpserver.html#http-server
|
||
|
|
X-Scheme: https
|
||
|
|
|
||
|
|
# Routers routes web requests to a service and optionally tweaks them with
|
||
|
|
# middleware.
|
||
|
|
#
|
||
|
|
# ref: https://docs.traefik.io/routing/routers/
|
||
|
|
routers:
|
||
|
|
# Route secure https traffic to the configurable-http-proxy managed by
|
||
|
|
# JupyterHub.
|
||
|
|
default:
|
||
|
|
entrypoints:
|
||
|
|
- "https"
|
||
|
|
middlewares:
|
||
|
|
- "hsts"
|
||
|
|
- "scheme"
|
||
|
|
rule: PathPrefix(`/`)
|
||
|
|
service: default
|
||
|
|
# Use our predefined TLS options and certificate resolver, enabling
|
||
|
|
# this route to act as a TLS termination proxy with high security
|
||
|
|
# standards.
|
||
|
|
tls:
|
||
|
|
certResolver: default
|
||
|
|
domains:
|
||
|
|
{{- range $host := .Values.proxy.https.hosts }}
|
||
|
|
- main: {{ $host }}
|
||
|
|
{{- end }}
|
||
|
|
options: default
|
||
|
|
|
||
|
|
# Route insecure http traffic to https
|
||
|
|
insecure:
|
||
|
|
entrypoints:
|
||
|
|
- "http"
|
||
|
|
middlewares:
|
||
|
|
- "redirect"
|
||
|
|
rule: PathPrefix(`/`)
|
||
|
|
service: default
|
||
|
|
|
||
|
|
# Services represents the destinations we route traffic to.
|
||
|
|
#
|
||
|
|
# ref: https://docs.traefik.io/routing/services/
|
||
|
|
services:
|
||
|
|
# Represents the configurable-http-proxy (chp) server that is managed by
|
||
|
|
# JupyterHub to route traffic both to itself and to user pods.
|
||
|
|
default:
|
||
|
|
loadBalancer:
|
||
|
|
servers:
|
||
|
|
- url: 'http://proxy-http:8000/'
|
||
|
|
|
||
|
|
# Configure TLS to give us an A+ in the ssllabs.com test
|
||
|
|
#
|
||
|
|
# ref: https://www.ssllabs.com/ssltest/
|
||
|
|
tls:
|
||
|
|
options:
|
||
|
|
default:
|
||
|
|
# Allowed ciphers adapted from Mozillas SSL Configuration Generator
|
||
|
|
# configured for Intermediate support which doesn't support very old
|
||
|
|
# systems but doesn't require very modern either.
|
||
|
|
#
|
||
|
|
# ref: https://ssl-config.mozilla.org/#server=traefik&version=2.1.2&config=intermediate&guideline=5.4
|
||
|
|
cipherSuites:
|
||
|
|
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
||
|
|
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
||
|
|
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
||
|
|
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
||
|
|
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
|
||
|
|
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
|
||
|
|
minVersion: VersionTLS12
|
||
|
|
sniStrict: true
|
||
|
|
{{- end }}
|