test

modules/nixos/services/traefik/default.nix

@@ -70,7 +70,7 @@ let
   jellyseerrUrl = "http://10.0.1.3:${toString config.services.jellyseerr.port}";
   lubeloggerUrl = "http://${serverIp}:6754";
   # onlyofficeUrl = "http://${config.containers.nextcloud.localAddress}:${toString config.containers.nextcloud.config.services.onlyoffice.port}";
-  onlyofficeUrl = "http://10.0.1.3:9943";
+  onlyofficeUrl = "http://10.0.1.3:9980";
   openWebUIUrl = "http://${serverIp}:8888";
   paperlessUrl = "http://${config.containers.paperless.localAddress}:${toString config.containers.paperless.config.services.paperless.port}";
 
@@ -294,11 +294,6 @@ in
                 ];
               };
             };
-            onlyoffice-websocket = {
-              headers.customrequestheaders = {
-                X-Forwarded-Proto = "https";
-              };
-            };
             crowdsec = {
               plugin = {
                 bouncer = {
@@ -344,6 +339,43 @@ in
                 ];
               };
             };
+            collabora-headers = {
+              headers = {
+                customRequestHeaders = {
+                  Upgrade = "websocket";
+                  Connection = "Upgrade";
+                  X-Forwarded-Proto = "https";
+                  X-Forwarded-Host = "office.mjallen.dev";
+                };
+                customResponseHeaders = {
+                  X-Frame-Options = "";
+                  Content-Security-Policy = "frame-ancestors https://cloud.mjallen.dev";
+                };
+                referrerPolicy = "no-referrer";
+                stsSeconds = "15552000";
+                stsPreload = "true";
+                stsIncludeSubdomains = "true";
+                forceSTSHeader = "true";
+                browserXssFilter = "true";
+              };
+            };
+            onlyoffice-headers = {
+              headers = {
+                customResponseHeaders = {
+                  X-Robots-Tag = "none";
+                  Strict-Transport-Security = "max-age=63072000";
+                  X-Forwarded-Proto = "https";
+                };
+                browserXssFilter = "true";
+                contentTypeNosniff = "true";
+                stsIncludeSubdomains = "true";
+                stsPreload = "true";
+                stsSeconds = "31536000";
+                forceSTSHeader = "true";
+                accessControlMaxAge = "15552000";
+                accesscontrolalloworiginlist = "*";
+              };
+            };
           };
 
           services = {
@@ -571,7 +603,8 @@ in
               middlewares = [
                 "crowdsec"
                 "whitelist-geoblock"
-                "onlyoffice-websocket"
+                # "onlyoffice-headers"
+                "collabora-headers"
               ];
               tls.certResolver = "letsencrypt";
             };