Post-Tyranny-Tech-Infrastru.../ansible/roles/traefik/templates/dynamic.yml.j2

# Traefik dynamic configuration
# Managed by Ansible - Client-specific routes come from Docker labels

http:
  middlewares:
    # Security headers
    security-headers:
      headers:
        browserXssFilter: true
        contentTypeNosniff: true
        forceSTSHeader: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
        customFrameOptionsValue: "SAMEORIGIN"

    # Rate limiting
    rate-limit:
      rateLimit:
        average: 100
        burst: 200
Complete Ansible base configuration (#2) Completed Issue #2: Ansible Base Configuration All objectives met: - ✅ Hetzner Cloud dynamic inventory (hcloud plugin) - ✅ Common role (SSH hardening, UFW firewall, fail2ban, auto-updates) - ✅ Docker role (Docker Engine + Compose + networks) - ✅ Traefik role (reverse proxy with Let's Encrypt SSL) - ✅ Setup playbook (orchestrates all base roles) - ✅ Successfully tested on live test server (91.99.210.204) Additional improvements: - Fixed ansible.cfg for Ansible 2.20+ compatibility - Updated ADR dates to 2025 - All roles follow Infrastructure Agent patterns Test Results: - SSH hardening applied (key-only auth) - UFW firewall active (ports 22, 80, 443) - Fail2ban protecting SSH - Automatic security updates enabled - Docker running with traefik network - Traefik deployed and ready for SSL Files added: - ansible/playbooks/setup.yml - ansible/roles/docker/* (complete) - ansible/roles/traefik/* (complete) Closes #2 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> 2025-12-27 14:13:15 +01:00			`# Traefik dynamic configuration`
refactor: Remove Zitadel references and clean up templates Complete the migration from Zitadel to Authentik by removing all remaining Zitadel references in Ansible templates and defaults. Changes: - Update Nextcloud defaults to reference authentik_domain instead of zitadel_domain - Add clarifying comments about dynamic OIDC credential provisioning - Clean up Traefik dynamic config template - remove obsolete static routes - Remove hardcoded test.vrije.cloud routes (routes now come from Docker labels) - Remove unused Zitadel service definitions and middleware configs Impact: - Nextcloud version now defaults to "latest" (from hardcoded "30") - Traefik template simplified to only define shared middlewares - All service routing handled via Docker Compose labels (already working) - No impact on existing deployments (these defaults were unused) Related to: Post-workshop cleanup following commit b6c9fa6 🤖 Generated with Claude Code (https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> 2026-01-23 20:40:34 +01:00			`# Managed by Ansible - Client-specific routes come from Docker labels`
Complete Ansible base configuration (#2) Completed Issue #2: Ansible Base Configuration All objectives met: - ✅ Hetzner Cloud dynamic inventory (hcloud plugin) - ✅ Common role (SSH hardening, UFW firewall, fail2ban, auto-updates) - ✅ Docker role (Docker Engine + Compose + networks) - ✅ Traefik role (reverse proxy with Let's Encrypt SSL) - ✅ Setup playbook (orchestrates all base roles) - ✅ Successfully tested on live test server (91.99.210.204) Additional improvements: - Fixed ansible.cfg for Ansible 2.20+ compatibility - Updated ADR dates to 2025 - All roles follow Infrastructure Agent patterns Test Results: - SSH hardening applied (key-only auth) - UFW firewall active (ports 22, 80, 443) - Fail2ban protecting SSH - Automatic security updates enabled - Docker running with traefik network - Traefik deployed and ready for SSL Files added: - ansible/playbooks/setup.yml - ansible/roles/docker/* (complete) - ansible/roles/traefik/* (complete) Closes #2 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> 2025-12-27 14:13:15 +01:00
			`http:`
			`middlewares:`
			`# Security headers`
			`security-headers:`
			`headers:`
			`browserXssFilter: true`
			`contentTypeNosniff: true`
			`forceSTSHeader: true`
			`stsIncludeSubdomains: true`
			`stsPreload: true`
			`stsSeconds: 31536000`
			`customFrameOptionsValue: "SAMEORIGIN"`

			`# Rate limiting`
			`rate-limit:`
			`rateLimit:`
			`average: 100`
			`burst: 200`