Deploy KeyCape-backed portal login edge

sso-mfa/k8s/user-engine/ingress.yaml

@@ -0,0 +1,74 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: user-engine-security
+  namespace: user-engine
+spec:
+  chain:
+    middlewares:
+      - name: user-engine-rate-limit
+      - name: user-engine-headers
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: user-engine-rate-limit
+  namespace: user-engine
+spec:
+  rateLimit:
+    average: 60
+    period: 1m
+    burst: 20
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: user-engine-headers
+  namespace: user-engine
+spec:
+  headers:
+    stsSeconds: 31536000
+    stsIncludeSubdomains: true
+    contentTypeNosniff: true
+    frameDeny: true
+    referrerPolicy: no-referrer
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: user-engine
+  namespace: user-engine
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: user-engine-user-engine-security@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: users.92-205-62-239.nip.io
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: user-engine
+                port: {number: 8080}
+  tls:
+    - secretName: user-engine-tls
+      hosts: [users.92-205-62-239.nip.io]
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-acme-http01
+  namespace: user-engine
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: "true"
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+      ports: [{protocol: TCP, port: 8089}]