Add full caddy installation (Coraza WAF + Crowdsec)

- Remove security issue when exposing ports in a docker container: Use
intranet instead
- Modify install_caddy to use new template
This commit is contained in:
2025-01-26 01:35:59 -03:00
parent f352126e56
commit 3d9bdc04b2
9 changed files with 149 additions and 10 deletions

View File

@@ -0,0 +1,39 @@
{
# Put Coraza in front of every request
order coraza_waf first
# Logging
log {
level DEBUG
format console
}
# Allow CrowdSec globally
crowdsec {
api_url http://crowdsec:8080
api_key {$CROWDSEC_API_KEY}
}
}
# Example static
static.example.com {
coraza_waf {
directives `
Include /etc/caddy/coraza.conf
`
}
root * /src/static/test
file_server
}
api.example.com {
coraza_waf {
directives `
Include /etc/caddy/coraza.conf
`
}
reverse_proxy * http://{CONTAINER_NAME}:{CONTAINER_PORT}
}

View File

@@ -0,0 +1,15 @@
# OWASP CRS rules
Include /etc/caddy/coreruleset/crs-setup.conf.example
Include /etc/caddy/coreruleset/rules/*.conf
# Custom rules
SecRuleEngine On
# Block SQLi
SecRule ARGS "@detectSQLi" \
"id:1000,\
phase:2,\
deny,\
status:403,\
msg:'SQL Injection Detected'"