From b8ce2b516367ed5f930a449f99c1f2c9378170a1 Mon Sep 17 00:00:00 2001
From: Kyattsukuro <nikl.free44@gmail.com>
Date: Wed, 21 Jan 2026 14:37:26 +0100
Subject: [PATCH] protect against dns rebinds

---
 config/config.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/config/config.yml b/config/config.yml
index 279fca5..19cb501 100644
--- a/config/config.yml
+++ b/config/config.yml
@@ -6,6 +6,8 @@ http:
       entryPoints:
         - https
         - http
+      middlewares:
+        - local-only
       tls:
         certResolver: hetzner
         domains:
@@ -37,4 +39,10 @@ http:
     redirect-duckdns:
       redirectRegex:
         regex: "^http(s?)://(.+\\.)?urmel\\.duckdns\\.org(:[0-9]+)?(/.*$|$)"
-        replacement: "http${1}://${2}urmel.de${3}${4}"
\ No newline at end of file
+        replacement: "http${1}://${2}urmel.de${3}${4}"
+    local-only:
+      ipAllowList:
+        sourceRange:
+          - "10.0.0.0/8"
+          - "172.16.0.0/12"
+          - "168.168.0.0/16"
\ No newline at end of file