Add full caddy installation (Coraza WAF + Crowdsec)

- Remove security issue when exposing ports in a docker container: Use
intranet instead
- Modify install_caddy to use new template

templates/caddy/full/.env

@@ -0,0 +1 @@
+CROWDSEC_API_KEY=${CROWDSEC_API_KEY}

templates/caddy/full/caddy/Caddyfile

@@ -0,0 +1,39 @@
+{
+  # Put Coraza in front of every request
+  order coraza_waf first
+  
+  # Logging
+  log {
+    level DEBUG
+    format console
+  }
+
+  # Allow CrowdSec globally
+  crowdsec {
+    api_url http://crowdsec:8080
+    api_key {$CROWDSEC_API_KEY}
+  }
+
+}
+
+# Example static
+static.example.com {
+  coraza_waf {
+    directives `
+      Include /etc/caddy/coraza.conf
+    `
+  }
+      
+  root * /src/static/test
+  file_server
+}
+
+api.example.com {
+  coraza_waf {
+    directives `
+      Include /etc/caddy/coraza.conf
+    `
+  }
+
+  reverse_proxy * http://{CONTAINER_NAME}:{CONTAINER_PORT}
+}

templates/caddy/full/caddy/coraza/coraza_rules.conf

@@ -0,0 +1,15 @@
+# OWASP CRS rules
+Include /etc/caddy/coreruleset/crs-setup.conf.example
+Include /etc/caddy/coreruleset/rules/*.conf
+
+# Custom rules
+SecRuleEngine On
+
+# Block SQLi
+SecRule ARGS "@detectSQLi" \
+  "id:1000,\
+  phase:2,\
+  deny,\
+  status:403,\
+  msg:'SQL Injection Detected'"
+

templates/caddy/full/crowdsec/acquis.yaml

@@ -0,0 +1,6 @@
+# Parse Caddy JSON logs
+filenames:
+  - /var/log/caddy/access.log
+labels:
+  type: caddy
+

templates/caddy/full/docker-compose.yml

@@ -0,0 +1,43 @@
+services:
+  crowdsec:
+    image: crowdsecurity/crowdsec:latest
+    container_name: crowdsec
+    volumes:
+      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
+      - ./crowdsec/data:/var/lib/crowdsec/data
+      - ./caddy/logs:/var/log/caddy:ro
+    environment:
+      - COLLECTIONS=crowdsecurity/caddy crowdsecurity/whitelist-good-actors crowdsecurity/http-cve
+      - BOUNCER_KEY_CADDY=${CROWDSEC_API_KEY}
+    networks:
+      - caddy_net
+    restart: unless-stopped
+
+  caddy:
+    image: ghcr.io/elagala/server-initializer/caddy-waf-crowdsec:latest 
+    container_name: caddy
+    ports:
+      - "80:80"
+      - "443:443"
+    environment:
+      - CROWDSEC_API_KEY=${CROWDSEC_API_KEY}
+    volumes:
+      - ../static:/src/static # Your static files location
+      - ./caddy/Caddyfile:/etc/caddy/Caddyfile
+      - ./caddy/coraza/coraza.conf:/etc/caddy/coraza.conf
+      - ./caddy/logs:/var/log/caddy
+      - caddy_data:/data
+      - caddy_config:/config
+    networks:
+      - caddy_net
+    depends_on:
+      - crowdsec
+    restart: unless-stopped
+
+volumes:
+  caddy_data:
+  caddy_config:
+
+networks:
+  caddy_net:
+    external: true