From abf6bfae88a98a1bd009a3cc36b91fe32aaffe8b Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 26 Sep 2026 20:36:26 +1000 Subject: [PATCH] Drop dead X-Frame-Options rules from the haproxy edge (#487) The 13 `X-Frame-Options DENY if acl_` rules in `fe_https` have never fired: their ACLs use `req.hdr(host)`, a request-direction fetch that is invalid in a response ruleset, so HAProxy rejects them at config-check time. Carried over verbatim from the Puppet LXD config during the k8s move. - Remove the 13 dead `http-response set-header X-Frame-Options` rules. - Remove the 15 now-orphaned `acl acl_*` definition lines. Not switching the header on: it has never been live, and Grafana/Gitea send their own. `haproxy -c` warnings drop 33 -> 20; the two working response headers stay. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/487 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- apps/base/haproxy/configmap.yaml | 28 ---------------------------- 1 file changed, 28 deletions(-) diff --git a/apps/base/haproxy/configmap.yaml b/apps/base/haproxy/configmap.yaml index d81ac50..e1ad1eb 100644 --- a/apps/base/haproxy/configmap.yaml +++ b/apps/base/haproxy/configmap.yaml @@ -94,36 +94,8 @@ data: mode http description Global HTTPS Frontend acl acl-letsencrypt path_beg /.well-known/acme-challenge/ - acl acl_sonarr req.hdr(host) -i sonarr.main.unkin.net - acl acl_radarr req.hdr(host) -i radarr.main.unkin.net - acl acl_lidarr req.hdr(host) -i lidarr.main.unkin.net - acl acl_readarr req.hdr(host) -i readarr.main.unkin.net - acl acl_prowlarr req.hdr(host) -i prowlarr.main.unkin.net - acl acl_nzbget req.hdr(host) -i nzbget.main.unkin.net - acl acl_jellyfin req.hdr(host) -i jellyfin.main.unkin.net - acl acl_fafflix req.hdr(host) -i fafflix.unkin.net - acl acl_gitea req.hdr(host) -i git.unkin.net - acl acl_grafana req.hdr(host) -i grafana.unkin.net - acl acl_ceph_dashboard req.hdr(host) -i dashboard.ceph.unkin.net - acl acl_stalwart_webadmin req.hdr(host) -i mail-webadmin.main.unkin.net - acl acl_stalwart_webadmin req.hdr(host) -i autoconfig.main.unkin.net - acl acl_stalwart_webadmin req.hdr(host) -i autodiscovery.main.unkin.net - acl acl_kanidm req.hdr(host) -i auth.unkin.net http-request set-header X-Forwarded-Proto https http-request set-header X-Real-IP %[src] - http-response set-header X-Frame-Options DENY if acl_sonarr - http-response set-header X-Frame-Options DENY if acl_radarr - http-response set-header X-Frame-Options DENY if acl_lidarr - http-response set-header X-Frame-Options DENY if acl_readarr - http-response set-header X-Frame-Options DENY if acl_prowlarr - http-response set-header X-Frame-Options DENY if acl_nzbget - http-response set-header X-Frame-Options DENY if acl_jellyfin - http-response set-header X-Frame-Options DENY if acl_fafflix - http-response set-header X-Frame-Options DENY if acl_gitea - http-response set-header X-Frame-Options DENY if acl_grafana - http-response set-header X-Frame-Options DENY if acl_ceph_dashboard - http-response set-header X-Frame-Options DENY if acl_stalwart_webadmin - http-response set-header X-Frame-Options DENY if acl_kanidm http-response set-header X-Content-Type-Options nosniff http-response set-header X-XSS-Protection 1;mode=block use_backend be_letsencrypt if acl-letsencrypt