Jeffrey
1849703886
Adds a pelican listener to gateway-public and a gateway-public parentRef to pelican-route. Reuses the existing pelican-tls certificate, which both listeners reference. Wings deliberately stays internal-only. That is a real functional limit, not an oversight: the browser talks to wings directly for the console websocket and for file upload/download, using the address from Node::getConnectionAddress. From outside the LAN those calls will fail. Panel login, server list, file browsing and editing, and power actions all go through the panel API and keep working, because the panel reaches wings server-side over the internal gateway. CrowdSec ext_authz already covers every listener on gateway-public, so the panel is behind the WAF and community blocklist from the moment it is live. Prerequisites completed first: TRUSTED_PROXIES=10.42.0.0/16 and APP_2FA_REQUIRED=1 set in Infisical and verified live in the panel config. pelican.jsme.be has no public DNS record yet, so this makes the panel reachable through 10.8.11.105 but not from the internet. The Azure DNS CNAME in the OpenTofu repo is the actual cutover.
54 lines
2.0 KiB
YAML
54 lines
2.0 KiB
YAML
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: pelican-route
|
|
namespace: pelican
|
|
spec:
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
namespace: envoy-gateway
|
|
sectionName: pelican
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: gateway-public
|
|
namespace: envoy-gateway
|
|
sectionName: pelican
|
|
hostnames:
|
|
- "pelican.jsme.be"
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
filters:
|
|
- type: RequestHeaderModifier
|
|
requestHeaderModifier:
|
|
set:
|
|
- name: X-Forwarded-Host
|
|
value: "pelican.jsme.be"
|
|
- name: X-Forwarded-Proto
|
|
value: https
|
|
- type: ResponseHeaderModifier
|
|
responseHeaderModifier:
|
|
set:
|
|
- name: Strict-Transport-Security
|
|
value: "max-age=31536000; includeSubDomains"
|
|
- name: X-Content-Type-Options
|
|
value: nosniff
|
|
- name: X-Frame-Options
|
|
value: SAMEORIGIN
|
|
- name: Referrer-Policy
|
|
value: strict-origin-when-cross-origin
|
|
- name: Permissions-Policy
|
|
value: "camera=(), microphone=(), geolocation=(), payment=()"
|
|
- name: Content-Security-Policy
|
|
value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: blob: https://gravatar.com https://www.gravatar.com; font-src 'self' data: https://cdnjs.cloudflare.com; connect-src 'self' https://wings-mc.jsme.be wss://wings-mc.jsme.be https://wings-ark.jsme.be wss://wings-ark.jsme.be ws: wss:; worker-src blob:; frame-ancestors 'self'"
|
|
backendRefs:
|
|
- name: pelican
|
|
port: 80
|
|
kind: Service
|
|
group: ""
|
|
weight: 1
|