From 6386ada453edbbaf0b93445231b909490f8cfa9c Mon Sep 17 00:00:00 2001 From: bcmmbaga Date: Wed, 5 Aug 2026 14:36:07 +0300 Subject: [PATCH] Declare the security-headers middleware on Traefik --- .../getting-started-enterprise.sh | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/infrastructure_files/getting-started-enterprise.sh b/infrastructure_files/getting-started-enterprise.sh index 5a2143ff9..966a508b9 100755 --- a/infrastructure_files/getting-started-enterprise.sh +++ b/infrastructure_files/getting-started-enterprise.sh @@ -449,6 +449,19 @@ render_compose_common() { volumes: - /var/run/docker.sock:/var/run/docker.sock:ro - netbird_traefik_letsencrypt:/letsencrypt + labels: + - traefik.enable=true + # Shared security headers, referenced by every NetBird router below. A + # label-declared middleware only exists while its container runs, so this + # lives on Traefik itself: declaring it on an app container would drop + # every router referencing it whenever that container restarts. + - traefik.http.middlewares.nb-security.headers.stsSeconds=3600 + - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true + - traefik.http.middlewares.nb-security.headers.stsPreload=true + - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true + - traefik.http.middlewares.nb-security.headers.browserXssFilter=true + - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin + - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN dashboard: <<: *default @@ -457,14 +470,6 @@ render_compose_common() { networks: [netbird] labels: - traefik.enable=true - # Shared security headers, referenced by every NetBird router below - - traefik.http.middlewares.nb-security.headers.stsSeconds=3600 - - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true - - traefik.http.middlewares.nb-security.headers.stsPreload=true - - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true - - traefik.http.middlewares.nb-security.headers.browserXssFilter=true - - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin - - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN # Dashboard catch-all: lowest priority so every route below wins - traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN}`) - traefik.http.routers.netbird-dashboard.entrypoints=websecure