From 07722671d4740a74b0e6afc8088cc19973061600 Mon Sep 17 00:00:00 2001
From: Moritz Graf <github@moritzgraf.de>
Date: Tue, 19 Apr 2022 22:29:31 +0200
Subject: [PATCH] Adding nextcloud changes to make it more secure

---
 k8s/README.md                      |   5 ++++
 k8s/minio/minio.secret.yaml        | Bin 408 -> 622 bytes
 k8s/nextcloud/nextcloud.secret.yml |  46 +++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+)

diff --git a/k8s/README.md b/k8s/README.md
index 4f8c348..4b9513c 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -73,6 +73,11 @@ k apply -f openebs/storageclass.yml
 
 Switching to [Bitnami chart](https://artifacthub.io/packages/helm/bitnami/minio) as "normal" chart just too big.
 
+Links:
+
+* [minio-console.haumdaucher.de](minio-console.haumdaucher.de)
+* [minio.haumdaucher.de](minio.haumdaucher.de)
+
 ```sh
 helm repo update
 helm upgrade --install -f minio/minio.secret.yaml --namespace minio --create-namespace minio bitnami/minio
diff --git a/k8s/minio/minio.secret.yaml b/k8s/minio/minio.secret.yaml
index 1a642000328630e6e1ad334a4f7b3eb87547e6a1..e11e6a044bbe574e3b5977d4784c0cf946521aaf 100644
GIT binary patch
literal 622
zcmV-!0+IayM@dveQdv+`02+gLwad--<#7Ct^q&TvGz&?9)BY*|DGg^MX#{LYQ~SPY
zSx<%h-dcqJVE7U}J4g^E5p}5n)f*0n^o$1oa@Q1fZ8?2xO4`WkT1;XHi7zapK&R|O
zLCuXGH>Ec!x|UdKoL9g-ZqH>`tOjt+UYop-OH!d`!a0uKzv(@vaPkhBLw!b%b!O^X
zaWkCMFme_bQ@?5oirV|K7zK1kCZdadYJVxEuxgN*0=uyH8A53sXt&TPLK$~l^mxqq
zOY$6wUK$M1?nMIy6V5qhH9F`!_q_BHx1B0J<R(Sr`5FJm`7;_JW~r{3V8knw5Zt)+
zzI95b#OZcid4*}}PR|<P=9q`jC|p-Zk~?WWqMK+qBEgA!XQx%8pWs;(aR~x+d05L(
zM7uM=EL1}U$Dl6xf<DiKML%EIHoiS$U>NI9{Q`IAOTM|buI>p`j!EYD2QgSU-rD&z
z3~>k^)d?*iOwanXy5#%-kM`ZMXw2}n<KR-L0sQI|WJyH+t`2JfkoNf8NiZn14&Ovv
zf!^t4qXYLKw_<V!AOJ{2mD?|KF*fM?pOf4EJmg9O_5-7~7MY(<*eHx(!DUHd2>*tp
zkDo3XQs2CU+cziwm;E^QNVEL%V~)$F9xFY~pFteF!UA#ypXgbGo3~pe;hP#1MU`+1
z2HrM1*;e|o>S>nH_UA3%5~H{`I^BNRUq?-K{GkeIJl@MByTTLu+A{=vu>894h6u=>
zn`8UkvzKMm$GtDONk~6Ot{ENg>;-<qi8t65&Ke@1Ie_21rRaB(CfBssZkhWNT8ik>
I9?04IcDd3rLjV8(

literal 408
zcmV;J0cZXIM@dveQdv+`060ph*Y`JW;cuEvP5YjUJ-8_*)T6io$8gZ1>L#^fr@LzX
zr7F-2anUi9&Dj`?)KTVTKQs`aU3|E(OBc?cUQ%zP|Kjf^fYyEqBVbO`TvyCdMap49
z*{qqbc_mbjAlQc1nopcOY9Djxyh71*=lvff8Aq@e#~0;D3{T)-OV-(3m5z5;CQeS*
z;h!nd@0SPcEib`#_*oQm8A6(QC<3!cXe8LgE2%$bD%-v$N;?TsCbn$dvk(<-VhfU4
z_4a>)Jt{vQz?E+Mosi~rE1|0D`@WBf_B=_rLv^w<9A`{KP2@9Kjca6iugOAl`P*yt
z0%H6N7{TfjaYh6ksOjP5{Ay;0K`is@$d>{+eNJjF?HOR3fy2-U3jY_>tnO3&@Kwcn
zmZsb*JYKCslgX=d!;wqjB2{e&=N$Bhi3VY54h1xi=N`+%xv9K>y~QDk3&~Sbqnwk>
zBWgbY7|=qXU;1)Jf`$7c0C(v>J7l~6#o@pr@Qn{!(!E31jK7<OjGKAK;S<Kb?Z!<u
C{mLN#

diff --git a/k8s/nextcloud/nextcloud.secret.yml b/k8s/nextcloud/nextcloud.secret.yml
index 8ef6f06..63879a1 100644
--- a/k8s/nextcloud/nextcloud.secret.yml
+++ b/k8s/nextcloud/nextcloud.secret.yml
@@ -1,18 +1,64 @@
+phpClientHttpsFix:
+  enabled: "true" 
+  protocol: "https"
+
 
 ingress:
   enabled: true
+  ingressClass: nginx
   annotations:
     kubernetes.io/ingress.class: "nginx"    
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: 4G
+    nginx.ingress.kubernetes.io/server-snippet: |-
+      server_tokens off;
+      proxy_hide_header X-Powered-By;
+
+      rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
+      rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+      rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json;
+      location = /.well-known/carddav {
+        return 301 $scheme://$host/remote.php/dav;
+      }
+      location = /.well-known/caldav {
+        return 301 $scheme://$host/remote.php/dav;
+      }
+      location = /robots.txt {
+        allow all;
+        log_not_found off;
+        access_log off;
+      }
+      location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
+        deny all;
+      }
+      location ~ ^/(?:autotest|occ|issue|indie|db_|console) {
+        deny all;
+      }
   tls:
   - hosts:
     - "cloud.haumdaucher.de"
     secretName: cloud-haumdaucher-de
+  
 nextcloud:
   host: "cloud.haumdaucher.de"
   username: admin
   password: loKeengoo6OoZaevahZai4Hie
+  configs:
+    proxy.config.php: |-
+      <?php
+      $CONFIG = array (
+        'trusted_proxies' => array(
+          0 => '127.0.0.1',
+          1 => '10.0.0.0/8',
+          2 => '136.243.23.215',
+        ),
+        'forwarded_for_headers' => array('HTTP_X_FORWARDED_FOR'),
+      );
 cronjob:
   enabled: true
 internalDatabase: