ginskill-init 2.7.0

package/skills/traefik/docs/security.md

@@ -0,0 +1,391 @@
+# Traefik Security Hardening
+
+## Security Headers (apply globally)
+
+```yaml
+http:
+  middlewares:
+    security-headers:
+      headers:
+        # XSS Protection
+        browserXssFilter: true
+        # Prevent MIME sniffing
+        contentTypeNosniff: true
+        # Clickjacking protection
+        frameDeny: true
+        customFrameOptionsValue: "SAMEORIGIN"
+        # HSTS
+        stsSeconds: 31536000
+        stsIncludeSubdomains: true
+        stsPreload: true
+        forceSTSHeader: true
+        # CSP
+        contentSecurityPolicy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
+        # Referrer
+        referrerPolicy: "strict-origin-when-cross-origin"
+        # Permissions
+        permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()"
+        # Remove server info
+        customResponseHeaders:
+          server: ""
+          X-Powered-By: ""
+```
+
+## TLS Hardening
+
+```yaml
+tls:
+  options:
+    default:
+      minVersion: VersionTLS12
+      sniStrict: true
+      cipherSuites:
+        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+```
+
+For maximum security (TLS 1.3 only):
+```yaml
+    strict:
+      minVersion: VersionTLS13
+      sniStrict: true
+```
+
+## Rate Limiting
+
+```yaml
+http:
+  middlewares:
+    global-rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+        period: 1s
+        sourceCriterion:
+          ipStrategy:
+            depth: 1  # Correct depth for your proxy chain
+
+    api-rate-limit:
+      rateLimit:
+        average: 20
+        burst: 10
+        period: 1s
+
+    login-rate-limit:
+      rateLimit:
+        average: 5
+        burst: 3
+        period: 1m
+```
+
+## IP Allowlisting
+
+```yaml
+http:
+  middlewares:
+    internal-only:
+      ipAllowList:
+        sourceRange:
+          - "10.0.0.0/8"
+          - "172.16.0.0/12"
+          - "192.168.0.0/16"
+        ipStrategy:
+          depth: 1
+```
+
+## Docker Socket Security
+
+**Never** mount Docker socket directly in production. Use a socket proxy:
+
+```yaml
+services:
+  socket-proxy:
+    image: tecnativa/docker-socket-proxy
+    environment:
+      CONTAINERS: 1
+      SERVICES: 0
+      TASKS: 0
+      NETWORKS: 0
+      NODES: 0
+      IMAGES: 0
+      VOLUMES: 0
+      BUILD: 0
+      COMMIT: 0
+      CONFIGS: 0
+      DISTRIBUTION: 0
+      EXEC: 0
+      GRPC: 0
+      INFO: 0
+      PLUGINS: 0
+      POST: 0
+      SECRETS: 0
+      SESSION: 0
+      SWARM: 0
+      SYSTEM: 0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - socket-proxy
+    restart: unless-stopped
+
+networks:
+  socket-proxy:
+    internal: true
+```
+
+## Dashboard Security
+
+```yaml
+# NEVER use api.insecure: true in production
+
+# Secure dashboard with ForwardAuth
+labels:
+  - "traefik.http.routers.dashboard.rule=Host(`traefik.internal.example.com`)"
+  - "traefik.http.routers.dashboard.service=api@internal"
+  - "traefik.http.routers.dashboard.middlewares=dashboard-auth,internal-only"
+  - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
+```
+
+## Forwarded Headers Security
+
+```yaml
+entryPoints:
+  websecure:
+    address: ":443"
+    forwardedHeaders:
+      trustedIPs:
+        - "127.0.0.1/32"
+        - "10.0.0.0/8"
+        # Add your load balancer / CDN IPs
+        # Cloudflare IPs:
+        - "173.245.48.0/20"
+        - "103.21.244.0/22"
+        - "103.22.200.0/22"
+        - "103.31.4.0/22"
+        - "141.101.64.0/18"
+        - "108.162.192.0/18"
+        - "190.93.240.0/20"
+        - "188.114.96.0/20"
+        - "197.234.240.0/22"
+        - "198.41.128.0/17"
+        - "162.158.0.0/15"
+        - "104.16.0.0/13"
+        - "104.24.0.0/14"
+        - "172.64.0.0/13"
+        - "131.0.72.0/22"
+    proxyProtocol:
+      trustedIPs:
+        - "10.0.0.0/8"  # Only trust your LB
+```
+
+**NEVER** trust `0.0.0.0/0` for proxy protocol or forwarded headers.
+
+## Container Security
+
+```yaml
+services:
+  traefik:
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - NET_BIND_SERVICE
+    read_only: true
+    tmpfs:
+      - /tmp
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 512M
+        reservations:
+          cpus: "0.1"
+          memory: 128M
+```
+
+## Known CVEs to Watch
+
+- **CVE-2026-29054**: Case-sensitive bypass for X-Forwarded header removal (fixed v3.6.9)
+- **CVE-2025-66491**: `Verify=On` actually disabled TLS verification (fixed v3.6.3)
+- Always run latest patch version
+
+## CORS Configuration
+
+```yaml
+http:
+  middlewares:
+    cors:
+      headers:
+        accessControlAllowMethods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
+        accessControlAllowHeaders: ["Content-Type", "Authorization"]
+        accessControlAllowOriginList:
+          - "https://app.example.com"
+          - "https://admin.example.com"
+        accessControlMaxAge: 86400
+        accessControlAllowCredentials: true
+        addVaryHeader: true
+```
+
+## Request Size Limits (Buffering)
+
+```yaml
+http:
+  middlewares:
+    request-limit:
+      buffering:
+        maxRequestBodyBytes: 10485760    # 10MB
+        maxResponseBodyBytes: 10485760
+        memRequestBodyBytes: 2097152     # 2MB in memory
+        memResponseBodyBytes: 2097152
+```
+
+## WAF Integration (Traefik Hub + Coraza)
+
+Traefik Hub integrates Coraza WAF with OWASP Core Rule Set:
+```yaml
+# Traefik Hub WAF middleware
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: waf
+spec:
+  plugin:
+    coraza:
+      directives:
+        - "SecRuleEngine On"
+        - "Include @owasp_crs/*.conf"
+        - "SecRule REQUEST_URI \"@rx /etc/passwd\" \"id:1,phase:1,deny,status:403\""
+```
+
+For open-source Traefik, use the community Coraza plugin or place ModSecurity/Coraza as a sidecar.
+
+## Secrets Management
+
+```yaml
+# Docker secrets (preferred over env vars)
+services:
+  traefik:
+    secrets:
+      - cf_api_token
+      - dashboard_password
+    environment:
+      - CF_DNS_API_TOKEN_FILE=/run/secrets/cf_api_token
+
+secrets:
+  cf_api_token:
+    file: ./secrets/cf_api_token.txt     # Docker Compose
+    # external: true                      # Docker Swarm
+  dashboard_password:
+    file: ./secrets/dashboard_password.txt
+```
+
+Kubernetes:
+```yaml
+# Use External Secrets Operator for Vault/AWS SM integration
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: traefik-certs
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: traefik-tls-secret
+  data:
+    - secretKey: tls.crt
+      remoteRef:
+        key: secret/traefik/tls
+        property: cert
+    - secretKey: tls.key
+      remoteRef:
+        key: secret/traefik/tls
+        property: key
+```
+
+## Network Segmentation
+
+```yaml
+# Docker: isolate proxy network from internal networks
+networks:
+  proxy:
+    external: true        # Public-facing services
+  backend:
+    internal: true        # Backend services only
+  socket-proxy:
+    internal: true        # Docker socket proxy only
+  monitoring:
+    internal: true        # Prometheus, Grafana, Loki
+```
+
+Kubernetes:
+```yaml
+# NetworkPolicy: restrict Traefik egress to app namespaces only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: traefik-egress
+  namespace: traefik
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: traefik
+  policyTypes: [Egress]
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              traefik-access: "true"
+      ports:
+        - protocol: TCP
+          port: 80
+        - protocol: TCP
+          port: 8080
+    - to:  # Allow DNS
+        - namespaceSelector: {}
+      ports:
+        - protocol: UDP
+          port: 53
+```
+
+## InFlightReq (Connection Limiting)
+
+```yaml
+http:
+  middlewares:
+    inflight-limit:
+      inFlightReq:
+        amount: 100  # Max concurrent requests
+        sourceCriterion:
+          ipStrategy:
+            depth: 1
+```
+
+## Security Checklist
+
+- [ ] `api.insecure: false`
+- [ ] `exposedByDefault: false`
+- [ ] Docker socket proxy or read-only mount
+- [ ] `forwardedHeaders.trustedIPs` configured
+- [ ] `proxyProtocol.trustedIPs` configured (if behind LB)
+- [ ] Security headers middleware applied globally
+- [ ] Rate limiting on all public routers
+- [ ] TLS min version 1.2+
+- [ ] `sniStrict: true`
+- [ ] Dashboard behind authentication
+- [ ] ACME storage persisted and backed up
+- [ ] Access logs enabled with filtering
+- [ ] Container runs with minimal privileges
+- [ ] Latest Traefik version with security patches
+- [ ] CORS configured (not wildcard `*` with credentials)
+- [ ] Request body size limits set
+- [ ] Network segmentation (internal networks)
+- [ ] Secrets in Docker secrets / K8s secrets (not env vars)
+- [ ] InFlightReq limits on critical endpoints
+- [ ] WAF enabled for public-facing services

package/skills/traefik/docs/tls-acme.md

@@ -0,0 +1,155 @@
+# TLS, ACME & Let's Encrypt
+
+## ACME Certificate Resolvers
+
+### HTTP-01 Challenge (simplest, no wildcard support)
+```yaml
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: admin@example.com
+      storage: /acme.json
+      httpChallenge:
+        entryPoint: web
+```
+
+### DNS-01 Challenge (required for wildcard certs)
+```yaml
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: admin@example.com
+      storage: /acme.json
+      dnsChallenge:
+        provider: cloudflare  # See supported providers below
+        resolvers: ["1.1.1.1:53", "8.8.8.8:53"]
+        delayBeforeCheck: 10s
+```
+
+Supported DNS providers: cloudflare, route53, googlecloud, azure, digitalocean, namecheap, ovh, gandi, hetzner, linode, vultr, and many more.
+
+Environment variables per provider (e.g., Cloudflare):
+```bash
+CF_DNS_API_TOKEN=your-api-token
+# OR
+CF_API_EMAIL=your-email
+CF_API_KEY=your-global-api-key
+```
+
+### TLS-ALPN-01 Challenge
+```yaml
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: admin@example.com
+      storage: /acme.json
+      tlsChallenge: {}
+```
+
+## Wildcard Certificates
+
+```yaml
+entryPoints:
+  websecure:
+    address: ":443"
+    http:
+      tls:
+        certResolver: letsencrypt
+        domains:
+          - main: "example.com"
+            sans:
+              - "*.example.com"
+          - main: "example.org"
+            sans:
+              - "*.example.org"
+```
+
+## TLS Options
+
+```yaml
+# dynamic/tls.yml
+tls:
+  options:
+    default:  # "default" applies to all routers without explicit tls options
+      minVersion: VersionTLS12
+      cipherSuites:
+        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
+      sniStrict: true
+
+    modern:
+      minVersion: VersionTLS13
+```
+
+Kubernetes CRD:
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: TLSOption
+metadata:
+  name: default
+  namespace: traefik
+spec:
+  minVersion: VersionTLS12
+  sniStrict: true
+  cipherSuites:
+    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+```
+
+## Mutual TLS (mTLS)
+
+```yaml
+tls:
+  options:
+    mtls:
+      clientAuth:
+        caFiles:
+          - /certs/client-ca.pem
+        clientAuthType: RequireAndVerifyClientCert
+        # Options: NoClientCert, RequestClientCert, RequireAnyClientCert,
+        #          VerifyClientCertIfGiven, RequireAndVerifyClientCert
+```
+
+## Custom Certificates (no ACME)
+
+```yaml
+tls:
+  certificates:
+    - certFile: /certs/example.com.crt
+      keyFile: /certs/example.com.key
+    - certFile: /certs/wildcard.example.com.crt
+      keyFile: /certs/wildcard.example.com.key
+  stores:
+    default:
+      defaultCertificate:
+        certFile: /certs/default.crt
+        keyFile: /certs/default.key
+```
+
+## ServersTransport (TLS to backends)
+
+```yaml
+# Kubernetes CRD
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: mtls-transport
+spec:
+  serverName: "backend.internal"
+  insecureSkipVerify: false
+  rootCAsSecrets:
+    - backend-ca
+  certificatesSecrets:
+    - client-cert
+  maxIdleConnsPerHost: 10
+```
+
+## Best Practices
+
+- Use DNS-01 for wildcard certs
+- Set `minVersion: VersionTLS12` minimum
+- Enable `sniStrict: true` to reject unknown domains
+- Persist `acme.json` on a volume (mode 600)
+- Use staging CA for testing: `caServer: https://acme-staging-v02.api.letsencrypt.org/directory`
+- In HA setups, use shared cert storage (Consul KV or Traefik Enterprise)