# Exact product hostname and isolated company path. Private media stays in Django.
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vergabe-security
  namespace: vergabe-demo-company
spec:
  chain:
    middlewares:
    - name: vergabe-rate-limit
    - name: vergabe-headers
    - name: vergabe-canonical-path
    - name: vergabe-strip-tenant
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vergabe-rate-limit
  namespace: vergabe-demo-company
spec:
  rateLimit:
    average: 60
    period: 1m
    burst: 20
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vergabe-headers
  namespace: vergabe-demo-company
spec:
  headers:
    stsSeconds: 31536000
    contentTypeNosniff: true
    frameDeny: true
    referrerPolicy: same-origin
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vergabe-canonical-path
  namespace: vergabe-demo-company
spec:
  redirectRegex:
    regex: ^(https?://vergabe-teilnahme\.coulomb\.social/demo-company)(\?.*)?$
    replacement: ${1}/${2}
    permanent: false
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vergabe-strip-tenant
  namespace: vergabe-demo-company
spec:
  stripPrefix:
    prefixes:
    - /demo-company
---
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: vergabe-https
  namespace: vergabe-demo-company
spec:
  redirectScheme:
    scheme: https
    permanent: true
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: vergabe-demo-company
  namespace: vergabe-demo-company
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: 'true'
    traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-security@kubernetescrd
spec:
  ingressClassName: traefik
  rules:
  - host: vergabe-teilnahme.coulomb.social
    http:
      paths:
      - path: /demo-company
        pathType: Prefix
        backend:
          service:
            name: vergabe-teilnahme
            port:
              number: 80
  tls:
  - secretName: vergabe-demo-tls
    hosts:
    - vergabe-teilnahme.coulomb.social
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: web
    traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-https@kubernetescrd
  name: vergabe-demo-company-http
  namespace: vergabe-demo-company
spec:
  ingressClassName: traefik
  rules:
  - host: vergabe-teilnahme.coulomb.social
    http:
      paths:
      - backend:
          service:
            name: vergabe-teilnahme
            port:
              number: 80
        path: /demo-company
        pathType: Prefix