caddy: refact variables name, global options, add caddy_my_name
This commit is contained in:
@@ -1,16 +1,28 @@
|
||||
# Defaults
|
||||
caddy_config_only: false
|
||||
caddy_debug: false
|
||||
caddy_go_version: "1.25.5"
|
||||
caddy_http_port: 80
|
||||
caddy_https_port: 443
|
||||
caddy_default_bind: ""
|
||||
|
||||
caddy_version: "2.10.2"
|
||||
caddy_go_version: "1.25.6"
|
||||
caddy_xcaddy_version: "0.4.5"
|
||||
caddy_caddy_version: "2.10.2"
|
||||
caddy_coraza_caddy_version: "2.1.0" # Coraza v3.3.3
|
||||
caddy_owasp_crs_version: "4.22.0"
|
||||
caddy_system_user: "byow"
|
||||
caddy_system_group: "byow"
|
||||
caddy_home_dir: "/opt/{{ caddy_system_user }}"
|
||||
caddy_config_dir: "/etc/{{ caddy_system_user }}"
|
||||
caddy_log_dir: "/var/log/{{ caddy_system_user }}"
|
||||
caddy_owasp_crs_versions: ["4.22.0"]
|
||||
|
||||
caddy_my_name: "mywaf"
|
||||
caddy_system_user: "{{ caddy_my_name }}"
|
||||
caddy_system_group: "{{ caddy_my_name }}"
|
||||
caddy_home_dir: "/opt/{{ caddy_my_name }}"
|
||||
caddy_config_dir: "/etc/{{ caddy_my_name }}"
|
||||
caddy_log_dir: "/var/log/{{ caddy_my_name }}"
|
||||
|
||||
# Required for Let's Encrypt auto certificates
|
||||
caddy_email: null
|
||||
|
||||
# If a custom CA root have to be used
|
||||
caddy_ca_root: null
|
||||
|
||||
# Cf.: https://github.com/coreruleset/plugin-registry
|
||||
caddy_crs_plugins:
|
||||
@@ -32,378 +44,16 @@ caddy_crs_plugins:
|
||||
version: "1.0.4"
|
||||
provider: "EsadCetiner"
|
||||
|
||||
# Required unless not site.custom_cert
|
||||
caddy_email: null
|
||||
|
||||
# Required if site.bot_barrier
|
||||
caddy_bot_barrier_secret: null
|
||||
|
||||
# Optionnal
|
||||
caddy_local_ca_name: null
|
||||
caddy_ca_root: null
|
||||
|
||||
# For each site, mandatories parameters
|
||||
caddy_sites: []
|
||||
# - name: ""
|
||||
# site: ""
|
||||
# - id: ""
|
||||
# name: ""
|
||||
# paths:
|
||||
# - path: "*"
|
||||
# addrs:
|
||||
# - path: "" (default "*")
|
||||
# addrs: (minimum 1 required)
|
||||
# - ""
|
||||
# blacklist:
|
||||
# - ""
|
||||
# aliases:
|
||||
# - ""
|
||||
# crs_exceptions:
|
||||
# before_request:
|
||||
# - ""
|
||||
# after_response:
|
||||
# - ""
|
||||
|
||||
caddy_waf_defaults:
|
||||
redirect_from_aliases: true
|
||||
custom_cert: false
|
||||
custom_cert_file: ""
|
||||
custom_key_file: ""
|
||||
|
||||
# Security headers
|
||||
header_content_security_policy:
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#detailed-csp-directives
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy#directives
|
||||
## Fetch directives
|
||||
child-src: "'self'"
|
||||
connect-src: "'self'"
|
||||
font-src: "'self'"
|
||||
img-src: "'self'"
|
||||
manifest-src: "'self'"
|
||||
media-src: "'self'"
|
||||
# Deprecated: prefetch-src: "'self'"
|
||||
object-src: "'none'"
|
||||
script-src: "'none'"
|
||||
script-src-attr: "'none'"
|
||||
script-src-elem: "'none'"
|
||||
style-src: "'self'"
|
||||
style-src-attr: "'self'"
|
||||
style-src-elem: "'self'"
|
||||
default-src: "'self'"
|
||||
## Document directives
|
||||
# base-uri
|
||||
# plugin-types
|
||||
# sandbox
|
||||
## Navigation directives
|
||||
form-action: "'self'"
|
||||
frame-ancestors: "'self'"
|
||||
# https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-src
|
||||
frame-src: "'self'"
|
||||
# https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/worker-src
|
||||
worker-src: "'self'"
|
||||
# https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/block-all-mixed-content
|
||||
block-all-mixed-content:
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/fenced-frame-src
|
||||
fenced-frame-src: "'self'"
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/upgrade-insecure-requests
|
||||
upgrade-insecure-requests:
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
|
||||
header_cross_origin_embedder_policy: "require-corp"
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
|
||||
header_cross_origin_opener_policy: "same-origin"
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Resource-Policy
|
||||
header_cross_origin_resource_policy: "same-site"
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
|
||||
header_permissions_policy:
|
||||
accelerometer: "()"
|
||||
ambient-light-sensor: "()"
|
||||
aria-notify: "()"
|
||||
attribution-reporting: "()"
|
||||
autoplay: "()"
|
||||
bluetooth: "()"
|
||||
browsing-topics: "()"
|
||||
camera: "()"
|
||||
captured-surface-control: "()"
|
||||
compute-pressure: "()"
|
||||
cross-origin-isolated: "()"
|
||||
deferred-fetch: "()"
|
||||
deferred-fetch-minimal: "()"
|
||||
display-capture: "()"
|
||||
encrypted-media: "()"
|
||||
fullscreen: "()"
|
||||
gamepad: "()"
|
||||
geolocation: "()"
|
||||
gyroscope: "()"
|
||||
hid: "()"
|
||||
identity-credentials-get: "()"
|
||||
idle-detection: "()"
|
||||
language-detector: "()"
|
||||
local-fonts: "()"
|
||||
magnetometer: "()"
|
||||
microphone: "()"
|
||||
midi: "()"
|
||||
on-device-speech-recognition: "()"
|
||||
otp-credentials: "()"
|
||||
payment: "()"
|
||||
picture-in-picture: "()"
|
||||
private-state-token-issuance: "()"
|
||||
private-state-token-redemption: "()"
|
||||
publickey-credentials-create: "()"
|
||||
publickey-credentials-get: "()"
|
||||
screen-wake-lock: "()"
|
||||
serial: "()"
|
||||
speaker-selection: "()"
|
||||
storage-access: "()"
|
||||
translator: "()"
|
||||
summarizer: "()"
|
||||
usb: "()"
|
||||
web-share: "()"
|
||||
window-management: "()"
|
||||
xr-spatial-tracking: "()"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#floc-federated-learning-of-cohorts
|
||||
interest-cohort: "()"
|
||||
|
||||
# ???
|
||||
battery: "()"
|
||||
document-domain: "()"
|
||||
execution-while-not-rendered: "()"
|
||||
execution-while-out-of-viewport: "()"
|
||||
navigation-override: "()"
|
||||
|
||||
# https://www.geeksforgeeks.org/computer-networks/http-headers-feature-policy/
|
||||
header_feature_policy:
|
||||
accelerometer: "'none'"
|
||||
ambient-light-sensor: "'none'"
|
||||
autoplay: "'none'"
|
||||
battery: "'none'"
|
||||
camera: "'none'"
|
||||
display-capture: "'none'"
|
||||
document-domain: "'none'"
|
||||
encrypted-media: "'none'"
|
||||
fullscreen: "'none'"
|
||||
geolocation: "'none'"
|
||||
gyroscope: "'none'"
|
||||
layout-animation: "'none'"
|
||||
legacy-image-formats: "'none'"
|
||||
magnetometer: "'none'"
|
||||
microphone: "'none'"
|
||||
midi: "'none'"
|
||||
oversized-images: "'none'"
|
||||
payment: "'none'"
|
||||
picture-in-picture: "'none'"
|
||||
publickey-credentials-get: "'none'"
|
||||
sync-xhr: "'none'"
|
||||
usb: "'none'"
|
||||
screen-wake-lock: "'none'"
|
||||
xr-spatial-tracking: "'none'"
|
||||
|
||||
# ???
|
||||
execution-while-not-rendered: "'none'"
|
||||
execution-while-out-of-viewport: "'none'"
|
||||
navigation-override: "'none'"
|
||||
speaker-selection: "'none'"
|
||||
unoptimized-images: "'none'"
|
||||
unsized-media: "'none'"
|
||||
web-share: "'none'"
|
||||
|
||||
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy
|
||||
header_referrer_policy: "strict-origin-when-cross-origin"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
|
||||
header_strict_transport_security: "max-age=2635200; includeSubDomains"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
|
||||
header_x_content_type_options: "nosniff"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options
|
||||
header_x_frame_options: "DENY"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-robots-tag
|
||||
header_x_robots_tag: "noindex, nofollow"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#content-type
|
||||
default_content_type: "text/html; charset=UTF-8"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#set-cookie
|
||||
cookies_attributes: "SameSite=None; Secure;"
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-dns-prefetch-control
|
||||
# FIXME
|
||||
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#server
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnet-version
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnetmvc-version
|
||||
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by
|
||||
delete_headers:
|
||||
- "Server"
|
||||
- "Via"
|
||||
- "X-AspNet-Version"
|
||||
- "X-AspNetMvc-Version"
|
||||
- "X-Powered-By"
|
||||
|
||||
custom_headers: {}
|
||||
# - name: <string>
|
||||
# value: <string>
|
||||
|
||||
# caddy-ratelimit
|
||||
rate_events: 1000
|
||||
rate_window: "1m"
|
||||
|
||||
# steffenbusch/caddy-bot-barrier
|
||||
bot_barrier: false
|
||||
|
||||
# corazawaf/coraza-caddy
|
||||
enable_crs: true
|
||||
crs_plugins: []
|
||||
log_only: false
|
||||
paranoia_level: 1
|
||||
detection_paranoia_level: null
|
||||
enforce_bodyproc_urlencoded: 1
|
||||
critical_anomaly_score: 5
|
||||
error_anomaly_score: 4
|
||||
warning_anomaly_score: 3
|
||||
notice_anomaly_score: 2
|
||||
inbound_anomaly_score_threshold: 5
|
||||
outbound_anomaly_score_threshold: 4
|
||||
reporting_level: 4
|
||||
max_num_args: 255
|
||||
arg_name_length: 100
|
||||
arg_length: 1000
|
||||
total_arg_length: 64000
|
||||
max_file_size: 10485760 # 10 Mo
|
||||
combined_file_sizes: 20970520 # 20 Mo
|
||||
sampling_percentage: 100
|
||||
allowed_methods:
|
||||
- "GET"
|
||||
- "HEAD"
|
||||
- "POST"
|
||||
- "OPTIONS"
|
||||
allowed_request_content_type:
|
||||
- "|application/csp-report|"
|
||||
- "|application/json|"
|
||||
- "|application/reports+json|"
|
||||
- "|application/soap+xml|"
|
||||
- "|application/x-www-form-urlencoded|"
|
||||
- "|application/xml|"
|
||||
- "|multipart/form-data|"
|
||||
- "|text/xml|"
|
||||
restricted_extensions:
|
||||
- ".ani/"
|
||||
- ".asa/"
|
||||
- ".asax/"
|
||||
- ".ascx/"
|
||||
- ".back/"
|
||||
- ".backup/"
|
||||
- ".bak/"
|
||||
- ".bat/"
|
||||
- ".bck/"
|
||||
- ".bk/"
|
||||
- ".bkp/"
|
||||
- ".cdx/"
|
||||
- ".cer/"
|
||||
- ".cfg/"
|
||||
- ".cmd/"
|
||||
- ".cnf/"
|
||||
- ".com/"
|
||||
- ".compositefont/"
|
||||
- ".conf/"
|
||||
- ".config/"
|
||||
- ".copy/"
|
||||
- ".crt/"
|
||||
- ".cs/"
|
||||
- ".csproj/"
|
||||
- ".csr/"
|
||||
- ".dat/"
|
||||
- ".db/"
|
||||
- ".dbf/"
|
||||
- ".dist/"
|
||||
- ".dll/"
|
||||
- ".dos/"
|
||||
- ".dpkg-dist/"
|
||||
- ".drv/"
|
||||
- ".gadget/"
|
||||
- ".hta/"
|
||||
- ".htr/"
|
||||
- ".htw/"
|
||||
- ".ida/"
|
||||
- ".idc/"
|
||||
- ".idq/"
|
||||
- ".inc/"
|
||||
- ".inf/"
|
||||
- ".ini/"
|
||||
- ".jse/"
|
||||
- ".key/"
|
||||
- ".licx/"
|
||||
- ".lnk/"
|
||||
- ".log/"
|
||||
- ".mdb/"
|
||||
- ".msc/"
|
||||
- ".ocx/"
|
||||
- ".old/"
|
||||
- ".pass/"
|
||||
- ".pdb/"
|
||||
- ".pem/"
|
||||
- ".pfx/"
|
||||
- ".pif/"
|
||||
- ".pol/"
|
||||
- ".prf/"
|
||||
- ".printer/"
|
||||
- ".pwd/"
|
||||
- ".rdb/"
|
||||
- ".rdp/"
|
||||
- ".reg/"
|
||||
- ".resources/"
|
||||
- ".resx/"
|
||||
- ".sav/"
|
||||
- ".save/"
|
||||
- ".scr/"
|
||||
- ".sct/"
|
||||
- ".sh/"
|
||||
- ".shs/"
|
||||
- ".sql/"
|
||||
- ".sqlite/"
|
||||
- ".sqlite3/"
|
||||
- ".swp/"
|
||||
- ".sys/"
|
||||
- ".temp/"
|
||||
- ".tlb/"
|
||||
- ".tmp/"
|
||||
- ".vb/"
|
||||
- ".vbe/"
|
||||
- ".vbproj/"
|
||||
- ".vbs/"
|
||||
- ".vsdisco/"
|
||||
- ".vxd/"
|
||||
- ".webinfo/"
|
||||
- ".ws/"
|
||||
- ".wsc/"
|
||||
- ".wsf/"
|
||||
- ".wsh/"
|
||||
- ".xsd/"
|
||||
- ".xsx/"
|
||||
restricted_headers_basic:
|
||||
- "/content-encoding/"
|
||||
- "/content-range/"
|
||||
- "/expect/"
|
||||
- "/if/"
|
||||
- "/lock-token/"
|
||||
- "/proxy/"
|
||||
- "/x-http-method-override/"
|
||||
- "/x-http-method/"
|
||||
- "/x-method-override/"
|
||||
- "/x-middleware-subrequest/"
|
||||
restricted_headers_extended:
|
||||
- "/accept-charset/"
|
||||
allowed_http_versions:
|
||||
- "HTTP/1.0"
|
||||
- "HTTP/1.1"
|
||||
- "HTTP/2"
|
||||
- "HTTP/2.0"
|
||||
- "HTTP/3"
|
||||
- "HTTP/3.0"
|
||||
allowed_request_content_type_charset:
|
||||
- "|utf-8|"
|
||||
- "|iso-8859-1|"
|
||||
- "|iso-8859-15|"
|
||||
- "|windows-1252|"
|
||||
# Will be merged with caddy_global_sites_defaults
|
||||
caddy_my_sites_defaults: {}
|
||||
|
||||
Reference in New Issue
Block a user