enhanced security through HSTS headers' middleware

(see https://docs.docker.com/compose/compose-file/#version-top-level-element)

.gitignore

@@ -1,2 +1,2 @@
-/.env
+/.env*
 /certs.json

docker-compose.yml

@@ -1,6 +1,4 @@
 ---
-version: "3"
-
 services:
   traefik:
     image: traefik:${TRAEFIK_VERSION}
@@ -13,7 +11,8 @@ services:
       - --api.dashboard=true
       # configure Let's Encrypt automatic certificates
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge=true
-      - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge.provider=hetzner
+      - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge.provider=${TRAEFIK_DNSPROVIDER}
+      - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.dnschallenge.resolvers=${TRAEFIK_DNSRESOLVERS}
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.email=${LETSENCRYPT_EMAIL}
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.keytype=RSA4096
       - --certificatesresolvers.${TRAEFIK_CERTRESOLVER}.acme.storage=/certs.json
@@ -32,22 +31,26 @@ services:
       # should not need, but just in case, a folder for dynamic config files is also configured
       - --providers.file.directory=/config
       - --providers.file.watch=true
-    environment:
+    env_file:
-      - HETZNER_API_KEY=${HETZNER_API_KEY}
+      - ${TRAEFIK_DNSPROVIDER_ENVFILE}
     labels:
       # expose Træfik using Træfik (dashboard)
       - traefik.enable=${TRAEFIK_ENABLED}
-      # configure a global whitelist for my home
+      # configure a global whitelist for accessing the Træfik dashboard
       - traefik.http.middlewares.dashboard-whitelist.ipwhitelist.sourcerange=${TRAEFIK_DASHBOARD_WHITELIST}
-      # configure the global redirect middleware
+      # configure a global middleware for redirecting HTTP to HTTPS
       - traefik.http.middlewares.http-to-https.redirectscheme.scheme=https
       - traefik.http.middlewares.http-to-https.redirectscheme.permanent=true
+      # configure a global middleware to harden security through HSTS
+      - traefik.http.middlewares.hsts.headers.stsSeconds=${TRAEFIK_STS_SECONDS}
+      - traefik.http.middlewares.hsts.headers.stsIncludeSubdomains=${TRAEFIK_STS_SUBDOMAINS}
+      - traefik.http.middlewares.hsts.headers.stsPreload=${TRAEFIK_STS_PRELOAD}
       ### Section HTTP
       - traefik.http.routers.http-${TRAEFIK_ROUTER}.entrypoints=http
       # only some people can access the dashboard, hence protect it with it's whitelist
       - traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=dashboard-whitelist
       # redirect Træfik dashboard to HTTPS only
-      - traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=http-to-https
+      - traefik.http.routers.http-${TRAEFIK_ROUTER}.middlewares=http-to-https,hsts
       - traefik.http.routers.http-${TRAEFIK_ROUTER}.rule=Host(`${TRAEFIK_MATCHRULE}`)
       - traefik.http.routers.http-${TRAEFIK_ROUTER}.service=api@internal
       ### Section HTTPS

env.dnsprovider.example

@@ -0,0 +1 @@
+HETZNER_API_KEY=

env.example

@@ -8,10 +8,17 @@ TRAEFIK_NETWORK=traefik
 TRAEFIK_MATCHRULE=traefik.mydomain.com
 TRAEFIK_ROUTER=traefik_mydomain_com
 TRAEFIK_PILOT_TOKEN=
+
+# Security
 TRAEFIK_TLSENABLED=true
+TRAEFIK_STS_SECONDS=15552000
+TRAEFIK_STS_SUBDOMAINS=true
+TRAEFIK_STS_PRELOAD=true
 
 # Certificate provider
-HETZNER_API_KEY=
+TRAEFIK_DNSPROVIDER=hetzner
+TRAEFIK_DNSPROVIDER_ENVFILE=./.env.dnsprovider
+TRAEFIK_DNSRESOLVERS=1.1.1.1:53,1.0.0.1:53
 LETSENCRYPT_EMAIL=admin@mydomain.com
 
 # Debugging