WIP

.gitignore

@@ -1,3 +1,4 @@
 .ansible/
 __pycache__/
+infra-*/
 .DS_Store

README.md

@@ -134,7 +134,7 @@ Fomctionnalités à ajouter:
 - Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules)
 - Gestion des sessions
 - Whitelist
-- Bad behavior
+- Bad behavior (via Caddy events ?)
 - Authentification
 - Anti DDoS
 - Greylist
@@ -156,3 +156,42 @@ Fomctionnalités à ajouter:
 Modules
 - []()
 - []()
+
+
+### Installation d'Ansible avec pipx
+
+1. Désinstaller *Ansible* et *ansible-lint* s'ils sont déjà installés. Par
+  exemple avec *Homebrew*:
+    ```
+    brew uninstall ansible ansible-lint
+    ```
+1. Installer *pipx*. Par exemple avec *Homebrew*:
+    ```
+    brew install pipx
+    ```
+1. Inscrire le chemin de recherche des exécutables de *pipx* dans les
+  scripts d'ouverture de session (fermer le shell et en ouvrir un nouveau
+  pour activer ce chemin de recherche):
+    ```
+    pipx ensurepath
+    ```
+1. Installer *Ansible* (version 12, et au moins version core 2.16.9, pour
+   être compatible avec *Mitogen*) dans un environnement isolé (qui sera
+   nommé `ansible`) puis injecter *ansible-lint* et les librairies requises
+   dans cet environnement: 
+    ```
+    pipx install ansible==12.3.0 --include-deps
+    pipx inject ansible ansible-lint --include-apps
+    pipx inject ansible requests
+    pipx inject ansible pip-system-certs
+    pipx inject ansible passlib    # pour |password_hash sur macOS (et autres)
+    pipx inject ansible jmespath   # pour |query_result
+    pipx inject ansible pytz       # pour plugin inventory auto
+    pipx inject ansible mitogen    # optionnel, pour utiliser Mitogen
+    ```
+1. Vérifier l'environnement:
+    ```
+    pipx list --include-injected
+    ansible --version       -> ansible [core 2.19.5]
+    ansible-lint --version  -> ansible-lint 26.1.1
+    ```

ansible/README.md

@@ -1,37 +0,0 @@
-### Installation d'Ansible avec pipx
-
-1. Désinstaller *Ansible* et *ansible-lint* s'ils sont déjà installés. Par
-  exemple avec *Homebrew*:
-    ```
-    brew uninstall ansible ansible-lint
-    ```
-1. Installer *pipx*. Par exemple avec *Homebrew*:
-    ```
-    brew install pipx
-    ```
-1. Inscrire le chemin de recherche des exécutables de *pipx* dans les
-  scripts d'ouverture de session (fermer le shell et en ouvrir un nouveau
-  pour activer ce chemin de recherche):
-    ```
-    pipx ensurepath
-    ```
-1. Installer *Ansible* (version 12, et au moins version core 2.16.9, pour
-   être compatible avec *Mitogen*) dans un environnement isolé (qui sera
-   nommé `ansible`) puis injecter *ansible-lint* et les librairies requises
-   dans cet environnement: 
-    ```
-    pipx install ansible==12.3.0 --include-deps
-    pipx inject ansible ansible-lint --include-apps
-    pipx inject ansible requests
-    pipx inject ansible pip-system-certs
-    pipx inject ansible passlib    # pour |password_hash sur macOS (et autres)
-    pipx inject ansible jmespath   # pour |query_result
-    pipx inject ansible pytz       # pour plugin inventory auto
-    pipx inject ansible mitogen    # optionnel, pour utiliser Mitogen
-    ```
-1. Vérifier l'environnement:
-    ```
-    pipx list --include-injected
-    ansible --version       -> ansible [core 2.19.5]
-    ansible-lint --version  -> ansible-lint 26.1.1
-    ```

example/ansible/filter_plugins

@@ -0,0 +1 @@
+../../filter_plugins

example/ansible/inventory/groups.yml

@@ -18,7 +18,7 @@ waf:
 
 mysql:
   hosts:
-    mysql1:
+    sql1:
 
 nfs:
   hosts:

example/ansible/play-main.yml

@@ -75,7 +75,7 @@
       - name: "www"
         port: 443
         check_http: "http://{{ ansible_default_ipv4.address }}:80/"
-#   keepalived_script_user: "caddy"
+#   keepalived_script_user: "byow"
 #   keepalived_monitored_process: "caddy"
 #   keepalived_vrrp_password: "{{ secrets.keepalived.secret }}"
 #   keepalived_vrrp_ips:
@@ -208,7 +208,7 @@
     wordpress_admin_email: "seb@itik.fr"
     wordpress_themes: ["twentytwentyfive"]
     wordpress_active_theme: "twentytwentyfive"
-    wordpress_db_host: "mysql1"
+    wordpress_db_host: "sql1"
     wordpress_db_pass: "{{ secrets.wordpress.mysql_password }}"
     consul_domain: "{{ common.consul.domain }}"
     consul_datacenter: "{{ common.consul.datacenter }}"

example/ansible/roles

@@ -0,0 +1 @@
+../../roles

example/tofu/.gitignore

@@ -0,0 +1,5 @@
+.terraform/
+.terraform.lock.hcl
+.terraform.tfstate.lock.info
+terraform.tfstate
+terraform.tfstate.backup

example/tofu/infra.auto.tfvars

@@ -0,0 +1,10 @@
+vms = {
+  waf1 = {},
+  waf2 = {},
+  waf3 = {},
+  sql1 = {},
+  nfs1 = {},
+  www1 = {},
+  www2 = {},
+  www3 = {},
+}

example/tofu/variables.tf

@@ -2,8 +2,8 @@ variable "vms" {
   description = "Liste des machines virtuelles"
   type = map(object({
     cpus   = optional(number, 2),
-    memory = optional(string, "2g"),
+    memory = optional(string, "3g"),
     disk   = optional(string, "12g"),
-    image  = optional(string, "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2"),
+    image  = optional(string, "24.04"),
   }))
 }

roles/caddy/defaults/main.yml

@@ -231,15 +231,15 @@ caddy_waf_defaults:
   # FIXME
 
   # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#server
-  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by
   # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnet-version
   # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnetmvc-version
+  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by
   delete_headers:
     - "Server"
-    - "X-Powered-By"
+    - "Via"
     - "X-AspNet-Version"
     - "X-AspNetMvc-Version"
-    - "Via"
+    - "X-Powered-By"
 
   custom_headers: {}
 #   - name: <string>
@@ -253,6 +253,7 @@ caddy_waf_defaults:
   bot_barrier: false
 
   # corazawaf/coraza-caddy
+  enable_crs: true
   crs_plugins: []
   log_only: false
   paranoia_level: 1
@@ -278,14 +279,14 @@ caddy_waf_defaults:
     - "POST"
     - "OPTIONS"
   allowed_request_content_type:
-    - "|application/x-www-form-urlencoded|"
+    - "|application/csp-report|"
-    - "|multipart/form-data|"
-    - "|text/xml|"
-    - "|application/xml|"
-    - "|application/soap+xml|"
     - "|application/json|"
     - "|application/reports+json|"
-    - "|application/csp-report|"
+    - "|application/soap+xml|"
+    - "|application/x-www-form-urlencoded|"
+    - "|application/xml|"
+    - "|multipart/form-data|"
+    - "|text/xml|"
   restricted_extensions:
     - ".ani/"
     - ".asa/"
@@ -294,10 +295,10 @@ caddy_waf_defaults:
     - ".back/"
     - ".backup/"
     - ".bak/"
+    - ".bat/"
     - ".bck/"
     - ".bk/"
     - ".bkp/"
-    - ".bat/"
     - ".cdx/"
     - ".cer/"
     - ".cfg/"
@@ -305,8 +306,8 @@ caddy_waf_defaults:
     - ".cnf/"
     - ".com/"
     - ".compositefont/"
-    - ".config/"
     - ".conf/"
+    - ".config/"
     - ".copy/"
     - ".crt/"
     - ".cs/"
@@ -341,9 +342,9 @@ caddy_waf_defaults:
     - ".old/"
     - ".pass/"
     - ".pdb/"
+    - ".pem/"
     - ".pfx/"
     - ".pif/"
-    - ".pem/"
     - ".pol/"
     - ".prf/"
     - ".printer/"
@@ -369,8 +370,8 @@ caddy_waf_defaults:
     - ".tmp/"
     - ".vb/"
     - ".vbe/"
-    - ".vbs/"
     - ".vbproj/"
+    - ".vbs/"
     - ".vsdisco/"
     - ".vxd/"
     - ".webinfo/"
@@ -382,15 +383,15 @@ caddy_waf_defaults:
     - ".xsx/"
   restricted_headers_basic:
     - "/content-encoding/"
-    - "/proxy/"
-    - "/lock-token/"
     - "/content-range/"
+    - "/expect/"
     - "/if/"
+    - "/lock-token/"
+    - "/proxy/"
     - "/x-http-method-override/"
     - "/x-http-method/"
     - "/x-method-override/"
     - "/x-middleware-subrequest/"
-    - "/expect/"
   restricted_headers_extended:
     - "/accept-charset/"
   allowed_http_versions:

roles/caddy/templates/Caddyfile

@@ -14,7 +14,7 @@
   log waf {
     format json
     include "http.handlers.waf"
-    output stdout
+    output file {{ caddy_log_dir }}/waf.log
   }
 {% if caddy_local_ca_name | default(None) != None %}
 
@@ -96,6 +96,7 @@
       window {{ site.rate_window | default('1m') }}
     }
   }
+{% if site.enable_crs | default(caddy_waf_defaults.enable_crs) %}
 
   coraza_waf {
     load_owasp_crs
@@ -115,6 +116,7 @@
       SecRuleEngine On
     `
   }
+{% endif %}
 
   header {
     Content-Security-Policy      "{{ caddy_waf_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"

roles/caddy/templates/crs-setup.conf

@@ -123,7 +123,7 @@ SecAction \
     ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
     setvar:'tx.allowed_methods={{ site.allowed_methods | default(caddy_waf_defaults.allowed_methods) | join(" ") }}'"
 
-# Content-Types that a client is allowed to send in a request
+## Content-Types that a client is allowed to send in a request
 SecAction \
     "id:900220,\
     phase:1,\
@@ -178,7 +178,7 @@ SecAction \
     ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
     setvar:'tx.restricted_headers_extended={{ site.restricted_headers_extended | default(caddy_waf_defaults.restricted_headers_extended) | join(" ") }}'"
 
-# Content-Types charsets that a client is allowed to send in a request
+## Content-Types charsets that a client is allowed to send in a request
 SecAction \
     "id:900280,\
     phase:1,\
@@ -189,7 +189,7 @@ SecAction \
     ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
     setvar:'tx.allowed_request_content_type_charset={{ caddy_waf_defaults.allowed_request_content_type_charset | default(caddy_waf_defaults.allowed_request_content_type_charset) | join(" ") }}'"
 
-# Block request if number of arguments is too high
+## Block request if number of arguments is too high
 SecAction \
     "id:900300,\
     phase:1,\
@@ -200,7 +200,7 @@ SecAction \
     ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
     setvar:tx.max_num_args={{ site.max_num_args | default(caddy_waf_defaults.max_num_args) }}"
 
-# Block request if the length of any argument name is too high
+## Block request if the length of any argument name is too high
 SecAction \
     "id:900310,\
     phase:1,\
@@ -211,7 +211,7 @@ SecAction \
     ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
     setvar:tx.arg_name_length={{ site.arg_name_length | default(caddy_waf_defaults.arg_name_length) }}"
 
-# Block request if the length of any argument value is too high
+## Block request if the length of any argument value is too high
 SecAction \
     "id:900320,\
     phase:1,\
@@ -222,7 +222,7 @@ SecAction \
     ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
     setvar:tx.arg_length={{ site.arg_length | default(caddy_waf_defaults.arg_length) }}"
 
-# Block request if the total length of all combined arguments is too high
+## Block request if the total length of all combined arguments is too high
 SecAction \
     "id:900330,\
     phase:1,\
@@ -233,7 +233,7 @@ SecAction \
     ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
     setvar:tx.total_arg_length={{ site.total_arg_length | default(caddy_waf_defaults.total_arg_length) }}"
 
-# Block request if the file size of any individual uploaded file is too high
+## Block request if the file size of any individual uploaded file is too high
 SecAction \
     "id:900340,\
     phase:1,\
@@ -244,7 +244,7 @@ SecAction \
     ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
     setvar:tx.max_file_size={{ site.max_file_size | default(caddy_waf_defaults.max_file_size) }}"
 
-# Block request if the total size of all combined uploaded files is too high
+## Block request if the total size of all combined uploaded files is too high
 SecAction \
     "id:900350,\
     phase:1,\

roles/consul/notes.txt

@@ -6,6 +6,10 @@ Security:
 - Certificate authority
 
 
+FIXME:
+- Ne fonctionne pas sous Debian 13
+
+
   "acl": {
     "enabled": true,
 {% if not consul_acl_bootstraped %}
@@ -44,3 +48,15 @@ Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_incoming' fiel
 Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead.
 Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead.
 Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead.
+
+
+FIXME:
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/recordlabel
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/artist
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/album
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/concept
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v2/festival
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/exportedservices
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/namespaceexportedservices
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/partitionexportedservices
+Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/internal/v1/tombstone

roles/consul/tasks/main.yml

@@ -3,6 +3,7 @@
     name:
       - "unzip"
 
+ # Not required for Ubuntu 24, was a test for Debian 13
 - name: Disable IPv6 on all interfaces
   ansible.posix.sysctl:
     name: "net.ipv6.conf.all.disable_ipv6"

tofu/.gitignore

@@ -1,4 +0,0 @@
-/.terraform/
-/.terraform.lock.hcl
-terraform.tfstate
-terraform.tfstate.backup

tofu/infra.auto.tfvars

@@ -1,10 +0,0 @@
-vms = {
-  waf1   = {},
-  waf2   = {},
-  waf3   = {},
-  mysql1 = {},
-  nfs1   = {},
-  www1   = {},
-  www2   = {},
-  www3   = {},
-}