Add security headers

apps/searxng/app/route.yaml

@@ -9,6 +9,9 @@ spec:
   routes:
   - match: Host(`search.trivernis.dev`) || Host(`search.trivernis.net`)
     kind: Rule
+    middlewares:
+      - name: strict-security-headers
+        namespace: default
     services:
     - name: searxng-srv
       port: 8080

apps/tandoor/app/route.yaml

@@ -1,4 +1,17 @@
 apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: security-headers
+  namespace: default
+spec:
+  headers:
+    stsSeconds: 15768000
+    contentTypeNosniff: true
+    browserXssFilter: true
+    referrerPolicy: same-origin
+    customFrameOptionsValue: SAMEORIGIN
+---
+apiVersion: traefik.containo.us/v1alpha1
 kind: IngressRoute
 metadata:
   name: recipes-route
@@ -9,11 +22,17 @@ spec:
   routes:
   - match: (Host(`recipes.trivernis.dev`) || Host(`recipes.trivernis.net`)) && (Path(`/media`) || Path(`/static`))
     kind: Rule
+    middlewares:
+      - name: security-headers
+        namespace: default
     services:
     - name: tandoor
       port: 80
   - match: Host(`recipes.trivernis.dev`) || Host(`recipes.trivernis.net`)
     kind: Rule
+    middlewares:
+      - name: security-headers
+        namespace: default
     services:
     - name: tandoor
       port: 8080

apps/traefik/app.yaml

@@ -5,3 +5,5 @@ metadata:
   name: traefik
 resources:
   - app/traefik-config.yaml
+  - app/security-headers.yaml
+  - app/strict-security-headers.yaml

apps/traefik/app/security-headers.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: security-headers
+  namespace: default
+spec:
+  headers:
+    stsSeconds: 15768000
+    contentTypeNosniff: true
+    browserXssFilter: true
+    referrerPolicy: same-origin
+    customFrameOptionsValue: SAMEORIGIN
+
+    customResponseHeaders:
+      X-Robots-Tag: noindex,nofollow
+      X-Download-Options: noopen
+      X-Powered-By: coffee X-Powered-By

apps/traefik/app/strict-security-headers.yaml

@@ -0,0 +1,18 @@
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: strict-security-headers
+  namespace: default
+spec:
+  headers:
+    stsSeconds: 15768000
+    contentTypeNosniff: true
+    browserXssFilter: true
+    referrerPolicy: no-referrer
+    frameDeny: true
+
+    customResponseHeaders:
+      X-Robots-Tag: noindex,nofollow
+      X-Download-Options: noopen
+      X-Permitted-Cross-Domain-Policies: none
+      X-Powered-By: coffee X-Powered-By