From 1788a25ea7ed90d6e87ffca0f14d53e590ec69ea Mon Sep 17 00:00:00 2001 From: Janik von Rotz Date: Tue, 11 Nov 2025 14:21:14 +0100 Subject: [PATCH] feat(nextcloud): remove hardcoded hsts header and improve security documentation - Remove hardcoded Strict-Transport-Security header from ingress template - Update README to recommend configuring security headers at ingress controller level - Improve documentation regarding ingress-nginx snippet directive limitations - Enhance context alias detection in task script with better error handling --- nextcloud/README.md | 4 +++- nextcloud/templates/ingress.yaml | 2 -- task | 3 ++- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/nextcloud/README.md b/nextcloud/README.md index 3ff6669..28768fd 100644 --- a/nextcloud/README.md +++ b/nextcloud/README.md @@ -4,9 +4,11 @@ This Helm chart deploys Nextcloud with PostgreSQL. ## Security Headers -This chart automatically configures the following security headers: +For enhanced security, it's recommended that you configure the following security headers: - `Strict-Transport-Security`: max-age=15552000; includeSubDomains; preload (HSTS) +Please note that if your ingress-nginx controller has snippet directives disabled (which is common in secure environments), you will need to configure these headers at the ingress controller level or through your cluster's ingress configuration. + ## Secrets Setup a `nextcloud-creds` secret with any additional environment variables you want to pass to Nextcloud. diff --git a/nextcloud/templates/ingress.yaml b/nextcloud/templates/ingress.yaml index 0085679..a16b708 100644 --- a/nextcloud/templates/ingress.yaml +++ b/nextcloud/templates/ingress.yaml @@ -6,8 +6,6 @@ metadata: annotations: kubernetes.io/ingress.class: {{ .Values.ingress.className }} nginx.ingress.kubernetes.io/proxy-body-size: "4G" - nginx.ingress.kubernetes.io/configuration-snippet: | - more_set_headers "Strict-Transport-Security: max-age=15552000; includeSubDomains; preload"; {{- if .Values.ingress.clusterIssuerRef }} cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuerRef }} {{- end }} diff --git a/task b/task index 74e149b..870daf8 100755 --- a/task +++ b/task @@ -98,7 +98,8 @@ if kubens &> /dev/null; then namespace=$(kubens -c) fi get-context-alias() { - echo "$(basename "$(readlink "$HOME/.kube/config")" | cut -d '.' -f 2)" + local alias="$(basename "$(readlink "$HOME/.kube/config" 2>/dev/null)" 2>/dev/null | cut -d '.' -f 2)" + echo "${alias:-loc}" } context_alias=$(get-context-alias)