From eaa27462a1e1067af2b907159f9f5223efbbd9fd Mon Sep 17 00:00:00 2001
From: git <git@nix-config>
Date: Tue, 14 Apr 2026 11:35:05 +1000
Subject: [PATCH] 	modified:   docker-compose.yml 	modified:  
 traefik/dynamic.yml 	modified:   traefik/traefik.yml

---
 docker-compose.yml  | 10 +++++++++-
 traefik/dynamic.yml |  9 +++++++++
 traefik/traefik.yml | 17 +++++++++++++++++
 3 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index 054b785..8c1d8f8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -19,6 +19,10 @@ services:
       - ${PROJECT_ROOT}/traefik/letsencrypt:/letsencrypt
       - ${PROJECT_ROOT}/traefik/traefik.yml:/etc/traefik/traefik.yml:ro
       - ${PROJECT_ROOT}/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
+      - ${PROJECT_ROOT}/traefik/certs:/etc/traefik/certs:ro
+    healthcheck:
+      test: traefik healthcheck --ping
+
     networks:
       - proxy
 
@@ -45,7 +49,7 @@ services:
       - traefik.http.routers.kuma.entrypoints=websecure
       - traefik.http.routers.kuma.tls=true
       - traefik.http.routers.kuma.tls.certresolver=le
-
+      - traefik.http.routers.kuma.tls.options=mtls-private-admin@file
       # Service -> container port
       - traefik.http.services.kuma.loadbalancer.server.port=3001
 #      - traefik.http.routers.kuma.middlewares=default-chain@file
@@ -177,3 +181,7 @@ services:
 networks:
   proxy:
     name: proxy
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.21.0.0/16
diff --git a/traefik/dynamic.yml b/traefik/dynamic.yml
index 626f759..965a433 100644
--- a/traefik/dynamic.yml
+++ b/traefik/dynamic.yml
@@ -25,3 +25,12 @@ http:
         middlewares:
           - secHeaders
           - crowdsec
+tls:
+  options:
+    mtls-private-admin:
+      minVersion: VersionTLS12
+      sniStrict: true
+      clientAuth:
+        caFiles:
+          - /etc/traefik/certs/ca/clients-ca.crt
+        clientAuthType: RequireAndVerifyClientCert
diff --git a/traefik/traefik.yml b/traefik/traefik.yml
index c978c39..5e0bfed 100644
--- a/traefik/traefik.yml
+++ b/traefik/traefik.yml
@@ -13,6 +13,17 @@ accessLog:
 entryPoints:
   web:
     address: ":80"
+    forwardedHeaders:
+      # Trust forwarding headers only from upstream proxies/LBs under our control.
+      # Network assumptions for this stack:
+      # - 127.0.0.1/32: local host-side reverse-proxy hops
+      # - 192.168.2.0/24: LAN edge proxies
+      # - 172.21.0.0/16: pinned Docker subnet for the traefik bridge network
+      insecure: false
+      trustedIPs:
+        - "127.0.0.1/32"
+        - "192.168.0.0/24"
+        - "172.21.0.0/16"
     http:
       redirections:
         entryPoint:
@@ -21,6 +32,12 @@ entryPoints:
 
   websecure:
     address: ":443"
+    forwardedHeaders:
+      insecure: false
+      trustedIPs:
+        - "127.0.0.1/32"
+        - "192.168.0.0/24"
+        - "172.21.0.0/16"
     http:
       middlewares:
         - default-chain@file