21 lines
812 B
Bash
21 lines
812 B
Bash
# Public domain served over HTTPS (Let's Encrypt certificate is issued for it)
|
|
DOMAIN=proxy.example.com
|
|
|
|
# Email for the ACME account (expiry notices from Let's Encrypt)
|
|
ACME_EMAIL=
|
|
|
|
# Secret token — k8s pods must send this in X-Proxy-Token header (optional)
|
|
# If empty or unset — token auth is disabled (open mode, protected by IP allowlist only)
|
|
# Generate with: openssl rand -hex 32
|
|
PROXY_SECRET=
|
|
|
|
# Allowed source CIDRs (comma-separated), leave empty to allow all (dev mode)
|
|
# Example: "10.0.0.0/8,172.16.0.0/12"
|
|
ALLOWED_CIDR=
|
|
|
|
# API key header: a request carrying this header bypasses the IP allowlist (IP OR key).
|
|
# Set both or neither. Name: [A-Za-z0-9-], value: [A-Za-z0-9._~+/=-]. Only matters if ALLOWED_CIDR is set.
|
|
# Generate value with: openssl rand -hex 32
|
|
AUTH_HEADER_NAME=
|
|
AUTH_HEADER_VALUE=
|