protect against dns rebinds

compose.yml

@@ -33,7 +33,7 @@ services:
       traefik.http.routers.traefik-dashboard.tls: "true"
       traefik.http.routers.traefik-dashboard.tls.certresolver: hetzner
       traefik.http.routers.traefik-dashboard.service: api@internal
-      traefik.http.routers.traefik-dashboard.middlewares: traefik-auth@file
+      traefik.http.routers.traefik-dashboard.middlewares: local-only@file, traefik-auth@file
 
 volumes:
   traefik-certs:

config/config.yml

@@ -38,3 +38,9 @@ http:
       redirectRegex:
         regex: "^http(s?)://(.+\\.)?urmel\\.duckdns\\.org(:[0-9]+)?(/.*$|$)"
         replacement: "http${1}://${2}urmel.de${3}${4}"
+    local-only:
+      ipAllowList:
+        sourceRange:
+          - "10.0.0.0/8"
+          - "172.16.0.0/12"
+          - "168.168.0.0/16"