WIP
This commit is contained in:
1
roles/caddy/.gitignore
vendored
Normal file
1
roles/caddy/.gitignore
vendored
Normal file
@@ -0,0 +1 @@
|
||||
/docs/
|
||||
146
roles/caddy/README.md
Normal file
146
roles/caddy/README.md
Normal file
@@ -0,0 +1,146 @@
|
||||
# Web Application Firewall
|
||||
|
||||
Ce rôle Ansible déploie un WAF basé sur Caddy, Coraza et les OWASP Core Security Rules.
|
||||
|
||||
## Principes
|
||||
|
||||
### Go
|
||||
|
||||
Caddy, Coraza, le module Coraza pour Caddy et l'outil `xcaddy` sont
|
||||
développés avec le langage Go.
|
||||
|
||||
L'outil `xcaddy` a besoin d'une version récente des outils de
|
||||
développement Go. C'est pourquoi le rôle installe Go depuis
|
||||
le site de téléchargement officiel et non via le gestionnaire
|
||||
de paquets de la distribution Linux.
|
||||
|
||||
Go est installé dans le répertoire `/usr/local/go-1.25.5/go` et
|
||||
un lien symbolique est créé de `/usr/local/bin/go` vers
|
||||
`/usr/local/go-1.25.5/go/bin/go`.
|
||||
|
||||
### Caddy
|
||||
|
||||
Caddy est un serveur Web et reverse proxy HTTP puissant et versatile.
|
||||
|
||||
Étant développé en Go, son déploiement prend la forme d'un simble
|
||||
binaire exécutable qui contient toutes les librairies requises. Ce
|
||||
programme est construit avec l'outil `xcaddy` puis copié dans le
|
||||
fichier `/usr/local/bin/caddy`. La ligne de commande utilisée pour
|
||||
construire ce binaire est enregsitrée dans le fichier
|
||||
`/usr/local/bin/.caddy.buil`.
|
||||
|
||||
Le fichier de configuration de caddy utilise le format `Caddyfile`.
|
||||
Il est généré automatiquement à partir des paramètres du rôle puis
|
||||
enregistré sous `/etc/caddy/Caddyfile`.
|
||||
|
||||
### Coraza
|
||||
|
||||
Coraza est directement inclus dans le binaire `caddy`
|
||||
|
||||
### Module Coraza pour Caddy
|
||||
|
||||
### xcaddy
|
||||
|
||||
qui permet de lier tous les modules Go requis
|
||||
pour le WAF
|
||||
|
||||
### Plugins OWASP CRS
|
||||
|
||||
(À ne pas confondre avec les plugins Coraza.)
|
||||
|
||||
Voir: https://github.com/coreruleset/plugin-registry
|
||||
|
||||
- name: "drupal-rule-exclusions"
|
||||
- name: "wordpress-rule-exclusions"
|
||||
- name: "nextcloud-rule-exclusions"
|
||||
- name: "dokuwiki-rule-exclusions"
|
||||
- name: "phpmyadmin-rule-exclusions"
|
||||
- name: "roundcube-rule-exclusions"
|
||||
- name: "sogo-rule-exclusions"
|
||||
|
||||
|
||||
## Paramètres du rôle Ansible
|
||||
|
||||
|
||||
|
||||
## TODO
|
||||
|
||||
Fonctionnalités déjà implémentées:
|
||||
|
||||
- Multisite (cavec configuration des CRS par site)
|
||||
- Redirection vers nom canonique
|
||||
- Rediction HTTP vers HTTPS
|
||||
- Certificats SSL (autmotiques via Let's Encrypt et customs)
|
||||
- OWASP CRS
|
||||
- Redirect (SSL et www et autres)
|
||||
- Filtrage par:
|
||||
- adresses IP
|
||||
- réseaux IP
|
||||
- Antibot par:
|
||||
- défi JavaScript
|
||||
- Passive backend checks
|
||||
- Compression Gzip et zstd
|
||||
|
||||
|
||||
Fomctionnalités à ajouter:
|
||||
|
||||
- Active backend checks
|
||||
- Antibot par:
|
||||
- Cookie
|
||||
- Captcha
|
||||
- reCAPTCHA
|
||||
- hCaptcha
|
||||
- Turnstile
|
||||
- mCaptcha
|
||||
- Changement de format de configuration: Caddyfile -> JSON
|
||||
- Mise en œuvre d'un cluster Redis (ou Consul) pour le partage de informations entre les WAF d'un cluster
|
||||
- Mieux tester le configuration des CRS
|
||||
- Mode détection sans blocage
|
||||
- Filtrage par:
|
||||
- rDNS
|
||||
- DNSBL
|
||||
- ASN
|
||||
- User-Agent (robots, crawlers, IA bots)
|
||||
- méthode HTTP
|
||||
- taille
|
||||
- URI patterns
|
||||
- pays
|
||||
- (ip:danmeuk-tor-exit, ua:mitchellkrogza-bad-user-agents, /etc/hapee-1.9/blacklist.acl)
|
||||
- Gestion CORS
|
||||
- Client cache
|
||||
- Proxy cache
|
||||
- Filtrage par pays
|
||||
- Compression Brotli
|
||||
- En-têtes de sécurité:
|
||||
- HSTS
|
||||
- CSP
|
||||
- X-Frame-Options
|
||||
- X-Content-Type-Options
|
||||
- Referrer Policy
|
||||
- Permissions Policy
|
||||
- Keep Headers
|
||||
- Cookie Flags
|
||||
- Custom headers
|
||||
- Reverse scan
|
||||
- Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules)
|
||||
- Sessions
|
||||
- Whitelist
|
||||
- Bad behavior
|
||||
- Auth
|
||||
- Anti DoDS
|
||||
- Greylist
|
||||
- HTML injection
|
||||
- Metrics (Elasticsearch + Metabase)
|
||||
- Static files et FastCGI pour PHP
|
||||
|
||||
|
||||
## Ressources
|
||||
|
||||
- [Documentation officielle Caddy](https://caddyserver.com/docs/)
|
||||
- [Site Officiel de Coraza](https://coraza.io)
|
||||
- [Coraza WAF Caddy module](https://github.com/corazawaf/coraza-caddy)
|
||||
- [Documentation AWOSP CRS](https://coreruleset.org/docs/)
|
||||
|
||||
Modules
|
||||
- []()
|
||||
- []()
|
||||
408
roles/caddy/defaults/main.yml
Normal file
408
roles/caddy/defaults/main.yml
Normal file
@@ -0,0 +1,408 @@
|
||||
# Defaults
|
||||
caddy_config_only: false
|
||||
caddy_go_version: "1.25.5"
|
||||
caddy_xcaddy_version: "0.4.5"
|
||||
caddy_caddy_version: "2.10.2"
|
||||
caddy_coraza_caddy_version: "2.1.0" # Coraza v3.3.3
|
||||
caddy_owasp_crs_version: "4.22.0"
|
||||
caddy_system_user: "byow"
|
||||
caddy_system_group: "byow"
|
||||
caddy_home_dir: "/opt/{{ caddy_system_user }}"
|
||||
caddy_config_dir: "/etc/{{ caddy_system_user }}"
|
||||
caddy_log_dir: "/var/log/{{ caddy_system_user }}"
|
||||
|
||||
# Cf.: https://github.com/coreruleset/plugin-registry
|
||||
caddy_crs_plugins:
|
||||
- name: "drupal-rule-exclusions"
|
||||
version: "1.0.0"
|
||||
- name: "wordpress-rule-exclusions"
|
||||
version: "1.2.0"
|
||||
- name: "nextcloud-rule-exclusions"
|
||||
version: "1.5.0"
|
||||
- name: "dokuwiki-rule-exclusions"
|
||||
version: "1.0.0"
|
||||
- name: "phpmyadmin-rule-exclusions"
|
||||
version: "1.0.0"
|
||||
has_after_config: true
|
||||
- name: "roundcube-rule-exclusions"
|
||||
version: "1.0.4"
|
||||
provider: "EsadCetiner"
|
||||
- name: "sogo-rule-exclusions"
|
||||
version: "1.0.4"
|
||||
provider: "EsadCetiner"
|
||||
|
||||
# Required unless not site.custom_cert
|
||||
caddy_email: null
|
||||
|
||||
# Required if site.bot_barrier
|
||||
caddy_bot_barrier_secret: null
|
||||
|
||||
# Optionnal
|
||||
caddy_local_ca_name: null
|
||||
caddy_ca_root: null
|
||||
|
||||
caddy_sites: []
|
||||
# - name: ""
|
||||
# site: ""
|
||||
# paths:
|
||||
# - path: "*"
|
||||
# addrs:
|
||||
# - ""
|
||||
# blacklist:
|
||||
# - ""
|
||||
# aliases:
|
||||
# - ""
|
||||
# crs_exceptions:
|
||||
# before_request:
|
||||
# - ""
|
||||
# after_response:
|
||||
# - ""
|
||||
|
||||
caddy_waf_defaults:
|
||||
redirect_from_aliases: true
|
||||
custom_cert: false
|
||||
custom_cert_file: ""
|
||||
custom_key_file: ""
|
||||
|
||||
# Security headers
|
||||
header_content_security_policy:
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#detailed-csp-directives
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy#directives
|
||||
## Fetch directives
|
||||
child-src: "'self'"
|
||||
connect-src: "'self'"
|
||||
font-src: "'self'"
|
||||
img-src: "'self'"
|
||||
manifest-src: "'self'"
|
||||
media-src: "'self'"
|
||||
# Deprecated: prefetch-src: "'self'"
|
||||
object-src: "'none'"
|
||||
script-src: "'none'"
|
||||
script-src-attr: "'none'"
|
||||
script-src-elem: "'none'"
|
||||
style-src: "'self'"
|
||||
style-src-attr: "'self'"
|
||||
style-src-elem: "'self'"
|
||||
default-src: "'self'"
|
||||
## Document directives
|
||||
# base-uri
|
||||
# plugin-types
|
||||
# sandbox
|
||||
## Navigation directives
|
||||
form-action: "'self'"
|
||||
frame-ancestors: "'self'"
|
||||
# https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-src
|
||||
frame-src: "'self'"
|
||||
# https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/worker-src
|
||||
worker-src: "'self'"
|
||||
# https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/block-all-mixed-content
|
||||
block-all-mixed-content:
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/fenced-frame-src
|
||||
fenced-frame-src: "'self'"
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/upgrade-insecure-requests
|
||||
upgrade-insecure-requests:
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
|
||||
header_cross_origin_embedder_policy: "require-corp"
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
|
||||
header_cross_origin_opener_policy: "same-origin"
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Resource-Policy
|
||||
header_cross_origin_resource_policy: "same-site"
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
|
||||
header_permissions_policy:
|
||||
accelerometer: "()"
|
||||
ambient-light-sensor: "()"
|
||||
aria-notify: "()"
|
||||
attribution-reporting: "()"
|
||||
autoplay: "()"
|
||||
bluetooth: "()"
|
||||
browsing-topics: "()"
|
||||
camera: "()"
|
||||
captured-surface-control: "()"
|
||||
compute-pressure: "()"
|
||||
cross-origin-isolated: "()"
|
||||
deferred-fetch: "()"
|
||||
deferred-fetch-minimal: "()"
|
||||
display-capture: "()"
|
||||
encrypted-media: "()"
|
||||
fullscreen: "()"
|
||||
gamepad: "()"
|
||||
geolocation: "()"
|
||||
gyroscope: "()"
|
||||
hid: "()"
|
||||
identity-credentials-get: "()"
|
||||
idle-detection: "()"
|
||||
language-detector: "()"
|
||||
local-fonts: "()"
|
||||
magnetometer: "()"
|
||||
microphone: "()"
|
||||
midi: "()"
|
||||
on-device-speech-recognition: "()"
|
||||
otp-credentials: "()"
|
||||
payment: "()"
|
||||
picture-in-picture: "()"
|
||||
private-state-token-issuance: "()"
|
||||
private-state-token-redemption: "()"
|
||||
publickey-credentials-create: "()"
|
||||
publickey-credentials-get: "()"
|
||||
screen-wake-lock: "()"
|
||||
serial: "()"
|
||||
speaker-selection: "()"
|
||||
storage-access: "()"
|
||||
translator: "()"
|
||||
summarizer: "()"
|
||||
usb: "()"
|
||||
web-share: "()"
|
||||
window-management: "()"
|
||||
xr-spatial-tracking: "()"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#floc-federated-learning-of-cohorts
|
||||
interest-cohort: "()"
|
||||
|
||||
# ???
|
||||
battery: "()"
|
||||
document-domain: "()"
|
||||
execution-while-not-rendered: "()"
|
||||
execution-while-out-of-viewport: "()"
|
||||
navigation-override: "()"
|
||||
|
||||
# https://www.geeksforgeeks.org/computer-networks/http-headers-feature-policy/
|
||||
header_feature_policy:
|
||||
accelerometer: "'none'"
|
||||
ambient-light-sensor: "'none'"
|
||||
autoplay: "'none'"
|
||||
battery: "'none'"
|
||||
camera: "'none'"
|
||||
display-capture: "'none'"
|
||||
document-domain: "'none'"
|
||||
encrypted-media: "'none'"
|
||||
fullscreen: "'none'"
|
||||
geolocation: "'none'"
|
||||
gyroscope: "'none'"
|
||||
layout-animation: "'none'"
|
||||
legacy-image-formats: "'none'"
|
||||
magnetometer: "'none'"
|
||||
microphone: "'none'"
|
||||
midi: "'none'"
|
||||
oversized-images: "'none'"
|
||||
payment: "'none'"
|
||||
picture-in-picture: "'none'"
|
||||
publickey-credentials-get: "'none'"
|
||||
sync-xhr: "'none'"
|
||||
usb: "'none'"
|
||||
screen-wake-lock: "'none'"
|
||||
xr-spatial-tracking: "'none'"
|
||||
|
||||
# ???
|
||||
execution-while-not-rendered: "'none'"
|
||||
execution-while-out-of-viewport: "'none'"
|
||||
navigation-override: "'none'"
|
||||
speaker-selection: "'none'"
|
||||
unoptimized-images: "'none'"
|
||||
unsized-media: "'none'"
|
||||
web-share: "'none'"
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy
|
||||
header_referrer_policy: "strict-origin-when-cross-origin"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
|
||||
header_strict_transport_security: "max-age=2635200; includeSubDomains"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
|
||||
header_x_content_type_options: "nosniff"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options
|
||||
header_x_frame_options: "DENY"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-robots-tag
|
||||
header_x_robots_tag: "noindex, nofollow"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#content-type
|
||||
default_content_type: "text/html; charset=UTF-8"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#set-cookie
|
||||
cookies_attributes: "SameSite=None; Secure;"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-dns-prefetch-control
|
||||
# FIXME
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#server
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnet-version
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnetmvc-version
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by
|
||||
delete_headers:
|
||||
- "Server"
|
||||
- "Via"
|
||||
- "X-AspNet-Version"
|
||||
- "X-AspNetMvc-Version"
|
||||
- "X-Powered-By"
|
||||
|
||||
custom_headers: {}
|
||||
# - name: <string>
|
||||
# value: <string>
|
||||
|
||||
# caddy-ratelimit
|
||||
rate_events: 1000
|
||||
rate_window: "1m"
|
||||
|
||||
# steffenbusch/caddy-bot-barrier
|
||||
bot_barrier: false
|
||||
|
||||
# corazawaf/coraza-caddy
|
||||
enable_crs: true
|
||||
crs_plugins: []
|
||||
log_only: false
|
||||
paranoia_level: 1
|
||||
detection_paranoia_level: null
|
||||
enforce_bodyproc_urlencoded: 1
|
||||
critical_anomaly_score: 5
|
||||
error_anomaly_score: 4
|
||||
warning_anomaly_score: 3
|
||||
notice_anomaly_score: 2
|
||||
inbound_anomaly_score_threshold: 5
|
||||
outbound_anomaly_score_threshold: 4
|
||||
reporting_level: 4
|
||||
max_num_args: 255
|
||||
arg_name_length: 100
|
||||
arg_length: 1000
|
||||
total_arg_length: 64000
|
||||
max_file_size: 10485760 # 10 Mo
|
||||
combined_file_sizes: 20970520 # 20 Mo
|
||||
sampling_percentage: 100
|
||||
allowed_methods:
|
||||
- "GET"
|
||||
- "HEAD"
|
||||
- "POST"
|
||||
- "OPTIONS"
|
||||
allowed_request_content_type:
|
||||
- "|application/csp-report|"
|
||||
- "|application/json|"
|
||||
- "|application/reports+json|"
|
||||
- "|application/soap+xml|"
|
||||
- "|application/x-www-form-urlencoded|"
|
||||
- "|application/xml|"
|
||||
- "|multipart/form-data|"
|
||||
- "|text/xml|"
|
||||
restricted_extensions:
|
||||
- ".ani/"
|
||||
- ".asa/"
|
||||
- ".asax/"
|
||||
- ".ascx/"
|
||||
- ".back/"
|
||||
- ".backup/"
|
||||
- ".bak/"
|
||||
- ".bat/"
|
||||
- ".bck/"
|
||||
- ".bk/"
|
||||
- ".bkp/"
|
||||
- ".cdx/"
|
||||
- ".cer/"
|
||||
- ".cfg/"
|
||||
- ".cmd/"
|
||||
- ".cnf/"
|
||||
- ".com/"
|
||||
- ".compositefont/"
|
||||
- ".conf/"
|
||||
- ".config/"
|
||||
- ".copy/"
|
||||
- ".crt/"
|
||||
- ".cs/"
|
||||
- ".csproj/"
|
||||
- ".csr/"
|
||||
- ".dat/"
|
||||
- ".db/"
|
||||
- ".dbf/"
|
||||
- ".dist/"
|
||||
- ".dll/"
|
||||
- ".dos/"
|
||||
- ".dpkg-dist/"
|
||||
- ".drv/"
|
||||
- ".gadget/"
|
||||
- ".hta/"
|
||||
- ".htr/"
|
||||
- ".htw/"
|
||||
- ".ida/"
|
||||
- ".idc/"
|
||||
- ".idq/"
|
||||
- ".inc/"
|
||||
- ".inf/"
|
||||
- ".ini/"
|
||||
- ".jse/"
|
||||
- ".key/"
|
||||
- ".licx/"
|
||||
- ".lnk/"
|
||||
- ".log/"
|
||||
- ".mdb/"
|
||||
- ".msc/"
|
||||
- ".ocx/"
|
||||
- ".old/"
|
||||
- ".pass/"
|
||||
- ".pdb/"
|
||||
- ".pem/"
|
||||
- ".pfx/"
|
||||
- ".pif/"
|
||||
- ".pol/"
|
||||
- ".prf/"
|
||||
- ".printer/"
|
||||
- ".pwd/"
|
||||
- ".rdb/"
|
||||
- ".rdp/"
|
||||
- ".reg/"
|
||||
- ".resources/"
|
||||
- ".resx/"
|
||||
- ".sav/"
|
||||
- ".save/"
|
||||
- ".scr/"
|
||||
- ".sct/"
|
||||
- ".sh/"
|
||||
- ".shs/"
|
||||
- ".sql/"
|
||||
- ".sqlite/"
|
||||
- ".sqlite3/"
|
||||
- ".swp/"
|
||||
- ".sys/"
|
||||
- ".temp/"
|
||||
- ".tlb/"
|
||||
- ".tmp/"
|
||||
- ".vb/"
|
||||
- ".vbe/"
|
||||
- ".vbproj/"
|
||||
- ".vbs/"
|
||||
- ".vsdisco/"
|
||||
- ".vxd/"
|
||||
- ".webinfo/"
|
||||
- ".ws/"
|
||||
- ".wsc/"
|
||||
- ".wsf/"
|
||||
- ".wsh/"
|
||||
- ".xsd/"
|
||||
- ".xsx/"
|
||||
restricted_headers_basic:
|
||||
- "/content-encoding/"
|
||||
- "/content-range/"
|
||||
- "/expect/"
|
||||
- "/if/"
|
||||
- "/lock-token/"
|
||||
- "/proxy/"
|
||||
- "/x-http-method-override/"
|
||||
- "/x-http-method/"
|
||||
- "/x-method-override/"
|
||||
- "/x-middleware-subrequest/"
|
||||
restricted_headers_extended:
|
||||
- "/accept-charset/"
|
||||
allowed_http_versions:
|
||||
- "HTTP/1.0"
|
||||
- "HTTP/1.1"
|
||||
- "HTTP/2"
|
||||
- "HTTP/2.0"
|
||||
- "HTTP/3"
|
||||
- "HTTP/3.0"
|
||||
allowed_request_content_type_charset:
|
||||
- "|utf-8|"
|
||||
- "|iso-8859-1|"
|
||||
- "|iso-8859-15|"
|
||||
- "|windows-1252|"
|
||||
71
roles/caddy/files/bot_barrier_template.html
Normal file
71
roles/caddy/files/bot_barrier_template.html
Normal file
@@ -0,0 +1,71 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Security Check</title>
|
||||
<style nonce="{{ .CSPNonce }}">
|
||||
html, body {
|
||||
height: 100%;
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
font-family: Arial, sans-serif;
|
||||
background-color: #f4f4f9;
|
||||
color: #333;
|
||||
|
||||
display: flex;
|
||||
justify-content: center;
|
||||
align-items: center;
|
||||
text-align: center;
|
||||
}
|
||||
|
||||
.wrapper {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
}
|
||||
|
||||
h1 {
|
||||
font-size: 2em;
|
||||
margin: 0.4em 0 0.3em;
|
||||
}
|
||||
|
||||
p {
|
||||
font-size: 1.2em;
|
||||
margin: 0.6em 0;
|
||||
}
|
||||
|
||||
.spinner {
|
||||
margin: 2em 0;
|
||||
width: 50px;
|
||||
height: 50px;
|
||||
border: 5px solid #ccc;
|
||||
border-top: 5px solid #333;
|
||||
border-radius: 50%;
|
||||
animation: spin 1s linear infinite;
|
||||
}
|
||||
|
||||
@keyframes spin {
|
||||
0% { transform: rotate(0deg); }
|
||||
100% { transform: rotate(360deg); }
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="wrapper">
|
||||
<!-- English Section -->
|
||||
<h1>Just a moment...</h1>
|
||||
<p>A small mathematical challenge is running<br>
|
||||
in the background - fully automatic to confirm<br>
|
||||
you're not a bot 🔒.</p>
|
||||
|
||||
<!-- Spinner -->
|
||||
<div class="spinner"></div>
|
||||
|
||||
<p>⏳ You'll be redirected shortly.</p>
|
||||
</div>
|
||||
|
||||
<script nonce="{{ .CSPNonce }}">{{ .Script }}</script>
|
||||
</body>
|
||||
</html>
|
||||
4
roles/caddy/handlers/main.yml
Normal file
4
roles/caddy/handlers/main.yml
Normal file
@@ -0,0 +1,4 @@
|
||||
- name: Restart Caddy
|
||||
ansible.builtin.service:
|
||||
name: "{{ caddy_system_user }}"
|
||||
state: "restarted"
|
||||
73
roles/caddy/tasks/caddy_config.yml
Normal file
73
roles/caddy/tasks/caddy_config.yml
Normal file
@@ -0,0 +1,73 @@
|
||||
- name: Create sites config directories
|
||||
loop: "{{ caddy_sites }}"
|
||||
ansible.builtin.file:
|
||||
path: "{{ caddy_config_dir }}/sites/{{ item.name }}"
|
||||
state: "directory"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0750"
|
||||
|
||||
- name: Generate sites coraza.conf config file
|
||||
loop: "{{ caddy_sites }}"
|
||||
loop_control:
|
||||
loop_var: "site"
|
||||
ansible.builtin.template:
|
||||
src: "templates/coraza.conf"
|
||||
dest: "{{ caddy_config_dir }}/sites/{{ site.name }}/coraza.conf"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Generate sites crs-setup config file
|
||||
loop: "{{ caddy_sites }}"
|
||||
loop_control:
|
||||
loop_var: "site"
|
||||
ansible.builtin.template:
|
||||
src: "templates/crs-setup.conf"
|
||||
dest: "{{ caddy_config_dir }}/sites/{{ site.name }}/crs-setup.conf"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Generate sites exclusions before request file
|
||||
loop: "{{ caddy_sites }}"
|
||||
loop_control:
|
||||
loop_var: "site"
|
||||
ansible.builtin.template:
|
||||
src: "templates/exclusions-request-before.conf"
|
||||
dest: "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-request-before.conf"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Generate sites exclusions after response file
|
||||
loop: "{{ caddy_sites }}"
|
||||
loop_control:
|
||||
loop_var: "site"
|
||||
ansible.builtin.template:
|
||||
src: "templates/exclusions-response-after.conf"
|
||||
dest: "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-response-after.conf"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Generate Caddyfile
|
||||
ansible.builtin.template:
|
||||
src: "templates/Caddyfile"
|
||||
dest: "{{ caddy_config_dir }}/Caddyfile"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Copy bot barrier template
|
||||
ansible.builtin.copy:
|
||||
src: "files/bot_barrier_template.html"
|
||||
dest: "{{ caddy_config_dir }}/bot_barrier_template.html"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0640"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
135
roles/caddy/tasks/caddy_install.yml
Normal file
135
roles/caddy/tasks/caddy_install.yml
Normal file
@@ -0,0 +1,135 @@
|
||||
- name: Remove packaged Go
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- "golang"
|
||||
state: "absent"
|
||||
autoremove: true
|
||||
purge: true
|
||||
|
||||
- name: Install requirements
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- "git"
|
||||
- "libnss3-tools"
|
||||
- "ssl-cert"
|
||||
|
||||
- name: Create Go directory
|
||||
ansible.builtin.file:
|
||||
path: "/usr/local/go-{{ caddy_go_version }}"
|
||||
state: "directory"
|
||||
mode: "0755"
|
||||
|
||||
- name: Install Go
|
||||
ansible.builtin.unarchive:
|
||||
src: "https://go.dev/dl/go{{ caddy_go_version }}.linux-amd64.tar.gz"
|
||||
dest: "/usr/local/go-{{ caddy_go_version }}"
|
||||
remote_src: true
|
||||
|
||||
- name: Link Go
|
||||
ansible.builtin.file:
|
||||
src: "/usr/local/go-{{ caddy_go_version }}/go/bin/go"
|
||||
dest: "/usr/local/bin/go"
|
||||
state: "link"
|
||||
|
||||
- name: Create xcaddy directory
|
||||
ansible.builtin.file:
|
||||
path: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
|
||||
state: "directory"
|
||||
mode: "0755"
|
||||
|
||||
- name: Install xcaddy
|
||||
ansible.builtin.unarchive:
|
||||
src: "{{ caddy_xcaddy_download }}/v{{ caddy_xcaddy_version }}/xcaddy_{{ caddy_xcaddy_version }}_linux_amd64.tar.gz"
|
||||
dest: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}"
|
||||
remote_src: true
|
||||
|
||||
- name: Link xcaddy
|
||||
ansible.builtin.file:
|
||||
src: "/usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy"
|
||||
dest: "/usr/local/bin/xcaddy"
|
||||
state: "link"
|
||||
|
||||
- name: Create Caddy build command
|
||||
ansible.builtin.set_fact:
|
||||
caddy_build_command: >
|
||||
xcaddy build v{{ caddy_caddy_version }}
|
||||
--with github.com/pteich/caddy-tlsconsul
|
||||
--with github.com/corazawaf/coraza-caddy/v2@v{{ caddy_coraza_caddy_version }}
|
||||
--with github.com/mholt/caddy-ratelimit
|
||||
--with github.com/steffenbusch/caddy-bot-barrier
|
||||
--output /usr/local/bin/caddy
|
||||
|
||||
- name: Test Caddy version
|
||||
ansible.builtin.copy:
|
||||
dest: "/usr/local/bin/.caddy.build"
|
||||
content: "{{ caddy_build_command }}"
|
||||
mode: "0644"
|
||||
register: caddy_test_caddy_version
|
||||
|
||||
- name: Build Caddy
|
||||
# noqa: no-handler
|
||||
when: "caddy_test_caddy_version.changed"
|
||||
ansible.builtin.command:
|
||||
cmd: "{{ caddy_build_command }}"
|
||||
creates: "/usr/local/bin/caddy"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Create Caddy system group
|
||||
ansible.builtin.group:
|
||||
name: "{{ caddy_system_group }}"
|
||||
system: true
|
||||
|
||||
- name: Create Caddy system user
|
||||
ansible.builtin.user:
|
||||
name: "{{ caddy_system_user }}"
|
||||
group: "{{ caddy_system_group }}"
|
||||
groups: ["ssl-cert"]
|
||||
password: "!"
|
||||
system: true
|
||||
home: "{{ caddy_home_dir }}"
|
||||
|
||||
- name: Create Caddy config directories
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: "directory"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0750"
|
||||
loop:
|
||||
- "{{ caddy_config_dir }}"
|
||||
- "{{ caddy_config_dir }}/crs-plugins"
|
||||
- "{{ caddy_config_dir }}/sites"
|
||||
|
||||
- name: Create Caddy log dir
|
||||
ansible.builtin.file:
|
||||
path: "{{ caddy_log_dir }}"
|
||||
state: "directory"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0770"
|
||||
|
||||
- name: Install OWASP CRS
|
||||
ansible.builtin.unarchive:
|
||||
src: "https://github.com/coreruleset/coreruleset/archive/refs/tags/v{{ caddy_owasp_crs_version }}.tar.gz"
|
||||
dest: "{{ caddy_config_dir }}"
|
||||
group: "{{ caddy_system_group }}"
|
||||
remote_src: true
|
||||
|
||||
- name: Install plugins
|
||||
loop: "{{ caddy_crs_plugins }}"
|
||||
loop_control:
|
||||
loop_var: "plugin"
|
||||
ansible.builtin.include_tasks: "plugin_install.yml"
|
||||
|
||||
- name: Deploy caddy service file
|
||||
ansible.builtin.template:
|
||||
src: "templates/caddy.service"
|
||||
dest: "/etc/systemd/system/{{ caddy_system_user }}.service"
|
||||
mode: "0644"
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Enable Caddy
|
||||
ansible.builtin.service:
|
||||
name: "{{ caddy_system_user }}"
|
||||
enabled: true
|
||||
daemon_reload: true
|
||||
6
roles/caddy/tasks/main.yml
Normal file
6
roles/caddy/tasks/main.yml
Normal file
@@ -0,0 +1,6 @@
|
||||
- name: Install Caddy
|
||||
when: "not(caddy_config_only)"
|
||||
ansible.builtin.include_tasks: "caddy_install.yml"
|
||||
|
||||
- name: Config Caddy
|
||||
ansible.builtin.include_tasks: "caddy_config.yml"
|
||||
55
roles/caddy/tasks/plugin_install.yml
Normal file
55
roles/caddy/tasks/plugin_install.yml
Normal file
@@ -0,0 +1,55 @@
|
||||
- name: Download plugin {{ plugin.name }}
|
||||
ansible.builtin.get_url:
|
||||
url: "https://github.com/{{ plugin.provider | default('coreruleset') }}/{{ plugin.name }}-plugin/archive/refs/tags/v{{ plugin.version }}.tar.gz"
|
||||
dest: "/usr/local/src/"
|
||||
mode: "0644"
|
||||
register: "caddy_plugin_downloaded"
|
||||
|
||||
- name: Deploy plugin {{ plugin.name }}
|
||||
# noqa: no-handler
|
||||
when: "caddy_plugin_downloaded.changed"
|
||||
block:
|
||||
|
||||
- name: Get temp dir {{ plugin.name }}
|
||||
ansible.builtin.tempfile:
|
||||
state: "directory"
|
||||
register: "caddy_temp_plugin_dir"
|
||||
|
||||
- name: Unarchive plugin {{ plugin.name }}
|
||||
ansible.builtin.unarchive:
|
||||
src: "/usr/local/src/{{ plugin.name }}-plugin-{{ plugin.version }}.tar.gz"
|
||||
dest: "{{ caddy_temp_plugin_dir.path }}"
|
||||
remote_src: true
|
||||
|
||||
- name: Copy plugin files {{ plugin.name }}
|
||||
ansible.builtin.copy:
|
||||
src: "{{ caddy_temp_plugin_dir.path }}/{{ plugin.name }}-plugin-{{ plugin.version }}/plugins/"
|
||||
dest: "{{ caddy_config_dir }}/crs-plugins/"
|
||||
mode: "0644"
|
||||
# directory_mode: "0750"
|
||||
group: "{{ caddy_system_group }}"
|
||||
remote_src: true
|
||||
notify:
|
||||
- "Restart Caddy"
|
||||
|
||||
- name: Create after config {{ plugin.name }}
|
||||
when: "not(plugin.has_after_config | default(false))"
|
||||
ansible.builtin.copy:
|
||||
content: ""
|
||||
dest: "{{ caddy_config_dir }}/crs-plugins/{{ plugin.name }}-after.conf"
|
||||
mode: "0644"
|
||||
group: "{{ caddy_system_group }}"
|
||||
|
||||
# FIXME: bad hack, why is it required?
|
||||
- name: Adjust plugins diretory permissions
|
||||
ansible.builtin.file:
|
||||
path: "{{ caddy_config_dir }}/crs-plugins"
|
||||
state: "directory"
|
||||
group: "{{ caddy_system_group }}"
|
||||
mode: "0750"
|
||||
|
||||
- name: Delete temp dir {{ plugin.name }}
|
||||
when: "caddy_temp_plugin_dir.path is defined"
|
||||
ansible.builtin.file:
|
||||
path: "{{ caddy_temp_plugin_dir.path }}"
|
||||
state: "absent"
|
||||
154
roles/caddy/templates/Caddyfile
Normal file
154
roles/caddy/templates/Caddyfile
Normal file
@@ -0,0 +1,154 @@
|
||||
{
|
||||
grace_period 10s
|
||||
order coraza_waf first
|
||||
{% if caddy_email | default(None) != None %}
|
||||
email "{{ caddy_email }}"
|
||||
{% endif %}
|
||||
|
||||
{% if caddy_ca_root | default(None) != None %}
|
||||
tls {
|
||||
ca_root "{{ caddy_ca_root }}"
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
log waf {
|
||||
format json
|
||||
include "http.handlers.waf"
|
||||
output file {{ caddy_log_dir }}/waf.log
|
||||
}
|
||||
{% if caddy_local_ca_name | default(None) != None %}
|
||||
|
||||
pki {
|
||||
ca local {
|
||||
name "{{ caddy_local_ca_name }}"
|
||||
}
|
||||
}
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
{% for site in caddy_sites %}
|
||||
{% if (site.redirect_from_aliases | default(true)) and (site.aliases | default([]) | length) > 0 %}
|
||||
{{ site.aliases | join(', ') }} {
|
||||
redir https://{{ site.site }}{uri}
|
||||
}
|
||||
|
||||
{% else %}
|
||||
{% for alias in site.aliases | default([]) %}
|
||||
{{ alias }},
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{{ site.site }} {
|
||||
encode gzip zstd
|
||||
|
||||
{% for path in site.paths %}
|
||||
handle {{ path.path | default('*') }} {
|
||||
reverse_proxy {
|
||||
to {{ path.addrs | join(' ') }}
|
||||
header_up X-Real-IP {remote}
|
||||
lb_policy ip_hash
|
||||
# Active checks
|
||||
# health_uri /
|
||||
# health_interval 10s
|
||||
# health_timeout 5s
|
||||
# health_status 200
|
||||
# Passive checks
|
||||
fail_duration 30s
|
||||
max_fails 3
|
||||
unhealthy_latency 2000ms
|
||||
transport http {
|
||||
# tls_server_name {host}
|
||||
# tls_insecure_skip_verify
|
||||
}
|
||||
}
|
||||
}
|
||||
{% endfor %}
|
||||
|
||||
{% if site.custom_cert | default (false) %}
|
||||
tls {{ site.custom_cert_file }} {{ site.custom_key_file }}
|
||||
|
||||
{% endif %}
|
||||
{% if site.blacklist | default([]) | length > 0 %}
|
||||
@blocked {
|
||||
{% for ip in site.blacklist | default([]) %}
|
||||
remote_ip {{ ip }}
|
||||
{% endfor %}
|
||||
}
|
||||
respond @blocked "Access Denied" 403
|
||||
|
||||
{% endif %}
|
||||
{% if site.bot_barrier | default (false) %}
|
||||
bot_barrier {
|
||||
secret {{ caddy_bot_barrier_secret }}
|
||||
complexity 18
|
||||
valid_for 30m
|
||||
seed_cookie_name __chall_{{ site.name }}_seed
|
||||
solution_cookie_name __chall_{{ site.name }}_solution
|
||||
mac_cookie_name __chall_{{ site.name }}_mac
|
||||
template {{ caddy_config_dir }}/bot_barrier_template.html
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
rate_limit {
|
||||
# distributed
|
||||
zone remote_ip {
|
||||
key {remote.ip}
|
||||
events {{ site.rate_events | default('1000') }}
|
||||
window {{ site.rate_window | default('1m') }}
|
||||
}
|
||||
}
|
||||
{% if site.enable_crs | default(caddy_waf_defaults.enable_crs) %}
|
||||
|
||||
coraza_waf {
|
||||
load_owasp_crs
|
||||
directives `
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/coraza.conf"
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/crs-setup.conf"
|
||||
{% for plugin in site.crs_plugins | default(caddy_waf_defaults.crs_plugins) %}
|
||||
Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-config.conf"
|
||||
Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-before.conf"
|
||||
{% endfor %}
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-request-before.conf"
|
||||
Include "{{ caddy_config_dir }}/coreruleset-{{ caddy_owasp_crs_version }}/rules/*.conf"
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-response-after.conf"
|
||||
{% for plugin in site.crs_plugins | default(caddy_waf_defaults.crs_plugins) %}
|
||||
Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-after.conf"
|
||||
{% endfor %}
|
||||
SecRuleEngine On
|
||||
`
|
||||
}
|
||||
{% endif %}
|
||||
|
||||
header {
|
||||
Content-Security-Policy "{{ caddy_waf_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
|
||||
Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_waf_defaults.header_cross_origin_embedder_policy) }}"
|
||||
Cross-Origin-Opener-Policy "{{ site.header_cross_origin_opener_policy | default(caddy_waf_defaults.header_cross_origin_opener_policy) }}"
|
||||
Cross-Origin-Resource-Policy "{{ site.header_cross_origin_resource_policy | default(caddy_waf_defaults.header_cross_origin_resource_policy) }}"
|
||||
Feature-Policy "{{ caddy_waf_defaults.header_feature_policy | combine(site.header_feature_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
|
||||
Permissions-Policy "{{ caddy_waf_defaults.header_permissions_policy | combine(site.header_permissions_policy | default({})) | dict2str(sep2=', ') }}"
|
||||
Referrer-Policy "{{ site.header_referrer_policy | default(caddy_waf_defaults.header_referrer_policy) }}"
|
||||
Strict-Transport-Security "{{ site.header_strict_transport_security | default(caddy_waf_defaults.header_strict_transport_security) }}"
|
||||
X-Content-Type-Options "{{ site.header_x_content_type_options | default(caddy_waf_defaults.header_x_content_type_options) }}"
|
||||
X-Frame-Options "{{ site.header_x_frame_options | default(caddy_waf_defaults.header_x_frame_options) }}"
|
||||
X-Robots-Tag "{{ site.header_x_robots_tag | default(caddy_waf_defaults.header_x_robots_tag) }}"
|
||||
?Content-Type "{{ site.default_content_type | default(caddy_waf_defaults.default_content_type) }}"
|
||||
>Set-Cookie "(.*)" "$1; {{ site.cookies_attributes | default(caddy_waf_defaults.cookies_attributes) }}"
|
||||
{% for header in site.delete_headers | default(caddy_waf_defaults.delete_headers) %}
|
||||
-{{ header }}
|
||||
{% endfor %}
|
||||
{% for header in site.custom_headers | default(caddy_waf_defaults.custom_headers) %}
|
||||
{{ header.name }} "{{ header.value }}"
|
||||
{% endfor %}
|
||||
}
|
||||
|
||||
handle_errors 403 {
|
||||
header X-Blocked "true"
|
||||
respond "Your request was blocked."
|
||||
}
|
||||
|
||||
log {
|
||||
format json
|
||||
output file {{ caddy_log_dir }}/site_{{ site.name }}.log
|
||||
}
|
||||
}
|
||||
|
||||
{% endfor %}
|
||||
20
roles/caddy/templates/caddy.service
Normal file
20
roles/caddy/templates/caddy.service
Normal file
@@ -0,0 +1,20 @@
|
||||
[Unit]
|
||||
Description=Caddy
|
||||
Documentation=https://caddyserver.com/docs/
|
||||
After=network.target network-online.target
|
||||
Requires=network-online.target
|
||||
|
||||
[Service]
|
||||
Type=notify
|
||||
User={{ caddy_system_user }}
|
||||
Group={{ caddy_system_group }}
|
||||
ExecStart=/usr/local/bin/caddy run --environ --config {{ caddy_config_dir }}/Caddyfile
|
||||
ExecReload=/usr/local/bin/caddy reload --config {{ caddy_config_dir }}/Caddyfile --force
|
||||
TimeoutStopSec=15s
|
||||
LimitNOFILE=1048576
|
||||
PrivateTmp=true
|
||||
ProtectSystem=full
|
||||
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
158
roles/caddy/templates/coraza.conf
Normal file
158
roles/caddy/templates/coraza.conf
Normal file
@@ -0,0 +1,158 @@
|
||||
# -- Rule engine initialization ----------------------------------------------
|
||||
|
||||
# Enable Coraza, attaching it to every transaction. Use detection
|
||||
# only to start with, because that minimises the chances of post-installation
|
||||
# disruption.
|
||||
SecRuleEngine DetectionOnly
|
||||
|
||||
|
||||
# -- Request body handling ---------------------------------------------------
|
||||
|
||||
# Allow Coraza to access request bodies. If you don't, Coraza
|
||||
# won't be able to see any POST parameters, which opens a large security
|
||||
# hole for attackers to exploit.
|
||||
SecRequestBodyAccess On
|
||||
|
||||
# Enable XML request body parser.
|
||||
# Initiate XML Processor in case of xml content-type
|
||||
SecRule REQUEST_HEADERS:Content-Type "^(?:application(?:/soap\+|/)|text/)xml" \
|
||||
"id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
|
||||
|
||||
# Enable JSON request body parser.
|
||||
# Initiate JSON Processor in case of JSON content-type; change accordingly
|
||||
# if your application does not use 'application/json'
|
||||
SecRule REQUEST_HEADERS:Content-Type "^application/json" \
|
||||
"id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
|
||||
|
||||
# Enable JSON request body parser for more subtypes.
|
||||
# Adapt this rule if you want to engage the JSON Processor for "+json" subtypes
|
||||
SecRule REQUEST_HEADERS:Content-Type "^application/[a-z0-9.-]+[+]json" \
|
||||
"id:'200006',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
|
||||
|
||||
# Maximum request body size we will accept for buffering. If you support
|
||||
# file uploads, this value must has to be as large as the largest file
|
||||
# you are willing to accept.
|
||||
SecRequestBodyLimit 13107200
|
||||
|
||||
# Maximum request body size that Coraza will store in memory. If the body
|
||||
# size exceeds this value, it will be saved to a temporary file on disk.
|
||||
SecRequestBodyInMemoryLimit 131072
|
||||
|
||||
# Maximum request body size we will accept for buffering, with files excluded.
|
||||
# You want to keep that value as low as practical.
|
||||
# Note: SecRequestBodyNoFilesLimit is currently NOT supported by Coraza
|
||||
# SecRequestBodyNoFilesLimit 131072
|
||||
|
||||
# What to do if the request body size is above our configured limit.
|
||||
# Keep in mind that this setting will automatically be set to ProcessPartial
|
||||
# when SecRuleEngine is set to DetectionOnly mode in order to minimize
|
||||
# disruptions when initially deploying Coraza.
|
||||
# Warning: Setting this directive to ProcessPartial introduces a potential bypass
|
||||
# risk, as attackers could prepend junk data equal to or greater than the inspected body size.
|
||||
SecRequestBodyLimitAction Reject
|
||||
|
||||
# Verify that we've correctly processed the request body.
|
||||
# As a rule of thumb, when failing to process a request body
|
||||
# you should reject the request (when deployed in blocking mode)
|
||||
# or log a high-severity alert (when deployed in detection-only mode).
|
||||
SecRule REQBODY_ERROR "!@eq 0" \
|
||||
"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
|
||||
|
||||
# By default be strict with what we accept in the multipart/form-data
|
||||
# request body. If the rule below proves to be too strict for your
|
||||
# environment consider changing it to detection-only.
|
||||
# Do NOT remove it, as it will catch many evasion attempts.
|
||||
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
|
||||
"id:'200003',phase:2,t:none,log,deny,status:400, \
|
||||
msg:'Multipart request body failed strict validation.'"
|
||||
|
||||
# -- Response body handling --------------------------------------------------
|
||||
|
||||
# Allow Coraza to access response bodies.
|
||||
# You should have this directive enabled in order to identify errors
|
||||
# and data leakage issues.
|
||||
# Do keep in mind that enabling this directive does increases both
|
||||
# memory consumption and response latency.
|
||||
SecResponseBodyAccess On
|
||||
|
||||
# Which response MIME types do you want to inspect? You should adjust the
|
||||
# configuration below to catch documents but avoid static files
|
||||
# (e.g., images and archives).
|
||||
SecResponseBodyMimeType text/plain text/html text/xml
|
||||
|
||||
# Buffer response bodies of up to 512 KB in length.
|
||||
SecResponseBodyLimit 524288
|
||||
|
||||
# What happens when we encounter a response body larger than the configured
|
||||
# limit? By default, we process what we have and let the rest through.
|
||||
# That's somewhat less secure, but does not break any legitimate pages.
|
||||
SecResponseBodyLimitAction ProcessPartial
|
||||
|
||||
|
||||
# -- Filesystem configuration ------------------------------------------------
|
||||
|
||||
# The location where Coraza will keep its persistent data. This default setting
|
||||
# is chosen due to all systems have /tmp available however, it
|
||||
# too should be updated to a place that other users can't access.
|
||||
SecDataDir /tmp/
|
||||
|
||||
|
||||
# -- File uploads handling configuration -------------------------------------
|
||||
|
||||
# The location where Coraza stores intercepted uploaded files. This
|
||||
# location must be private to Coraza. You don't want other users on
|
||||
# the server to access the files, do you?
|
||||
#SecUploadDir /opt/coraza/var/upload/
|
||||
|
||||
# If On, the WAF will store the uploaded files in the SecUploadDir
|
||||
# directory.
|
||||
# Note: SecUploadKeepFiles is currently NOT supported by Coraza
|
||||
#SecUploadKeepFiles Off
|
||||
|
||||
# Uploaded files are by default created with permissions that do not allow
|
||||
# any other user to access them. You may need to relax that if you want to
|
||||
# interface Coraza to an external program (e.g., an anti-virus).
|
||||
# Note: SecUploadFileMode is currently NOT supported by Coraza
|
||||
#SecUploadFileMode 0600
|
||||
|
||||
|
||||
# -- Debug log configuration -------------------------------------------------
|
||||
|
||||
# Default debug log path
|
||||
# Debug levels:
|
||||
# 0: No logging (least verbose)
|
||||
# 1: Error
|
||||
# 2: Warn
|
||||
# 3: Info
|
||||
# 4-8: Debug
|
||||
# 9: Trace (most verbose)
|
||||
SecDebugLog {{ caddy_log_dir }}/coraza-debug.log
|
||||
SecDebugLogLevel 4
|
||||
|
||||
|
||||
# -- Audit log configuration -------------------------------------------------
|
||||
|
||||
# Log the transactions that are marked by a rule, as well as those that
|
||||
# trigger a server error (determined by a 5xx or 4xx, excluding 404,
|
||||
# level response status codes).
|
||||
SecAuditEngine RelevantOnly
|
||||
SecAuditLogRelevantStatus "^(?:(5|4)(0|1)[0-9])$"
|
||||
|
||||
# Define which parts of the transaction are going to be recorded in the audit log
|
||||
SecAuditLogParts ABIJDEFHZ
|
||||
|
||||
# Use a single file for logging. This is much easier to look at, but
|
||||
# assumes that you will use the audit log only occasionally.
|
||||
SecAuditLogType Serial
|
||||
|
||||
# The format used to write the audit log.
|
||||
# Can be one of JSON|JsonLegacy|Native|OCSF
|
||||
SecAuditLogFormat JSON
|
||||
|
||||
# The following settings are not supported by Coraza
|
||||
# SecCookieFormat 0
|
||||
# SecArgumentSeparator &
|
||||
# SecRule MULTIPART_UNMATCHED_BOUNDARY "@eq 1" \
|
||||
# "id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
|
||||
# SecRule TX:/^COR_/ "!@streq 0" \
|
||||
# "id:'200005',phase:2,t:none,deny,msg:'Coraza internal error flagged: %{MATCHED_VAR_NAME}'"
|
||||
305
roles/caddy/templates/crs-setup.conf
Normal file
305
roles/caddy/templates/crs-setup.conf
Normal file
@@ -0,0 +1,305 @@
|
||||
## Log destination
|
||||
SecDefaultAction "phase:1,log,auditlog,pass"
|
||||
SecDefaultAction "phase:2,log,auditlog,pass"
|
||||
|
||||
## Paranoia level
|
||||
SecAction \
|
||||
"id:900000,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.blocking_paranoia_level={{ site.paranoia_level | default(caddy_waf_defaults.paranoia_level) }}"
|
||||
{% if site.detection_paranoia_level | default(caddy_waf_defaults.detection_paranoia_level) != None %}
|
||||
|
||||
## Detection paranoia level
|
||||
SecAction \
|
||||
"id:900001,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.detection_paranoia_level={{ site.detection_paranoia_level | default(caddy_waf_defaults.detection_paranoia_level) }}"
|
||||
{% endif %}
|
||||
|
||||
## Enforce Body Processor URLENCODED
|
||||
SecAction \
|
||||
"id:900010,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.enforce_bodyproc_urlencoded={{ site.enforce_bodyproc_urlencoded | default(caddy_waf_defaults.enforce_bodyproc_urlencoded) }}"
|
||||
|
||||
## Anomaly Scoring Mode Severity Levels
|
||||
SecAction \
|
||||
"id:900100,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.critical_anomaly_score={{ site.critical_anomaly_score | default(caddy_waf_defaults.critical_anomaly_score) }},\
|
||||
setvar:tx.error_anomaly_score={{ site.error_anomaly_score | default(caddy_waf_defaults.error_anomaly_score) }},\
|
||||
setvar:tx.warning_anomaly_score={{ site.warning_anomaly_score | default(caddy_waf_defaults.warning_anomaly_score) }},\
|
||||
setvar:tx.notice_anomaly_score={{ site.notice_anomaly_score | default(caddy_waf_defaults.notice_anomaly_score) }}"
|
||||
|
||||
## Anomaly Scoring Mode Blocking Threshold Levels
|
||||
SecAction \
|
||||
"id:900110,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.inbound_anomaly_score_threshold={% if site.log_only | default(caddy_waf_defaults.log_only) %}1000{% else %}{{ site.inbound_anomaly_score_threshold | default(caddy_waf_defaults.inbound_anomaly_score_threshold) }}{% endif %},\
|
||||
setvar:tx.outbound_anomaly_score_threshold={% if site.log_only | default(caddy_waf_defaults.log_only) %}1000{% else %}{{ site.outbound_anomaly_score_threshold | default(caddy_waf_defaults.outbound_anomaly_score_threshold) }}{% endif %}"
|
||||
|
||||
## Application Specific Rule Exclusions
|
||||
# FIXME
|
||||
# In CRS 4, these are no longer part of the CRS itself, but they are available
|
||||
# as "CRS plugins". Some plugins improve support for web applications, and others
|
||||
# may bring new functionality. Plugins are not installed by default, but can be
|
||||
# downloaded from the plugin registry:
|
||||
# https://github.com/coreruleset/plugin-registry
|
||||
# For detailed information about using and installing plugins, please see:
|
||||
# https://coreruleset.org/docs/concepts/plugins/
|
||||
|
||||
## Anomaly Score Reporting Level
|
||||
# 0 - Reporting disabled
|
||||
# 1 - Reporting for requests with a blocking anomaly score >= a threshold
|
||||
# 2 - Reporting for requests with a detection anomaly score >= a threshold
|
||||
# 3 - Reporting for requests with a blocking anomaly score greater than 0
|
||||
# 4 - Reporting for requests with a detection anomaly score greater than 0
|
||||
# 5 - Reporting for all requests
|
||||
SecAction \
|
||||
"id:900115,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.reporting_level={{ site.reporting_level | default(caddy_waf_defaults.reporting_level) }}"
|
||||
|
||||
## Early Anomaly Scoring Mode Blocking
|
||||
SecAction \
|
||||
"id:900120,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.early_blocking=0"
|
||||
|
||||
## Initialize Default Collections
|
||||
SecAction \
|
||||
"id:900130,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.enable_default_collections=1"
|
||||
|
||||
## HTTP Policy Settings
|
||||
SecAction \
|
||||
"id:900200,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.allowed_methods={{ site.allowed_methods | default(caddy_waf_defaults.allowed_methods) | join(" ") }}'"
|
||||
|
||||
## Content-Types that a client is allowed to send in a request
|
||||
SecAction \
|
||||
"id:900220,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.allowed_request_content_type={{ site.allowed_request_content_type | default(caddy_waf_defaults.allowed_request_content_type) | join(" ") }}'"
|
||||
|
||||
## Allowed HTTP versions
|
||||
SecAction \
|
||||
"id:900230,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.allowed_http_versions={{ site.allowed_http_versions | default(caddy_waf_defaults.allowed_http_versions) | join(" ") }}'"
|
||||
|
||||
## Forbidden file extensions
|
||||
SecAction \
|
||||
"id:900240,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.restricted_extensions={{ site.restricted_extensions | default(caddy_waf_defaults.restricted_extensions) | join(" ") }}'"
|
||||
|
||||
## Restricted request headers
|
||||
SecAction \
|
||||
"id:900250,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.restricted_headers_basic={{ site.restricted_headers_basic | default(caddy_waf_defaults.restricted_headers_basic) | join(" ") }}'"
|
||||
|
||||
## Extended restricted request headers (forbidden at a higher paranoia level)
|
||||
SecAction \
|
||||
"id:900255,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.restricted_headers_extended={{ site.restricted_headers_extended | default(caddy_waf_defaults.restricted_headers_extended) | join(" ") }}'"
|
||||
|
||||
## Content-Types charsets that a client is allowed to send in a request
|
||||
SecAction \
|
||||
"id:900280,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.allowed_request_content_type_charset={{ caddy_waf_defaults.allowed_request_content_type_charset | default(caddy_waf_defaults.allowed_request_content_type_charset) | join(" ") }}'"
|
||||
|
||||
## Block request if number of arguments is too high
|
||||
SecAction \
|
||||
"id:900300,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.max_num_args={{ site.max_num_args | default(caddy_waf_defaults.max_num_args) }}"
|
||||
|
||||
## Block request if the length of any argument name is too high
|
||||
SecAction \
|
||||
"id:900310,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.arg_name_length={{ site.arg_name_length | default(caddy_waf_defaults.arg_name_length) }}"
|
||||
|
||||
## Block request if the length of any argument value is too high
|
||||
SecAction \
|
||||
"id:900320,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.arg_length={{ site.arg_length | default(caddy_waf_defaults.arg_length) }}"
|
||||
|
||||
## Block request if the total length of all combined arguments is too high
|
||||
SecAction \
|
||||
"id:900330,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.total_arg_length={{ site.total_arg_length | default(caddy_waf_defaults.total_arg_length) }}"
|
||||
|
||||
## Block request if the file size of any individual uploaded file is too high
|
||||
SecAction \
|
||||
"id:900340,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.max_file_size={{ site.max_file_size | default(caddy_waf_defaults.max_file_size) }}"
|
||||
|
||||
## Block request if the total size of all combined uploaded files is too high
|
||||
SecAction \
|
||||
"id:900350,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.combined_file_sizes={{ site.combined_file_sizes | default(caddy_waf_defaults.combined_file_sizes) }}"
|
||||
|
||||
## Easing In / Sampling Percentage
|
||||
SecAction \
|
||||
"id:900400,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.sampling_percentage={{ site.sampling_percentage | default(caddy_waf_defaults.sampling_percentage) }}"
|
||||
|
||||
## Check UTF-8 encoding
|
||||
SecAction \
|
||||
"id:900950,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.crs_validate_utf8_encoding=1"
|
||||
|
||||
## Skip Checking Responses
|
||||
# CRS will perform analysis of the response contents if this is enabled and you have
|
||||
# the directive `SecResponseBodyAccess On`.
|
||||
# Warning: this feature is _enabled_ by default, but depending on your applications
|
||||
# you might be targeted in a Request Filter Denial of Service (RFDoS) attack.
|
||||
# References: https://blog.sicuranext.com/response-filter-denial-of-service-a-new-way-to-shutdown-a-website/
|
||||
# Uncomment this rule to _skip checking responses_.
|
||||
#SecAction \
|
||||
# "id:900500,\
|
||||
# phase:1,\
|
||||
# pass,\
|
||||
# t:none,\
|
||||
# nolog,\
|
||||
# tag:'OWASP_CRS',\
|
||||
# ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
# setvar:tx.crs_skip_response_analysis=1"
|
||||
|
||||
## End of setup
|
||||
SecAction \
|
||||
"id:900990,\
|
||||
phase:1,\
|
||||
pass,\
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.crs_setup_version={{ caddy_owasp_crs_version | regex_replace('\.', '') }}"
|
||||
3
roles/caddy/templates/exclusions-request-before.conf
Normal file
3
roles/caddy/templates/exclusions-request-before.conf
Normal file
@@ -0,0 +1,3 @@
|
||||
{% for exclusion in site.crs_exceptions.before_request | default([]) %}
|
||||
{{ exclusion }}
|
||||
{% endfor %}
|
||||
3
roles/caddy/templates/exclusions-response-after.conf
Normal file
3
roles/caddy/templates/exclusions-response-after.conf
Normal file
@@ -0,0 +1,3 @@
|
||||
{% for exclusion in site.crs_exceptions.after_response | default([]) %}
|
||||
{{ exclusion }}
|
||||
{% endfor %}
|
||||
1
roles/caddy/vars/main.yml
Normal file
1
roles/caddy/vars/main.yml
Normal file
@@ -0,0 +1 @@
|
||||
caddy_xcaddy_download: "https://github.com/caddyserver/xcaddy/releases/download"
|
||||
Reference in New Issue
Block a user