diff --git a/.gitignore b/.gitignore index 998d9a7..3f6153d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ +/notes/ .ansible/ __pycache__/ infra-*/ diff --git a/LICENSE.md b/LICENSE.md new file mode 100644 index 0000000..f269e6f --- /dev/null +++ b/LICENSE.md @@ -0,0 +1,30 @@ +Copyright (c) 2026 Sébastien Namèche (iTik). All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, this +list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, +this list of conditions and the following disclaimer in the documentation +and/or other materials provided with the distribution. + +3. All advertising materials mentioning features or use of this software must +display the following acknowledgement: +This product includes software developed by Sébastien Namèche (iTik). + +4. Neither the name of the copyright holder nor the names the copyright holder +nor the names of its contributors may be used to endorse or promote products +derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY COPYRIGHT HOLDER "AS IS" AND ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO +EVENT SHALL COPYRIGHT HOLDER BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, +PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER +IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) +ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. diff --git a/README.md b/README.md index 9d99142..dae6133 100644 --- a/README.md +++ b/README.md @@ -1,197 +1,5 @@ # BYOW - Build Your Own WAF -Ce rôle Ansible déploie un WAF basé sur Caddy, Coraza et les OWASP Core Security Rules. +A WAF _à la carte_. -## Principes - -### Go - -Caddy, Coraza, le module Coraza pour Caddy et l'outil `xcaddy` sont -développés avec le langage Go. - -L'outil `xcaddy` a besoin d'une version récente des outils de -développement Go. C'est pourquoi le rôle installe Go depuis -le site de téléchargement officiel et non via le gestionnaire -de paquets de la distribution Linux. - -Go est installé dans le répertoire `/usr/local/go-1.25.5/go` et -un lien symbolique est créé de `/usr/local/bin/go` vers -`/usr/local/go-1.25.5/go/bin/go`. - -### Caddy - -Caddy est un serveur Web et reverse proxy HTTP puissant et versatile. - -Étant développé en Go, son déploiement prend la forme d'un simble -binaire exécutable qui contient toutes les librairies requises. Ce -programme est construit avec l'outil `xcaddy` puis copié dans le -fichier `/usr/local/bin/caddy`. La ligne de commande utilisée pour -construire ce binaire est enregsitrée dans le fichier -`/usr/local/bin/.caddy.buil`. - -Le fichier de configuration de caddy utilise le format `Caddyfile`. -Il est généré automatiquement à partir des paramètres du rôle puis -enregistré sous `/etc/caddy/Caddyfile`. - -### Coraza - -Coraza est directement inclus dans le binaire `caddy` - -### Module Coraza pour Caddy - -### xcaddy - -qui permet de lier tous les modules Go requis -pour le WAF - -### Plugins OWASP CRS - -(À ne pas confondre avec les plugins Coraza.) - -Voir: https://github.com/coreruleset/plugin-registry - - - name: "drupal-rule-exclusions" - - name: "wordpress-rule-exclusions" - - name: "nextcloud-rule-exclusions" - - name: "dokuwiki-rule-exclusions" - - name: "phpmyadmin-rule-exclusions" - - name: "roundcube-rule-exclusions" - - name: "sogo-rule-exclusions" - - -## Paramètres du rôle Ansible - - - -## TODO - -Fonctionnalités déjà implémentées: - -- Déploiement et configuration avec Ansible -- Serveurs transient -- VIP (avec Keepalived) -- DNS dynamique (via Nomad) -- Cluster via Nomad -- OWASP CRS -- Multisite (avec configuration complète des CRS par site) -- Alias avec redirection optionnelle vers nom canonique -- Redirection HTTP vers HTTPS -- Certificats SSL (personnalisés automatiques via Let's Encrypt) -- Filtrage (blacklists) par: - - adresses IP - - réseaux IP -- Antibot par: - - défi JavaScript -- Passive backend checks -- Compression Gzip et zstd -- Mode détection sans blocage par les CRS -- Filtrage par: - - méthode HTTP -- En-têtes de sécurité: - - HSTS - - CSP - - X-Frame-Options - - X-Content-Type-Options - - Referrer Policy - - Permissions Policy - - Keep Headers - - Cookie Flags - - Custom headers - - suppression d'en-têtes -- Collecte des logs via OVH LDP - -Urgemment: - -- Connexion à consul, ACL consul -- Collection Ansible -- Revérifier gestion CORS -- Active backend checks -- Correction de la collecte des logs via OVH LDP - -Fomctionnalités à ajouter: - -- Rate limiting distribué -- Antibot par: - - Cookie - - Captcha - - reCAPTCHA - - hCaptcha - - Turnstile - - mCaptcha -- Filtrage par: - - rDNS - - DNSBL - - ASN - - User-Agent (robots, crawlers, IA bots) - - taille - - URI patterns - - pays - - (ip:danmeuk-tor-exit, ua:mitchellkrogza-bad-user-agents, /etc/hapee-1.9/blacklist.acl) -- Client cache -- Proxy cache -- Compression Brotli -- Reverse scan -- Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules) -- Gestion des sessions -- Whitelist -- Bad behavior (via Caddy events ?) -- Authentification -- Anti DDoS -- Greylist -- HTML injection -- Metrics (Elasticsearch + Metabase) -- Static files et FastCGI pour PHP (est-ce une bonne idée ?!) -- Crowdsec -- https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list - - -## Ressources - -- [Documentation officielle Caddy](https://caddyserver.com/docs/) -- [Site Officiel de Coraza](https://coraza.io) -- [Coraza WAF Caddy module](https://github.com/corazawaf/coraza-caddy) -- [Documentation AWOSP CRS](https://coreruleset.org/docs/) -- https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x) - -Modules -- []() -- []() - - -### Installation d'Ansible avec pipx - -1. Désinstaller *Ansible* et *ansible-lint* s'ils sont déjà installés. Par - exemple avec *Homebrew*: - ``` - brew uninstall ansible ansible-lint - ``` -1. Installer *pipx*. Par exemple avec *Homebrew*: - ``` - brew install pipx - ``` -1. Inscrire le chemin de recherche des exécutables de *pipx* dans les - scripts d'ouverture de session (fermer le shell et en ouvrir un nouveau - pour activer ce chemin de recherche): - ``` - pipx ensurepath - ``` -1. Installer *Ansible* (version 12, et au moins version core 2.16.9, pour - être compatible avec *Mitogen*) dans un environnement isolé (qui sera - nommé `ansible`) puis injecter *ansible-lint* et les librairies requises - dans cet environnement: - ``` - pipx install ansible==12.3.0 --include-deps - pipx inject ansible ansible-lint --include-apps - pipx inject ansible requests - pipx inject ansible pip-system-certs - pipx inject ansible passlib # pour |password_hash sur macOS (et autres) - pipx inject ansible jmespath # pour |query_result - pipx inject ansible pytz # pour plugin inventory auto - pipx inject ansible mitogen # optionnel, pour utiliser Mitogen - ``` -1. Vérifier l'environnement: - ``` - pipx list --include-injected - ansible --version -> ansible [core 2.19.5] - ansible-lint --version -> ansible-lint 26.1.1 - ``` +See [seb4itik/byow/README.md](seb4itik/byow/README.md) diff --git a/roles/caddy/.gitignore b/roles/caddy/.gitignore deleted file mode 100644 index 298c305..0000000 --- a/roles/caddy/.gitignore +++ /dev/null @@ -1 +0,0 @@ -/docs/ \ No newline at end of file diff --git a/roles/consul/notes.txt b/roles/consul/notes.txt deleted file mode 100644 index e8a040c..0000000 --- a/roles/consul/notes.txt +++ /dev/null @@ -1,62 +0,0 @@ -Security: -- Gossip protocol encryption -- Built-in ACL -- Consul agent communication -- mTLS for authentitication and encryption -- Certificate authority - - -FIXME: -- Ne fonctionne pas sous Debian 13 - - - "acl": { - "enabled": true, -{% if not consul_acl_bootstraped %} - "default_policy": "allow", -{% else %} - "default_policy": "deny", - "tokens": { - "agent": "FIXME" - }, -{% endif %} - "down_policy": "extend-cache" - }, - - -FIXME: -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.976+0300 [WARN] agent: bootstrap_expect > 0: expecting 3 servers -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead. -Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ca_file' field is deprecated. Use the 'tls.defaults.ca_file' field instead. -Jan 20 14:00:20 waf1 consul[3863]: 2026-01-20T14:00:20.983+0300 [WARN] agent.auto_config: bootstrap_expect > 0: expecting 3 servers -Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'cert_file' field is deprecated. Use the 'tls.defaults.cert_file' field instead. -Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'key_file' field is deprecated. Use the 'tls.defaults.key_file' field instead. -Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_incoming' field is deprecated. Use the 'tls.defaults.verify_incoming' field instead. -Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_outgoing' field is deprecated. Use the 'tls.defaults.verify_outgoing' field instead. -Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'verify_server_hostname' field is deprecated. Use the 'tls.internal_rpc.verify_server_hostname' field instead. -Jan 20 14:00:20 waf1 consul[3863]: agent.auto_config: The 'ui' field is deprecated. Use the 'ui_config.enabled' field instead. - - -FIXME: -Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/recordlabel -Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/artist -Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/album -Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v1/concept -Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/demo/v2/festival -Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/exportedservices -Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/namespaceexportedservices -Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/multicluster/v2/partitionexportedservices -Jan 20 15:32:40 waf1 consul[2072]: agent.http: Registered resource endpoint: endpoint=/api/internal/v1/tombstone diff --git a/roles/caddy/README.md b/seb4itik/byow/README.md similarity index 54% rename from roles/caddy/README.md rename to seb4itik/byow/README.md index b211142..aec5285 100644 --- a/roles/caddy/README.md +++ b/seb4itik/byow/README.md @@ -1,4 +1,6 @@ -# Web Application Firewall +# BYOW - Build Your Own WAF + +A WAF _à la carte_. Ce rôle Ansible déploie un WAF basé sur Caddy, Coraza et les OWASP Core Security Rules. @@ -67,50 +69,26 @@ Voir: https://github.com/coreruleset/plugin-registry Fonctionnalités déjà implémentées: -- Multisite (cavec configuration des CRS par site) -- Redirection vers nom canonique -- Rediction HTTP vers HTTPS -- Certificats SSL (autmotiques via Let's Encrypt et customs) +- Déploiement et configuration avec Ansible +- Serveurs transient +- VIP (avec Keepalived) +- DNS dynamique (via Nomad) +- Cluster via Nomad - OWASP CRS -- Redirect (SSL et www et autres) -- Filtrage par: +- Multisite (avec configuration complète des CRS par site) +- Alias avec redirection optionnelle vers nom canonique +- Redirection HTTP vers HTTPS +- Certificats SSL (personnalisés automatiques via Let's Encrypt) +- Filtrage (blacklists) par: - adresses IP - réseaux IP - Antibot par: - défi JavaScript - Passive backend checks -- Compression Gzip et zstd - - -Fomctionnalités à ajouter: - -- Active backend checks -- Antibot par: - - Cookie - - Captcha - - reCAPTCHA - - hCaptcha - - Turnstile - - mCaptcha -- Changement de format de configuration: Caddyfile -> JSON -- Mise en œuvre d'un cluster Redis (ou Consul) pour le partage de informations entre les WAF d'un cluster -- Mieux tester le configuration des CRS -- Mode détection sans blocage +- Compression Gzip et zstd +- Mode détection sans blocage par les CRS - Filtrage par: - - rDNS - - DNSBL - - ASN - - User-Agent (robots, crawlers, IA bots) - méthode HTTP - - taille - - URI patterns - - pays - - (ip:danmeuk-tor-exit, ua:mitchellkrogza-bad-user-agents, /etc/hapee-1.9/blacklist.acl) -- Gestion CORS -- Client cache -- Proxy cache -- Filtrage par pays -- Compression Brotli - En-têtes de sécurité: - HSTS - CSP @@ -121,17 +99,52 @@ Fomctionnalités à ajouter: - Keep Headers - Cookie Flags - Custom headers + - suppression d'en-têtes +- Collecte des logs via OVH LDP + +Urgemment: + +- Connexion à consul, ACL consul +- Collection Ansible +- Revérifier gestion CORS +- Active backend checks +- Correction de la collecte des logs via OVH LDP + +Fomctionnalités à ajouter: + +- Rate limiting distribué +- Antibot par: + - Cookie + - Captcha + - reCAPTCHA + - hCaptcha + - Turnstile + - mCaptcha +- Filtrage par: + - rDNS + - DNSBL + - ASN + - User-Agent (robots, crawlers, IA bots) + - taille + - URI patterns + - pays + - (ip:danmeuk-tor-exit, ua:mitchellkrogza-bad-user-agents, /etc/hapee-1.9/blacklist.acl) +- Client cache +- Proxy cache +- Compression Brotli - Reverse scan - Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules) -- Sessions +- Gestion des sessions - Whitelist -- Bad behavior -- Auth -- Anti DoDS +- Bad behavior (via Caddy events ?) +- Authentification +- Anti DDoS - Greylist - HTML injection - Metrics (Elasticsearch + Metabase) -- Static files et FastCGI pour PHP +- Static files et FastCGI pour PHP (est-ce une bonne idée ?!) +- Crowdsec +- https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list ## Ressources @@ -140,7 +153,47 @@ Fomctionnalités à ajouter: - [Site Officiel de Coraza](https://coraza.io) - [Coraza WAF Caddy module](https://github.com/corazawaf/coraza-caddy) - [Documentation AWOSP CRS](https://coreruleset.org/docs/) +- https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x) Modules - []() - []() + + +### Installation d'Ansible avec pipx + +1. Désinstaller *Ansible* et *ansible-lint* s'ils sont déjà installés. Par + exemple avec *Homebrew*: + ``` + brew uninstall ansible ansible-lint + ``` +1. Installer *pipx*. Par exemple avec *Homebrew*: + ``` + brew install pipx + ``` +1. Inscrire le chemin de recherche des exécutables de *pipx* dans les + scripts d'ouverture de session (fermer le shell et en ouvrir un nouveau + pour activer ce chemin de recherche): + ``` + pipx ensurepath + ``` +1. Installer *Ansible* (version 12, et au moins version core 2.16.9, pour + être compatible avec *Mitogen*) dans un environnement isolé (qui sera + nommé `ansible`) puis injecter *ansible-lint* et les librairies requises + dans cet environnement: + ``` + pipx install ansible==12.3.0 --include-deps + pipx inject ansible ansible-lint --include-apps + pipx inject ansible requests + pipx inject ansible pip-system-certs + pipx inject ansible passlib # pour |password_hash sur macOS (et autres) + pipx inject ansible jmespath # pour |query_result + pipx inject ansible pytz # pour plugin inventory auto + pipx inject ansible mitogen # optionnel, pour utiliser Mitogen + ``` +1. Vérifier l'environnement: + ``` + pipx list --include-injected + ansible --version -> ansible [core 2.19.5] + ansible-lint --version -> ansible-lint 26.1.1 + ``` diff --git a/seb4itik/byow/galaxy.yml b/seb4itik/byow/galaxy.yml new file mode 100644 index 0000000..e9ea74d --- /dev/null +++ b/seb4itik/byow/galaxy.yml @@ -0,0 +1,15 @@ +namespace: "seb4itik" +name: "byow" +version: "0.1.0" +readme: "README.md" +authors: +- "S. Namèche " +description: "Build Your Own WAF" +license: +- "BSD-4-Clause" +tags: ['waf'] +dependencies: {} +repository: "https://lab.itik.fr/itik/bgwaf" +documentation: "https://lab.itik.fr/itik/bgwaf/src/branch/main/README.md" +homepage: "https://lab.itik.fr/itik/bgwaf" +issues: "https://lab.itik.fr/itik/bgwaf/issues" diff --git a/seb4itik/byow/meta/runtime.yml b/seb4itik/byow/meta/runtime.yml new file mode 100644 index 0000000..3e3704b --- /dev/null +++ b/seb4itik/byow/meta/runtime.yml @@ -0,0 +1 @@ +requires_ansible: '>=2.19.5' diff --git a/seb4itik/byow/plugins/README.md b/seb4itik/byow/plugins/README.md new file mode 100644 index 0000000..74076b6 --- /dev/null +++ b/seb4itik/byow/plugins/README.md @@ -0,0 +1,31 @@ +# Collections Plugins Directory + +This directory can be used to ship various plugins inside an Ansible collection. Each plugin is placed in a folder that +is named after the type of plugin it is in. It can also include the `module_utils` and `modules` directory that +would contain module utils and modules respectively. + +Here is an example directory of the majority of plugins currently supported by Ansible: + +``` +└── plugins + ├── action + ├── become + ├── cache + ├── callback + ├── cliconf + ├── connection + ├── filter + ├── httpapi + ├── inventory + ├── lookup + ├── module_utils + ├── modules + ├── netconf + ├── shell + ├── strategy + ├── terminal + ├── test + └── vars +``` + +A full list of plugin types can be found at [Working With Plugins](https://docs.ansible.com/ansible-core/2.19/plugins/plugins.html). diff --git a/seb4itik/byow/roles/caddy/README.md b/seb4itik/byow/roles/caddy/README.md new file mode 100644 index 0000000..5e801db --- /dev/null +++ b/seb4itik/byow/roles/caddy/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## Caddy diff --git a/roles/caddy/defaults/main.yml b/seb4itik/byow/roles/caddy/defaults/main.yml similarity index 100% rename from roles/caddy/defaults/main.yml rename to seb4itik/byow/roles/caddy/defaults/main.yml diff --git a/roles/caddy/files/bot_barrier_template.html b/seb4itik/byow/roles/caddy/files/bot_barrier_template.html similarity index 100% rename from roles/caddy/files/bot_barrier_template.html rename to seb4itik/byow/roles/caddy/files/bot_barrier_template.html diff --git a/roles/caddy/filter_plugins/filters.py b/seb4itik/byow/roles/caddy/filter_plugins/filters.py similarity index 100% rename from roles/caddy/filter_plugins/filters.py rename to seb4itik/byow/roles/caddy/filter_plugins/filters.py diff --git a/roles/caddy/handlers/main.yml b/seb4itik/byow/roles/caddy/handlers/main.yml similarity index 100% rename from roles/caddy/handlers/main.yml rename to seb4itik/byow/roles/caddy/handlers/main.yml diff --git a/roles/caddy/tasks/caddy_config.yml b/seb4itik/byow/roles/caddy/tasks/caddy_config.yml similarity index 100% rename from roles/caddy/tasks/caddy_config.yml rename to seb4itik/byow/roles/caddy/tasks/caddy_config.yml diff --git a/roles/caddy/tasks/caddy_install.yml b/seb4itik/byow/roles/caddy/tasks/caddy_install.yml similarity index 100% rename from roles/caddy/tasks/caddy_install.yml rename to seb4itik/byow/roles/caddy/tasks/caddy_install.yml diff --git a/roles/caddy/tasks/main.yml b/seb4itik/byow/roles/caddy/tasks/main.yml similarity index 100% rename from roles/caddy/tasks/main.yml rename to seb4itik/byow/roles/caddy/tasks/main.yml diff --git a/roles/caddy/tasks/plugin_install.yml b/seb4itik/byow/roles/caddy/tasks/plugin_install.yml similarity index 100% rename from roles/caddy/tasks/plugin_install.yml rename to seb4itik/byow/roles/caddy/tasks/plugin_install.yml diff --git a/roles/caddy/templates/Caddyfile b/seb4itik/byow/roles/caddy/templates/Caddyfile similarity index 100% rename from roles/caddy/templates/Caddyfile rename to seb4itik/byow/roles/caddy/templates/Caddyfile diff --git a/roles/caddy/templates/caddy.service b/seb4itik/byow/roles/caddy/templates/caddy.service similarity index 100% rename from roles/caddy/templates/caddy.service rename to seb4itik/byow/roles/caddy/templates/caddy.service diff --git a/roles/caddy/templates/coraza.conf b/seb4itik/byow/roles/caddy/templates/coraza.conf similarity index 100% rename from roles/caddy/templates/coraza.conf rename to seb4itik/byow/roles/caddy/templates/coraza.conf diff --git a/roles/caddy/templates/crs-setup.conf b/seb4itik/byow/roles/caddy/templates/crs-setup.conf similarity index 100% rename from roles/caddy/templates/crs-setup.conf rename to seb4itik/byow/roles/caddy/templates/crs-setup.conf diff --git a/roles/caddy/templates/exclusions-request-before.conf b/seb4itik/byow/roles/caddy/templates/exclusions-request-before.conf similarity index 100% rename from roles/caddy/templates/exclusions-request-before.conf rename to seb4itik/byow/roles/caddy/templates/exclusions-request-before.conf diff --git a/roles/caddy/templates/exclusions-response-after.conf b/seb4itik/byow/roles/caddy/templates/exclusions-response-after.conf similarity index 100% rename from roles/caddy/templates/exclusions-response-after.conf rename to seb4itik/byow/roles/caddy/templates/exclusions-response-after.conf diff --git a/roles/caddy/vars/main.yml b/seb4itik/byow/roles/caddy/vars/main.yml similarity index 100% rename from roles/caddy/vars/main.yml rename to seb4itik/byow/roles/caddy/vars/main.yml diff --git a/seb4itik/byow/roles/common/README.md b/seb4itik/byow/roles/common/README.md new file mode 100644 index 0000000..ff975e7 --- /dev/null +++ b/seb4itik/byow/roles/common/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## Common diff --git a/roles/common/defaults/main.yml b/seb4itik/byow/roles/common/defaults/main.yml similarity index 100% rename from roles/common/defaults/main.yml rename to seb4itik/byow/roles/common/defaults/main.yml diff --git a/roles/common/tasks/main.yml b/seb4itik/byow/roles/common/tasks/main.yml similarity index 100% rename from roles/common/tasks/main.yml rename to seb4itik/byow/roles/common/tasks/main.yml diff --git a/roles/common/tasks/setup_packages.yml b/seb4itik/byow/roles/common/tasks/setup_packages.yml similarity index 100% rename from roles/common/tasks/setup_packages.yml rename to seb4itik/byow/roles/common/tasks/setup_packages.yml diff --git a/roles/common/tasks/setup_proxy_client.yml b/seb4itik/byow/roles/common/tasks/setup_proxy_client.yml similarity index 100% rename from roles/common/tasks/setup_proxy_client.yml rename to seb4itik/byow/roles/common/tasks/setup_proxy_client.yml diff --git a/roles/common/templates/apt_proxy.conf b/seb4itik/byow/roles/common/templates/apt_proxy.conf similarity index 100% rename from roles/common/templates/apt_proxy.conf rename to seb4itik/byow/roles/common/templates/apt_proxy.conf diff --git a/seb4itik/byow/roles/consul/README.md b/seb4itik/byow/roles/consul/README.md new file mode 100644 index 0000000..4b429ec --- /dev/null +++ b/seb4itik/byow/roles/consul/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## Consul diff --git a/roles/consul/defaults/main.yml b/seb4itik/byow/roles/consul/defaults/main.yml similarity index 100% rename from roles/consul/defaults/main.yml rename to seb4itik/byow/roles/consul/defaults/main.yml diff --git a/roles/consul/handlers/main.yml b/seb4itik/byow/roles/consul/handlers/main.yml similarity index 100% rename from roles/consul/handlers/main.yml rename to seb4itik/byow/roles/consul/handlers/main.yml diff --git a/roles/consul/tasks/main.yml b/seb4itik/byow/roles/consul/tasks/main.yml similarity index 100% rename from roles/consul/tasks/main.yml rename to seb4itik/byow/roles/consul/tasks/main.yml diff --git a/roles/consul/templates/config.json b/seb4itik/byow/roles/consul/templates/config.json similarity index 100% rename from roles/consul/templates/config.json rename to seb4itik/byow/roles/consul/templates/config.json diff --git a/roles/consul/templates/consul.service b/seb4itik/byow/roles/consul/templates/consul.service similarity index 100% rename from roles/consul/templates/consul.service rename to seb4itik/byow/roles/consul/templates/consul.service diff --git a/seb4itik/byow/roles/keepalived/README.md b/seb4itik/byow/roles/keepalived/README.md new file mode 100644 index 0000000..e61f8d7 --- /dev/null +++ b/seb4itik/byow/roles/keepalived/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## Keepalived diff --git a/roles/keepalived/defaults/main.yml b/seb4itik/byow/roles/keepalived/defaults/main.yml similarity index 100% rename from roles/keepalived/defaults/main.yml rename to seb4itik/byow/roles/keepalived/defaults/main.yml diff --git a/roles/keepalived/handlers/main.yml b/seb4itik/byow/roles/keepalived/handlers/main.yml similarity index 100% rename from roles/keepalived/handlers/main.yml rename to seb4itik/byow/roles/keepalived/handlers/main.yml diff --git a/roles/keepalived/tasks/main.yml b/seb4itik/byow/roles/keepalived/tasks/main.yml similarity index 100% rename from roles/keepalived/tasks/main.yml rename to seb4itik/byow/roles/keepalived/tasks/main.yml diff --git a/roles/keepalived/templates/keepalived.conf b/seb4itik/byow/roles/keepalived/templates/keepalived.conf similarity index 100% rename from roles/keepalived/templates/keepalived.conf rename to seb4itik/byow/roles/keepalived/templates/keepalived.conf diff --git a/seb4itik/byow/roles/local_ca/README.md b/seb4itik/byow/roles/local_ca/README.md new file mode 100644 index 0000000..5db9962 --- /dev/null +++ b/seb4itik/byow/roles/local_ca/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## Local CA diff --git a/roles/local_ca/defaults/main.yml b/seb4itik/byow/roles/local_ca/defaults/main.yml similarity index 100% rename from roles/local_ca/defaults/main.yml rename to seb4itik/byow/roles/local_ca/defaults/main.yml diff --git a/roles/local_ca/tasks/main.yml b/seb4itik/byow/roles/local_ca/tasks/main.yml similarity index 100% rename from roles/local_ca/tasks/main.yml rename to seb4itik/byow/roles/local_ca/tasks/main.yml diff --git a/seb4itik/byow/roles/local_ca_certs/README.md b/seb4itik/byow/roles/local_ca_certs/README.md new file mode 100644 index 0000000..153d0f9 --- /dev/null +++ b/seb4itik/byow/roles/local_ca_certs/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## Local CA certificates diff --git a/roles/local_ca_certs/defaults/main.yml b/seb4itik/byow/roles/local_ca_certs/defaults/main.yml similarity index 100% rename from roles/local_ca_certs/defaults/main.yml rename to seb4itik/byow/roles/local_ca_certs/defaults/main.yml diff --git a/roles/local_ca_certs/handlers/main.yml b/seb4itik/byow/roles/local_ca_certs/handlers/main.yml similarity index 100% rename from roles/local_ca_certs/handlers/main.yml rename to seb4itik/byow/roles/local_ca_certs/handlers/main.yml diff --git a/roles/local_ca_certs/tasks/create_cert.yml b/seb4itik/byow/roles/local_ca_certs/tasks/create_cert.yml similarity index 100% rename from roles/local_ca_certs/tasks/create_cert.yml rename to seb4itik/byow/roles/local_ca_certs/tasks/create_cert.yml diff --git a/roles/local_ca_certs/tasks/main.yml b/seb4itik/byow/roles/local_ca_certs/tasks/main.yml similarity index 100% rename from roles/local_ca_certs/tasks/main.yml rename to seb4itik/byow/roles/local_ca_certs/tasks/main.yml diff --git a/seb4itik/byow/roles/mysql/README.md b/seb4itik/byow/roles/mysql/README.md new file mode 100644 index 0000000..ce77f7f --- /dev/null +++ b/seb4itik/byow/roles/mysql/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## MySQL diff --git a/roles/mysql/defaults/main.yml b/seb4itik/byow/roles/mysql/defaults/main.yml similarity index 100% rename from roles/mysql/defaults/main.yml rename to seb4itik/byow/roles/mysql/defaults/main.yml diff --git a/roles/mysql/handlers/main.yml b/seb4itik/byow/roles/mysql/handlers/main.yml similarity index 100% rename from roles/mysql/handlers/main.yml rename to seb4itik/byow/roles/mysql/handlers/main.yml diff --git a/roles/mysql/tasks/main.yml b/seb4itik/byow/roles/mysql/tasks/main.yml similarity index 100% rename from roles/mysql/tasks/main.yml rename to seb4itik/byow/roles/mysql/tasks/main.yml diff --git a/seb4itik/byow/roles/nfs_client/README.md b/seb4itik/byow/roles/nfs_client/README.md new file mode 100644 index 0000000..95c1748 --- /dev/null +++ b/seb4itik/byow/roles/nfs_client/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## NFS client diff --git a/roles/nfs_client/defaults/main.yml b/seb4itik/byow/roles/nfs_client/defaults/main.yml similarity index 100% rename from roles/nfs_client/defaults/main.yml rename to seb4itik/byow/roles/nfs_client/defaults/main.yml diff --git a/roles/nfs_client/tasks/main.yml b/seb4itik/byow/roles/nfs_client/tasks/main.yml similarity index 100% rename from roles/nfs_client/tasks/main.yml rename to seb4itik/byow/roles/nfs_client/tasks/main.yml diff --git a/seb4itik/byow/roles/nfs_server/README.md b/seb4itik/byow/roles/nfs_server/README.md new file mode 100644 index 0000000..4de2fc1 --- /dev/null +++ b/seb4itik/byow/roles/nfs_server/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## NFS Server diff --git a/roles/nfs_server/defaults/main.yml b/seb4itik/byow/roles/nfs_server/defaults/main.yml similarity index 100% rename from roles/nfs_server/defaults/main.yml rename to seb4itik/byow/roles/nfs_server/defaults/main.yml diff --git a/roles/nfs_server/handlers/main.yml b/seb4itik/byow/roles/nfs_server/handlers/main.yml similarity index 100% rename from roles/nfs_server/handlers/main.yml rename to seb4itik/byow/roles/nfs_server/handlers/main.yml diff --git a/roles/nfs_server/tasks/main.yml b/seb4itik/byow/roles/nfs_server/tasks/main.yml similarity index 100% rename from roles/nfs_server/tasks/main.yml rename to seb4itik/byow/roles/nfs_server/tasks/main.yml diff --git a/roles/nfs_server/templates/exports b/seb4itik/byow/roles/nfs_server/templates/exports similarity index 100% rename from roles/nfs_server/templates/exports rename to seb4itik/byow/roles/nfs_server/templates/exports diff --git a/seb4itik/byow/roles/ovh_ldp/README.md b/seb4itik/byow/roles/ovh_ldp/README.md new file mode 100644 index 0000000..1dd2e2d --- /dev/null +++ b/seb4itik/byow/roles/ovh_ldp/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## OVH Log Data Platform diff --git a/roles/ovh_ldp/defaults/main.yml b/seb4itik/byow/roles/ovh_ldp/defaults/main.yml similarity index 100% rename from roles/ovh_ldp/defaults/main.yml rename to seb4itik/byow/roles/ovh_ldp/defaults/main.yml diff --git a/roles/ovh_ldp/handlers/main.yml b/seb4itik/byow/roles/ovh_ldp/handlers/main.yml similarity index 100% rename from roles/ovh_ldp/handlers/main.yml rename to seb4itik/byow/roles/ovh_ldp/handlers/main.yml diff --git a/roles/ovh_ldp/tasks/main.yml b/seb4itik/byow/roles/ovh_ldp/tasks/main.yml similarity index 100% rename from roles/ovh_ldp/tasks/main.yml rename to seb4itik/byow/roles/ovh_ldp/tasks/main.yml diff --git a/roles/ovh_ldp/templates/ldp-ovh.conf b/seb4itik/byow/roles/ovh_ldp/templates/ldp-ovh.conf similarity index 100% rename from roles/ovh_ldp/templates/ldp-ovh.conf rename to seb4itik/byow/roles/ovh_ldp/templates/ldp-ovh.conf diff --git a/seb4itik/byow/roles/unbound/README.md b/seb4itik/byow/roles/unbound/README.md new file mode 100644 index 0000000..8ac12cc --- /dev/null +++ b/seb4itik/byow/roles/unbound/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## Unbound diff --git a/roles/unbound/defaults/main.yml b/seb4itik/byow/roles/unbound/defaults/main.yml similarity index 100% rename from roles/unbound/defaults/main.yml rename to seb4itik/byow/roles/unbound/defaults/main.yml diff --git a/roles/unbound/handlers/main.yml b/seb4itik/byow/roles/unbound/handlers/main.yml similarity index 100% rename from roles/unbound/handlers/main.yml rename to seb4itik/byow/roles/unbound/handlers/main.yml diff --git a/roles/unbound/tasks/main.yml b/seb4itik/byow/roles/unbound/tasks/main.yml similarity index 100% rename from roles/unbound/tasks/main.yml rename to seb4itik/byow/roles/unbound/tasks/main.yml diff --git a/roles/unbound/templates/unbound.conf b/seb4itik/byow/roles/unbound/templates/unbound.conf similarity index 100% rename from roles/unbound/templates/unbound.conf rename to seb4itik/byow/roles/unbound/templates/unbound.conf diff --git a/seb4itik/byow/roles/wordpress/README.md b/seb4itik/byow/roles/wordpress/README.md new file mode 100644 index 0000000..4e64afb --- /dev/null +++ b/seb4itik/byow/roles/wordpress/README.md @@ -0,0 +1,5 @@ +# BYOW - Build Your Own WAF + +A WAF _à la carte_. + +## Wordpress diff --git a/roles/wordpress/defaults/main.yml b/seb4itik/byow/roles/wordpress/defaults/main.yml similarity index 100% rename from roles/wordpress/defaults/main.yml rename to seb4itik/byow/roles/wordpress/defaults/main.yml diff --git a/roles/wordpress/handlers/main.yml b/seb4itik/byow/roles/wordpress/handlers/main.yml similarity index 100% rename from roles/wordpress/handlers/main.yml rename to seb4itik/byow/roles/wordpress/handlers/main.yml diff --git a/roles/wordpress/tasks/install_plugins.yml b/seb4itik/byow/roles/wordpress/tasks/install_plugins.yml similarity index 100% rename from roles/wordpress/tasks/install_plugins.yml rename to seb4itik/byow/roles/wordpress/tasks/install_plugins.yml diff --git a/roles/wordpress/tasks/main.yml b/seb4itik/byow/roles/wordpress/tasks/main.yml similarity index 100% rename from roles/wordpress/tasks/main.yml rename to seb4itik/byow/roles/wordpress/tasks/main.yml diff --git a/roles/wordpress/templates/nginx_vhost.conf b/seb4itik/byow/roles/wordpress/templates/nginx_vhost.conf similarity index 100% rename from roles/wordpress/templates/nginx_vhost.conf rename to seb4itik/byow/roles/wordpress/templates/nginx_vhost.conf diff --git a/seb4itik/byow/seb4itik-byow-0.1.0.tar.gz b/seb4itik/byow/seb4itik-byow-0.1.0.tar.gz new file mode 100644 index 0000000..b39e09d Binary files /dev/null and b/seb4itik/byow/seb4itik-byow-0.1.0.tar.gz differ