mirror of
https://github.com/elAgala/server-initializer.git
synced 2026-02-14 13:16:17 +00:00
Add full caddy installation (Coraza WAF + Crowdsec)
- Remove security issue when exposing ports in a docker container: Use intranet instead - Modify install_caddy to use new template
This commit is contained in:
39
templates/caddy/full/caddy/Caddyfile
Normal file
39
templates/caddy/full/caddy/Caddyfile
Normal file
@@ -0,0 +1,39 @@
|
||||
{
|
||||
# Put Coraza in front of every request
|
||||
order coraza_waf first
|
||||
|
||||
# Logging
|
||||
log {
|
||||
level DEBUG
|
||||
format console
|
||||
}
|
||||
|
||||
# Allow CrowdSec globally
|
||||
crowdsec {
|
||||
api_url http://crowdsec:8080
|
||||
api_key {$CROWDSEC_API_KEY}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
# Example static
|
||||
static.example.com {
|
||||
coraza_waf {
|
||||
directives `
|
||||
Include /etc/caddy/coraza.conf
|
||||
`
|
||||
}
|
||||
|
||||
root * /src/static/test
|
||||
file_server
|
||||
}
|
||||
|
||||
api.example.com {
|
||||
coraza_waf {
|
||||
directives `
|
||||
Include /etc/caddy/coraza.conf
|
||||
`
|
||||
}
|
||||
|
||||
reverse_proxy * http://{CONTAINER_NAME}:{CONTAINER_PORT}
|
||||
}
|
||||
15
templates/caddy/full/caddy/coraza/coraza_rules.conf
Normal file
15
templates/caddy/full/caddy/coraza/coraza_rules.conf
Normal file
@@ -0,0 +1,15 @@
|
||||
# OWASP CRS rules
|
||||
Include /etc/caddy/coreruleset/crs-setup.conf.example
|
||||
Include /etc/caddy/coreruleset/rules/*.conf
|
||||
|
||||
# Custom rules
|
||||
SecRuleEngine On
|
||||
|
||||
# Block SQLi
|
||||
SecRule ARGS "@detectSQLi" \
|
||||
"id:1000,\
|
||||
phase:2,\
|
||||
deny,\
|
||||
status:403,\
|
||||
msg:'SQL Injection Detected'"
|
||||
|
||||
Reference in New Issue
Block a user