From c558d7b62c90ca89d016eae9933a39aca183cd9f Mon Sep 17 00:00:00 2001 From: Kyattsukuro Date: Wed, 21 Jan 2026 14:37:26 +0100 Subject: [PATCH] protect against dns rebinds --- compose.yml | 2 +- config/config.yml | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/compose.yml b/compose.yml index b9ef64c..0878b38 100644 --- a/compose.yml +++ b/compose.yml @@ -33,7 +33,7 @@ services: traefik.http.routers.traefik-dashboard.tls: "true" traefik.http.routers.traefik-dashboard.tls.certresolver: hetzner traefik.http.routers.traefik-dashboard.service: api@internal - traefik.http.routers.traefik-dashboard.middlewares: traefik-auth@file + traefik.http.routers.traefik-dashboard.middlewares: traefik-auth@file, local-only@file volumes: traefik-certs: diff --git a/config/config.yml b/config/config.yml index 279fca5..40f2ef0 100644 --- a/config/config.yml +++ b/config/config.yml @@ -37,4 +37,10 @@ http: redirect-duckdns: redirectRegex: regex: "^http(s?)://(.+\\.)?urmel\\.duckdns\\.org(:[0-9]+)?(/.*$|$)" - replacement: "http${1}://${2}urmel.de${3}${4}" \ No newline at end of file + replacement: "http${1}://${2}urmel.de${3}${4}" + local-only: + ipAllowList: + sourceRange: + - "10.0.0.0/8" + - "172.16.0.0/12" + - "168.168.0.0/16" \ No newline at end of file