pi
eb83aa6290
- edge: extract VPC/subnet/bandwidth/disk/DNS/Caddy settings into variables - edge: add Caddyfile template with SSE-safe flush_interval -1 and security headers - edge: add WireGuard NAT masquerade so homelab peer accepts forwarded client IPs - edge: mark user_data sensitive and add prevent_destroy to the relay instance - edge: validate relay_admin_cidr and Cloudflare hostnames - edge: parameterise Cloudflare TTL/proxied and enforce proxied tunnel CNAMEs - iam: fix PDB key to chart-supported pdb and remove unsupported extraVolumes - iam: keep login hardened; drop unsupported login PDB
23 lines
570 B
Smarty
23 lines
570 B
Smarty
# Rendered by terraform/edge. Do not edit on the instance.
|
|
#
|
|
# Caddy terminates TLS for the .cn hostnames and forwards over the WireGuard
|
|
# tunnel to ingress-nginx. flush_interval -1 disables response buffering so
|
|
# Server-Sent Events reach the client chunk-by-chunk.
|
|
{
|
|
email ${acme_email}
|
|
admin off
|
|
}
|
|
|
|
${hosts} {
|
|
reverse_proxy ${ingress_upstream} {
|
|
flush_interval -1
|
|
}
|
|
|
|
header {
|
|
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
|
X-Content-Type-Options "nosniff"
|
|
X-Frame-Options "DENY"
|
|
Referrer-Policy "strict-origin-when-cross-origin"
|
|
}
|
|
}
|