WIP

ansible/roles/waf_config/templates/Caddyfile

@@ -1,5 +1,4 @@
 {
-# storage redis
   grace_period 10s
   order coraza_waf first
 {% if waf_config_email | default(None) != None %}
@@ -15,7 +14,7 @@
   log waf {
     format json
     include "http.handlers.waf"
-    output file /var/log/caddy/waf.log
+    output stdout
   }
 {% if waf_config_local_ca_name | default(None) != None %}
 
@@ -117,6 +116,28 @@
     `
   }
 
+  # Cf. https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
+  header {
+#   Access-Control-Allow-Origin  "https://secure.gravatar.com"
+    Content-Security-Policy      "upgrade-insecure-requests; worker-src 'self' blob:; connect-src 'self'; media-src 'self'; img-src 'self' data: https://secure.gravatar.com/avatar/; font-src 'self' data:; style-src 'self' 'unsafe-inline'; object-src 'none'; frame-src 'self' blob:; child-src 'self'; form-action 'self'; frame-ancestors 'self'"
+#   Cross-Origin-Embedder-Policy "require-corp"
+    Cross-Origin-Opener-Policy   "same-origin"
+    Cross-Origin-Resource-Policy "same-site"
+    Permissions-Policy           "geolocation=(), camera=(), microphone=(), interest-cohort=()"
+    Referrer-Policy              "strict-origin-when-cross-origin"
+    Strict-Transport-Security    "max-age=2635200; includeSubDomains"
+    X-Content-Type-Options       "nosniff"
+    X-Frame-Options              "DENY"
+    X-Robots-Tag                 "noindex, nofollow"
+    ?Content-Type                "text/html; charset=UTF-8"
+    >Set-Cookie          "(.*)"  "$1; SameSite=None; Secure;"
+    -Server
+    -Via
+    -X-Powered-By
+    -X-AspNet-Version
+    -X-AspNetMvc-Version
+  }
+
   handle_errors 403 {
     header X-Blocked "true"
     respond "Your request was blocked."