feat: Add IPWhitelist, redirectRegex and (internal) nextcloud middlewares (#929)

* feat: Add IPWhitelist and redirectRegex middlewares to traefik

* fix: add nextcloud middlewares

* fix nextcloud cronjob

charts/stable/nextcloud/templates/_cronjob.tpl

@@ -1,6 +1,6 @@
 {{/* Define the cronjob */}}
 {{- define "nextcloud.cronjob" -}}
-{{- $jobName := include "common.names.fullname" . -}}
+{{- $jobName := include "common.names.fullname" . }}
 
 ---
 apiVersion: batch/v1beta1

charts/stable/nextcloud/templates/common.yaml

@@ -1,14 +1,17 @@
 {{/* Make sure all variables are set properly */}}
 {{- include "common.values.setup" . }}
 
-{{/* Render the templates */}}
-{{ include "common.all" . }}
-
 {{/* Render configmap for nextcloud */}}
 {{- include "nextcloud.configmap" . }}
 
 {{/* Render secrets for nextcloud */}}
 {{- include "nextcloud.secrets" . }}
 
+{{- $newMiddlewares :=  append .Values.ingress.main.fixedMiddlewares "tc-nextcloud-chain" }}
+{{- $_ := set .Values.ingress.main "fixedMiddlewares" $newMiddlewares -}}
+
 {{/* Render cronjob for nextcloud */}}
 {{- include "nextcloud.cronjob" . }}
+
+{{/* Render the templates */}}
+{{ include "common.all" . }}

charts/stable/traefik/Chart.yaml

@@ -22,4 +22,4 @@ sources:
 - https://github.com/traefik/traefik-helm-chart
 - https://traefik.io/
 type: application
-version: 7.0.11
+version: 7.1.0

charts/stable/traefik/SCALE/questions.yaml

@@ -563,6 +563,93 @@ questions:
                         type: int
                         required: true
                         default: 200
+        - variable: redirectRegex
+          label: "redirectRegex"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: redirectRegexEntry
+                label: ""
+                schema:
+                  type: dict
+                  attrs:
+                    - variable: name
+                      label: "Name"
+                      schema:
+                        type: string
+                        required: true
+                    - variable: regex
+                      label: "Regex"
+                      schema:
+                        type: string
+                        required: true
+                        default: ""
+                    - variable: replacement
+                      label: "Replacement"
+                      schema:
+                        type: string
+                        required: true
+                        default: ""
+                    - variable: permanent
+                      label: "Permanent"
+                      schema:
+                        type: boolean
+                        required: true
+                        default: false
+
+        - variable: ipWhiteList
+          label: "ipWhiteList"
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: ipWhiteListEntry
+                label: ""
+                schema:
+                  type: dict
+                  attrs:
+                    - variable: name
+                      label: "Name"
+                      schema:
+                        type: string
+                        required: true
+                        default: ""
+                    - variable: sourceRange
+                      label: "Source Range"
+                      schema:
+                        type: list
+                        default: []
+                        items:
+                          - variable: sourceRangeEntry
+                            label: ""
+                            schema:
+                              type: string
+                              required: true
+                              default: ""
+                    - variable: ipStrategy
+                      label: "IP Strategy"
+                      schema:
+                        type: dict
+                        attrs:
+                          - variable: depth
+                            label: "Depth"
+                            schema:
+                              type: int
+                              required: true
+                          - variable: excludedIPs
+                            label: "Excluded IPs"
+                            schema:
+                              type: list
+                              default: []
+                              items:
+                                - variable: excludedIPsEntry
+                                  label: ""
+                                  schema:
+                                    type: string
+                                    required: true
+                                    default: ""
+
 
   - variable: hostNetwork
     group: "Networking and Services"

charts/stable/traefik/templates/middlewares/ipwhitelist.yaml

@@ -0,0 +1,33 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{ range $index, $middlewareData := .Values.middlewares.ipWhiteList }}
+
+---
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  ipWhiteList:
+    sourceRange:
+      {{- range $middlewareData.sourceRange }}
+      - {{ . }}
+      {{- end }}
+  {{- if $middlewareData.ipStrategy }}
+  ipStrategy:
+    {{- if $middlewareData.ipStrategy.depth }}
+    depth: {{ $middlewareData.ipStrategy.depth }}
+    {{- end }}
+    {{- if $middlewareData.ipStrategy.excludedIPs }}
+    excludedIPs:
+      {{- range $middlewareData.ipStrategy.excludedIPs }}
+      - {{ . }}
+      {{- end }}
+    {{- end }}
+  {{- end }}
+{{ end }}

charts/stable/traefik/templates/middlewares/redirectregex.yaml

@@ -0,0 +1,20 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{ range $index, $middlewareData := .Values.middlewares.redirectRegex }}
+
+---
+# Declaring the user list
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  redirectRegex:
+    regex: {{ $middlewareData.regex | quote }}
+    replacement: {{ $middlewareData.replacement | quote }}
+    permanent: {{ $middlewareData.replacement }}
+{{ end }}

charts/stable/traefik/templates/middlewares/tc-nextcloud.yaml

@@ -0,0 +1,65 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-nextcloud-headers
+  namespace: {{ $namespace }}
+spec:
+  headers:
+    stsSeconds: 63072000
+    forceSTSHeader: true
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-nextcloud-redirectregex-dav
+spec:
+  redirectRegex:
+    regex: "https://(.*)/.well-known/(card|cal)dav"
+    replacement: "https://${1}/remote.php/dav/"
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-nextcloud-redirectregex-finger
+spec:
+  redirectRegex:
+    regex: "https://(.*)/.well-known/webfinger"
+    replacement: "https://${1}/public.php?service=webfinger"
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-nextcloud-redirectregex-hostmeta
+spec:
+  redirectRegex:
+    regex: "https://(.*)/.well-known/host-meta"
+    replacement: "https://${1}/public.php?service=host-meta"
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-nextcloud-redirectregex-hostmetajson
+spec:
+  redirectRegex:
+    regex: "https://(.*)/.well-known/host-meta.json"
+    replacement: "https://${1}/public.php?service=host-meta-json"
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: tc-nextcloud-chain
+  namespace: {{ $namespace }}
+spec:
+  chain:
+    middlewares:
+    - name: tc-nextcloud-headers
+    - name: tc-nextcloud-redirectregex-dav
+    - name: tc-nextcloud-redirectregex-finger
+    - name: tc-nextcloud-redirectregex-hostmetajson
+    - name: tc-nextcloud-redirectregex-hostmeta

charts/stable/traefik/values.yaml

@@ -306,15 +306,28 @@ middlewares:
   #   authResponseHeadersRegex: "^X-"
   #   trustForwardHeader: true
   chain: []
-  # name: chainname
+  # - name: chainname
   #   middlewares:
   #    - name: compress
   redirectScheme: []
+  # - name: redirectSchemeName
   #   scheme: https
   #   permanent: true
   rateLimit: []
+  # - name: rateLimitName
   #   average: 300
   #   burst: 200
+  redirectRegex: []
+  # - name: redirectRegexName
+  #   regex: putregexhere
+  #   replacement: replacementurlhere
+  #   permanent: false
+  ipWhiteList: []
+  # - name: ipWhiteListName
+  #   sourceRange: []
+  #   ipStrategy:
+  #     depth: 2
+  #     excludedIPs: []
 
 portalhook:
   enabled: true