Traefik middlewares explained

Ingress without policy is just a door. Traefik middlewares let us attach the same security story to every public route.

The chain we reuse

1. WAF / request filtering for common exploit patterns
2. HSTS so browsers refuse insecure downgrade
3. Rate limits on auth and noisy public APIs
4. Forward-auth for operator and admin surfaces

middlewares: - name: soc2-waf-chain - name: soc2-hsts - name: authelia-forwardauth

New apps inherit the chain. Exceptions require an explicit reason — and still keep TLS.