From b443152ecc265cd7fecce864838b193ba08ff904 Mon Sep 17 00:00:00 2001
From: nutcas3 <mauricee423@gmail.com>
Date: Fri, 1 May 2026 09:07:13 +0300
Subject: [PATCH] feat: Add Traefik configuration with security middlewares,
 rate limiting, and dynamic routing

- Add traefik.yml with HTTP to HTTPS redirection and secure-headers middleware
- Add dashboard on port 80 with insecure mode enabled
- Add websecure entrypoint on port 443 with security headers
- Add Docker and file providers with dynamic configuration watching
- Add Prometheus metrics with entrypoint and service labels
- Add middlewares.yml with secure-headers including CSP, X-Frame-Options, and Permissions
---
 traefik/dynamic/middlewares.yml | 56 +++++++++++++++++++++++++++++++++
 traefik/traefik.yml             | 38 ++++++++++++++++++++++
 2 files changed, 94 insertions(+)
 create mode 100644 traefik/dynamic/middlewares.yml
 create mode 100644 traefik/traefik.yml

diff --git a/traefik/dynamic/middlewares.yml b/traefik/dynamic/middlewares.yml
new file mode 100644
index 0000000..b45fc64
--- /dev/null
+++ b/traefik/dynamic/middlewares.yml
@@ -0,0 +1,56 @@
+http:
+  middlewares:
+    secure-headers:
+      headers:
+        customRequestHeaders:
+          X-Forwarded-Proto: "https"
+        customResponseHeaders:
+          X-Content-Type-Options: "nosniff"
+          X-Frame-Options: "DENY"
+          X-XSS-Protection: "1; mode=block"
+          Referrer-Policy: "strict-origin-when-cross-origin"
+          Permissions-Policy: "camera=(), microphone=(), geolocation=()"
+          Content-Security-Policy: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none';"
+
+    # Rate Limiting Middleware (API endpoints)
+    api-ratelimit:
+      rateLimit:
+        average: 100
+        period: "1m"
+        burst: 200
+
+    # Rate Limiting Middleware (Charging endpoints - more restrictive)
+    charging-ratelimit:
+      rateLimit:
+        average: 1000
+        period: "1m"
+        burst: 2000
+
+    # Rate Limiting Middleware (Carrier endpoints - very restrictive)
+    carrier-ratelimit:
+      rateLimit:
+        average: 50
+        period: "1m"
+        burst: 100
+
+    # JWT Authentication Middleware
+    jwt-auth:
+      plugin:
+        JWTAuth:
+          secret: "${JWT_SECRET}"
+          authHeaderName: "Authorization"
+          responseHeaderName: "X-Auth-User"
+          forwardAuth: true
+
+    # Compression Middleware
+    compression:
+      compress:
+        excludedContentTypes:
+          - "text/event-stream"
+          - "application/grpc"
+
+    # Retry Middleware
+    retry-attempts:
+      retry:
+        attempts: 3
+        initialInterval: "100ms"
diff --git a/traefik/traefik.yml b/traefik/traefik.yml
new file mode 100644
index 0000000..a93b5c5
--- /dev/null
+++ b/traefik/traefik.yml
@@ -0,0 +1,38 @@
+api:
+  dashboard: true
+  insecure: true
+
+entryPoints:
+  web:
+    address: ":80"
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+  websecure:
+    address: ":443"
+    http:
+      middlewares:
+        - secure-headers@file
+
+providers:
+  docker:
+    exposedByDefault: false
+    network: taas-network
+  file:
+    directory: /traefik/dynamic
+    watch: true
+
+log:
+  level: INFO
+  format: json
+
+accessLog: {}
+
+metrics:
+  prometheus:
+    addEntryPointsLabels: true
+    addServicesLabels: true
+
+ping: {}