From 00de6a9b9521c0b8f7235d7733b23364e4c7a0b7 Mon Sep 17 00:00:00 2001
From: kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
Date: Mon, 31 Jan 2022 21:36:00 +0100
Subject: [PATCH] fix(traefik): introduce two basic changes with different CORS
 policy

---
 charts/core/traefik/Chart.yaml                |  2 +-
 .../{tc-synapse.yaml => tc-chains.yaml}       | 28 ++++----
 .../templates/middlewares/tc-headers.yaml     | 64 +++++++++++++++++++
 3 files changed, 79 insertions(+), 15 deletions(-)
 rename charts/core/traefik/templates/middlewares/{tc-synapse.yaml => tc-chains.yaml} (73%)
 create mode 100644 charts/core/traefik/templates/middlewares/tc-headers.yaml

diff --git a/charts/core/traefik/Chart.yaml b/charts/core/traefik/Chart.yaml
index 5d4ede201de..c7a30df70d6 100644
--- a/charts/core/traefik/Chart.yaml
+++ b/charts/core/traefik/Chart.yaml
@@ -22,7 +22,7 @@ sources:
 - https://github.com/traefik/traefik-helm-chart
 - https://traefik.io/
 type: application
-version: 10.0.48
+version: 10.0.49
 annotations:
   truecharts.org/catagories: |
     - network
diff --git a/charts/core/traefik/templates/middlewares/tc-synapse.yaml b/charts/core/traefik/templates/middlewares/tc-chains.yaml
similarity index 73%
rename from charts/core/traefik/templates/middlewares/tc-synapse.yaml
rename to charts/core/traefik/templates/middlewares/tc-chains.yaml
index 259df10d0a4..409766daa89 100644
--- a/charts/core/traefik/templates/middlewares/tc-synapse.yaml
+++ b/charts/core/traefik/templates/middlewares/tc-chains.yaml
@@ -7,23 +7,23 @@
 apiVersion: traefik.containo.us/v1alpha1
 kind: Middleware
 metadata:
-  name: tc-synapse-headers
-  namespace: {{ $namespace }}
-spec:
-  headers:
-    accessControlAllowOriginList:
-      - "*"
-
----
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: tc-synapse-chain
+  name: tc-opencors-chain
   namespace: {{ $namespace }}
 spec:
   chain:
     middlewares:
     - name: basic-ratelimit
-    - name: basic-secure-headers
-    - name: tc-synapse-headers
+    - name: tc-opencors-headers
+    - name: compress
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-closedcors-chain
+  namespace: {{ $namespace }}
+spec:
+  chain:
+    middlewares:
+    - name: basic-ratelimit
+    - name: tc-closedcors-headers
     - name: compress
diff --git a/charts/core/traefik/templates/middlewares/tc-headers.yaml b/charts/core/traefik/templates/middlewares/tc-headers.yaml
new file mode 100644
index 00000000000..330fbe4467a
--- /dev/null
+++ b/charts/core/traefik/templates/middlewares/tc-headers.yaml
@@ -0,0 +1,64 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-opencors-headers
+  namespace: {{ $namespace }}
+spec:
+  headers:
+    accessControlAllowHeaders:
+    - '*'
+    accessControlAllowMethods:
+    - GET
+    - OPTIONS
+    - HEAD
+    - PUT
+    - POST
+    accessControlAllowOriginList:
+    - '*'
+    accessControlMaxAge: 100
+    browserXssFilter: true
+    contentTypeNosniff: true
+    customRequestHeaders:
+      X-Forwarded-Proto: https
+    customResponseHeaders:
+      X-Robots-Tag: none
+      server: ""
+    forceSTSHeader: true
+    referrerPolicy: same-origin
+    sslForceHost: true
+    sslRedirect: true
+    stsSeconds: 63072000
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-closedcors-headers
+  namespace: {{ $namespace }}
+spec:
+  headers:
+    accessControlAllowMethods:
+      - GET
+      - OPTIONS
+      - HEAD
+      - PUT
+    accessControlMaxAge: 100
+    sslRedirect: true
+    stsSeconds: 63072000
+    # stsIncludeSubdomains: false
+    # stsPreload: false
+    forceSTSHeader: true
+    contentTypeNosniff: true
+    browserXssFilter: true
+    sslForceHost: true
+    referrerPolicy: same-origin
+    customRequestHeaders:
+      X-Forwarded-Proto: "https"
+    customResponseHeaders:
+      X-Robots-Tag: 'none'
+      server: ''