WIP

ansible/roles/waf_config/defaults/main.yml

@@ -35,12 +35,14 @@ waf_config_defaults:
   custom_key_file: ""
   plugins: []
 
+  # caddy-ratelimit
   rate_events: 1000
   rate_window: "1m"
 
+  # steffenbusch/caddy-bot-barrier
   bot_barrier: false
 
-  # CRS defaults
+  # corazawaf/coraza-caddy
   log_only: false
   paranoia_level: 1
   detection_paranoia_level: null
@@ -178,6 +180,8 @@ waf_config_defaults:
     - "/x-method-override/"
     - "/x-middleware-subrequest/"
     - "/expect/"
+  restricted_headers_extended:
+    - "/accept-charset/"
   allowed_http_versions:
     - "HTTP/1.0"
     - "HTTP/1.1"
@@ -185,8 +189,6 @@ waf_config_defaults:
     - "HTTP/2.0"
     - "HTTP/3"
     - "HTTP/3.0"
-  restricted_headers_extended:
-    - "/accept-charset/"
   allowed_request_content_type_charset:
     - "|utf-8|"
     - "|iso-8859-1|"

ansible/roles/waf_config/templates/Caddyfile

@@ -1,5 +1,4 @@
 {
-# storage redis
   grace_period 10s
   order coraza_waf first
 {% if waf_config_email | default(None) != None %}
@@ -15,7 +14,7 @@
   log waf {
     format json
     include "http.handlers.waf"
-    output file /var/log/caddy/waf.log
+    output stdout
   }
 {% if waf_config_local_ca_name | default(None) != None %}
 
@@ -117,6 +116,28 @@
     `
   }
 
+  # Cf. https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
+  header {
+#   Access-Control-Allow-Origin  "https://secure.gravatar.com"
+    Content-Security-Policy      "upgrade-insecure-requests; worker-src 'self' blob:; connect-src 'self'; media-src 'self'; img-src 'self' data: https://secure.gravatar.com/avatar/; font-src 'self' data:; style-src 'self' 'unsafe-inline'; object-src 'none'; frame-src 'self' blob:; child-src 'self'; form-action 'self'; frame-ancestors 'self'"
+#   Cross-Origin-Embedder-Policy "require-corp"
+    Cross-Origin-Opener-Policy   "same-origin"
+    Cross-Origin-Resource-Policy "same-site"
+    Permissions-Policy           "geolocation=(), camera=(), microphone=(), interest-cohort=()"
+    Referrer-Policy              "strict-origin-when-cross-origin"
+    Strict-Transport-Security    "max-age=2635200; includeSubDomains"
+    X-Content-Type-Options       "nosniff"
+    X-Frame-Options              "DENY"
+    X-Robots-Tag                 "noindex, nofollow"
+    ?Content-Type                "text/html; charset=UTF-8"
+    >Set-Cookie          "(.*)"  "$1; SameSite=None; Secure;"
+    -Server
+    -Via
+    -X-Powered-By
+    -X-AspNet-Version
+    -X-AspNetMvc-Version
+  }
+
   handle_errors 403 {
     header X-Blocked "true"
     respond "Your request was blocked."