fix(traefik): introduce two basic changes with different CORS policy

charts/core/traefik/Chart.yaml

@@ -22,7 +22,7 @@ sources:
 - https://github.com/traefik/traefik-helm-chart
 - https://traefik.io/
 type: application
-version: 10.0.48
+version: 10.0.49
 annotations:
   truecharts.org/catagories: |
     - network

charts/core/traefik/templates/middlewares/tc-chains.yaml

@@ -7,23 +7,23 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
-  name: tc-synapse-headers
-  namespace: {{ $namespace }}
-spec:
-  headers:
-    accessControlAllowOriginList:
-      - "*"
-
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: tc-synapse-chain
+  name: tc-opencors-chain
   namespace: {{ $namespace }}
 spec:
   chain:
     middlewares:
     - name: basic-ratelimit
-    - name: basic-secure-headers
-    - name: tc-synapse-headers
+    - name: tc-opencors-headers
+    - name: compress
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-closedcors-chain
+  namespace: {{ $namespace }}
+spec:
+  chain:
+    middlewares:
+    - name: basic-ratelimit
+    - name: tc-closedcors-headers
     - name: compress

charts/core/traefik/templates/middlewares/tc-headers.yaml

@@ -0,0 +1,64 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-opencors-headers
+  namespace: {{ $namespace }}
+spec:
+  headers:
+    accessControlAllowHeaders:
+    - '*'
+    accessControlAllowMethods:
+    - GET
+    - OPTIONS
+    - HEAD
+    - PUT
+    - POST
+    accessControlAllowOriginList:
+    - '*'
+    accessControlMaxAge: 100
+    browserXssFilter: true
+    contentTypeNosniff: true
+    customRequestHeaders:
+      X-Forwarded-Proto: https
+    customResponseHeaders:
+      X-Robots-Tag: none
+      server: ""
+    forceSTSHeader: true
+    referrerPolicy: same-origin
+    sslForceHost: true
+    sslRedirect: true
+    stsSeconds: 63072000
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-closedcors-headers
+  namespace: {{ $namespace }}
+spec:
+  headers:
+    accessControlAllowMethods:
+      - GET
+      - OPTIONS
+      - HEAD
+      - PUT
+    accessControlMaxAge: 100
+    sslRedirect: true
+    stsSeconds: 63072000
+    # stsIncludeSubdomains: false
+    # stsPreload: false
+    forceSTSHeader: true
+    contentTypeNosniff: true
+    browserXssFilter: true
+    sslForceHost: true
+    referrerPolicy: same-origin
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+    customResponseHeaders:
+      X-Robots-Tag: 'none'
+      server: ''