add: collabora to netcloud

tools/wireguard/traefik/dynamic.yml

@@ -19,6 +19,13 @@ http:
                 customRequestHeaders:
                     X-Forwarded-Proto: "https"
 
+        # Nextcloud headers to prevent man in the middle attacks
+        hsts:
+            headers:
+                stsSeconds: 15552000
+                stsIncludeSubdomains: true
+                stsPreload: true
+
     serversTransports:
         # Use this for backend containers that use self-signed TLS certs
         # (e.g. Nextcloud). Reference it in a service with:
@@ -31,7 +38,7 @@ http:
     routers:
         # Basic service
         my-service:
-            rule: "Host(`service.example.com`)"  # <-- change domain
+            rule: "Host(`service.example.com`)" # <-- change domain
             entryPoints:
                 - websecure
             service: my-service
@@ -40,18 +47,19 @@ http:
 
         # Service that needs X-Forwarded-Proto (e.g. Mastodon, Synapse)
         my-service-with-headers:
-            rule: "Host(`other.example.com`)"  # <-- change domain
+            rule: "Host(`other.example.com`)" # <-- change domain
             entryPoints:
                 - websecure
             service: my-service-with-headers
             middlewares:
                 - https-headers
+                - hsts
             tls:
                 certResolver: letsencrypt
 
         # Service with a self-signed cert on the backend (e.g. Nextcloud)
         my-https-backend:
-            rule: "Host(`secure.example.com`)"  # <-- change domain
+            rule: "Host(`secure.example.com`)" # <-- change domain
             entryPoints:
                 - websecure
             service: my-https-backend
@@ -62,18 +70,19 @@ http:
         my-service:
             loadBalancer:
                 servers:
-                    - url: "http://container-name:PORT"  # <-- change container name and port
+                    - url: "http://container-name:PORT" # <-- change container name and port
 
         my-service-with-headers:
             loadBalancer:
                 servers:
-                    - url: "http://container-name:PORT"  # <-- change container name and port
+                    - url: "http://container-name:PORT" # <-- change container name and port
 
         my-https-backend:
             loadBalancer:
                 servers:
-                    - url: "https://container-name:PORT"  # <-- change container name and port
+                    - url: "https://container-name:PORT" # <-- change container name and port
                 serversTransport: insecure-transport
+
     # -------------------------------------------------------------------------
 
 # =============================================================================
@@ -86,12 +95,12 @@ tcp:
         my-tcp-service:
             rule: "HostSNI(`*`)"
             entryPoints:
-                - my-tcp-entrypoint  # <-- must match an entrypoint defined in traefik.yml
+                - my-tcp-entrypoint # <-- must match an entrypoint defined in traefik.yml
             service: my-tcp-service
 
     services:
         my-tcp-service:
             loadBalancer:
                 servers:
-                    - address: "container-name:PORT"  # <-- change container name and port
+                    - address: "container-name:PORT" # <-- change container name and port
     # -------------------------------------------------------------------------