Narrow trusted proxy CIDRs and pin Traefik subnet

2026-04-13 10:16:06 +10:00
parent 417973b1cb
commit 8448f2bb94
3 changed files with 20 additions and 3 deletions
@@ -23,7 +23,16 @@ entryPoints:
  web:
    address: ":80"
    forwardedHeaders:
-      insecure: true
+      # Trust forwarding headers only from upstream proxies/LBs under our control.
+      # Network assumptions for this stack:
+      # - 127.0.0.1/32: local host-side reverse-proxy hops
+      # - 192.168.2.0/24: LAN edge proxies
+      # - 172.21.0.0/16: pinned Docker subnet for the traefik bridge network
+      insecure: false
+      trustedIPs:
+        - "127.0.0.1/32"
+        - "192.168.2.0/24"
+        - "172.21.0.0/16"
    http:
      redirections:
        entryPoint:
@@ -33,7 +42,11 @@ entryPoints:
  websecure:
    address: ":443"
    forwardedHeaders:
-      insecure: true
+      insecure: false
+      trustedIPs:
+        - "127.0.0.1/32"
+        - "192.168.2.0/24"
+        - "172.21.0.0/16"
    http:
      middlewares:
        - default-chain@file