 pi
|
eb83aa6290
|
refactor(edge,iam): apply best practices to relay and Zitadel config
- edge: extract VPC/subnet/bandwidth/disk/DNS/Caddy settings into variables
- edge: add Caddyfile template with SSE-safe flush_interval -1 and security headers
- edge: add WireGuard NAT masquerade so homelab peer accepts forwarded client IPs
- edge: mark user_data sensitive and add prevent_destroy to the relay instance
- edge: validate relay_admin_cidr and Cloudflare hostnames
- edge: parameterise Cloudflare TTL/proxied and enforce proxied tunnel CNAMEs
- iam: fix PDB key to chart-supported pdb and remove unsupported extraVolumes
- iam: keep login hardened; drop unsupported login PDB
|
2026-10-25 18:03:55 -07:00 |
|