caddy: refact variables name, global options, add caddy_my_name
This commit is contained in:
@@ -1,6 +1,11 @@
|
||||
{
|
||||
grace_period 10s
|
||||
http_port {{ caddy_http_port }}
|
||||
https_port {{ caddy_https_port }}
|
||||
default_bind {{ caddy_default_bind }}
|
||||
order coraza_waf first
|
||||
admin off
|
||||
persist_config off
|
||||
|
||||
{% if caddy_email | default(None) != None %}
|
||||
email "{{ caddy_email }}"
|
||||
{% endif %}
|
||||
@@ -9,43 +14,38 @@
|
||||
tls {
|
||||
ca_root "{{ caddy_ca_root }}"
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% if caddy_debug %}
|
||||
log {
|
||||
format json
|
||||
level DEBUG
|
||||
output file {{ caddy_log_dir }}/debug.log
|
||||
}
|
||||
|
||||
{% endif %}
|
||||
|
||||
log waf {
|
||||
format json
|
||||
include "http.handlers.waf"
|
||||
output file {{ caddy_log_dir }}/waf.log
|
||||
}
|
||||
{% if caddy_local_ca_name | default(None) != None %}
|
||||
|
||||
pki {
|
||||
ca local {
|
||||
name "{{ caddy_local_ca_name }}"
|
||||
}
|
||||
}
|
||||
{% endif %}
|
||||
}
|
||||
|
||||
{% for site in caddy_sites %}
|
||||
{% if (site.redirect_from_aliases | default(true)) and (site.aliases | default([]) | length) > 0 %}
|
||||
{{ site.aliases | join(', ') }} {
|
||||
redir https://{{ site.site }}{uri}
|
||||
|
||||
{% if (site.site_redirect_from_aliases | default(caddy_sites_defaults.site_redirect_from_aliases)) and (site.site_aliases | default([]) | length) > 0 %}
|
||||
|
||||
{{ site.site_aliases | join(', ') }} {
|
||||
redir https://{{ site.name }}{uri}
|
||||
}
|
||||
|
||||
{% else %}
|
||||
{% for alias in site.aliases | default([]) %}
|
||||
|
||||
{% for alias in site.site_aliases | default(caddy_sites_defaults.site_aliases) %}
|
||||
{{ alias }},
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{{ site.site }} {
|
||||
{{ site.name }} {
|
||||
encode gzip zstd
|
||||
|
||||
{% for path in site.paths %}
|
||||
@@ -53,7 +53,7 @@
|
||||
reverse_proxy {
|
||||
to {{ path.addrs | join(' ') }}
|
||||
header_up X-Real-IP {remote}
|
||||
lb_policy ip_hash
|
||||
lb_policy {{ site.proxy_lb_policy | default(caddy_sites_defaults.proxy_lb_policy) }}
|
||||
# Active checks
|
||||
# health_uri /
|
||||
# health_interval 10s
|
||||
@@ -72,53 +72,61 @@
|
||||
{% endfor %}
|
||||
|
||||
{% if site.custom_cert | default (false) %}
|
||||
tls {{ site.custom_cert_file }} {{ site.custom_key_file }}
|
||||
|
||||
tls {{ site.custom_cert_file }} {{ site.custom_cert_key_file }}
|
||||
{% endif %}
|
||||
{% if site.blacklist | default([]) | length > 0 %}
|
||||
|
||||
{% if site.filter_blacklist | default(caddy_sites_defaults.filter_blacklist) | length > 0 %}
|
||||
@blocked {
|
||||
{% for ip in site.blacklist | default([]) %}
|
||||
{% for ip in site.filter_blacklist | default(caddy_sites_defaults.filter_blacklist) %}
|
||||
remote_ip {{ ip }}
|
||||
{% endfor %}
|
||||
}
|
||||
respond @blocked "Access Denied" 403
|
||||
|
||||
{% endif %}
|
||||
{% if site.bot_barrier | default (false) %}
|
||||
bot_barrier {
|
||||
secret {{ caddy_bot_barrier_secret }}
|
||||
complexity 18
|
||||
valid_for 30m
|
||||
seed_cookie_name __chall_{{ site.name }}_seed
|
||||
solution_cookie_name __chall_{{ site.name }}_solution
|
||||
mac_cookie_name __chall_{{ site.name }}_mac
|
||||
template {{ caddy_config_dir }}/bot_barrier_template.html
|
||||
|
||||
@not_whitelisted not {
|
||||
{% for ip in site.filter_whitelist | default(caddy_sites_defaults.filter_whitelist) %}
|
||||
remote_ip {{ ip }}
|
||||
{% endfor %}
|
||||
}
|
||||
|
||||
{% if site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %}
|
||||
bot_barrier @not_whitelisted {
|
||||
secret {{ site.bot_barrier_secret | default(caddy_sites_defaults.bot_barrier_secret) | mandatory }}
|
||||
complexity {{ site.bot_barrier_complexity | default(caddy_sites_defaults.bot_barrier_complexity) }}
|
||||
valid_for {{ site.bot_barrier_valid_for | default(caddy_sites_defaults.bot_barrier_valid_for) }}
|
||||
seed_cookie_name __chall_{{ site.id }}_seed
|
||||
solution_cookie_name __chall_{{ site.id }}_solution
|
||||
mac_cookie_name __chall_{{ site.id }}_mac
|
||||
template {{ caddy_config_dir }}/bot_barrier_template.html
|
||||
}
|
||||
{% endif %}
|
||||
rate_limit {
|
||||
|
||||
{% if site.rate_limit | default(caddy_sites_defaults.rate_limit) %}
|
||||
rate_limit @not_whitelisted {
|
||||
# distributed
|
||||
zone remote_ip {
|
||||
key {remote.ip}
|
||||
events {{ site.rate_events | default('1000') }}
|
||||
window {{ site.rate_window | default('1m') }}
|
||||
events {{ site.rate_limit_events | default(caddy_sites_defaults.rate_limit_events) }}
|
||||
window {{ site.rate_limit_window | default(caddy_sites_defaults.rate_limit_window) }}
|
||||
}
|
||||
}
|
||||
{% if site.enable_crs | default(caddy_waf_defaults.enable_crs) %}
|
||||
{% endif %}
|
||||
|
||||
coraza_waf {
|
||||
{% if site.crs | default(caddy_sites_defaults.crs) %}
|
||||
coraza_waf @not_whitelisted {
|
||||
load_owasp_crs
|
||||
directives `
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/coraza.conf"
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/crs-setup.conf"
|
||||
{% for plugin in site.crs_plugins | default(caddy_waf_defaults.crs_plugins) %}
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.id }}/coraza.conf"
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.id }}/crs-setup.conf"
|
||||
{% for plugin in site.crs_plugins | default(caddy_sites_defaults.crs_plugins) %}
|
||||
Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-config.conf"
|
||||
Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-before.conf"
|
||||
{% endfor %}
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-request-before.conf"
|
||||
Include "{{ caddy_config_dir }}/coreruleset-{{ caddy_owasp_crs_version }}/rules/*.conf"
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-response-after.conf"
|
||||
{% for plugin in site.crs_plugins | default(caddy_waf_defaults.crs_plugins) %}
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-request-before.conf"
|
||||
Include "{{ caddy_config_dir }}/coreruleset-{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}/rules/*.conf"
|
||||
Include "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-response-after.conf"
|
||||
{% for plugin in site.crs_plugins | default(caddy_sites_defaults.crs_plugins) %}
|
||||
Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-after.conf"
|
||||
{% endfor %}
|
||||
SecRuleEngine On
|
||||
@@ -127,35 +135,35 @@
|
||||
{% endif %}
|
||||
|
||||
header {
|
||||
Content-Security-Policy "{{ caddy_waf_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
|
||||
Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_waf_defaults.header_cross_origin_embedder_policy) }}"
|
||||
Cross-Origin-Opener-Policy "{{ site.header_cross_origin_opener_policy | default(caddy_waf_defaults.header_cross_origin_opener_policy) }}"
|
||||
Cross-Origin-Resource-Policy "{{ site.header_cross_origin_resource_policy | default(caddy_waf_defaults.header_cross_origin_resource_policy) }}"
|
||||
Feature-Policy "{{ caddy_waf_defaults.header_feature_policy | combine(site.header_feature_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
|
||||
Permissions-Policy "{{ caddy_waf_defaults.header_permissions_policy | combine(site.header_permissions_policy | default({})) | dict2str(sep2=', ') }}"
|
||||
Referrer-Policy "{{ site.header_referrer_policy | default(caddy_waf_defaults.header_referrer_policy) }}"
|
||||
Strict-Transport-Security "{{ site.header_strict_transport_security | default(caddy_waf_defaults.header_strict_transport_security) }}"
|
||||
X-Content-Type-Options "{{ site.header_x_content_type_options | default(caddy_waf_defaults.header_x_content_type_options) }}"
|
||||
X-Frame-Options "{{ site.header_x_frame_options | default(caddy_waf_defaults.header_x_frame_options) }}"
|
||||
X-Robots-Tag "{{ site.header_x_robots_tag | default(caddy_waf_defaults.header_x_robots_tag) }}"
|
||||
?Content-Type "{{ site.default_content_type | default(caddy_waf_defaults.default_content_type) }}"
|
||||
>Set-Cookie "(.*)" "$1; {{ site.cookies_attributes | default(caddy_waf_defaults.cookies_attributes) }}"
|
||||
{% for header in site.delete_headers | default(caddy_waf_defaults.delete_headers) %}
|
||||
Content-Security-Policy "{{ caddy_sites_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
|
||||
Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_sites_defaults.header_cross_origin_embedder_policy) }}"
|
||||
Cross-Origin-Opener-Policy "{{ site.header_cross_origin_opener_policy | default(caddy_sites_defaults.header_cross_origin_opener_policy) }}"
|
||||
Cross-Origin-Resource-Policy "{{ site.header_cross_origin_resource_policy | default(caddy_sites_defaults.header_cross_origin_resource_policy) }}"
|
||||
Feature-Policy "{{ caddy_sites_defaults.header_feature_policy | combine(site.header_feature_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
|
||||
Permissions-Policy "{{ caddy_sites_defaults.header_permissions_policy | combine(site.header_permissions_policy | default({})) | dict2str(sep2=', ') }}"
|
||||
Referrer-Policy "{{ site.header_referrer_policy | default(caddy_sites_defaults.header_referrer_policy) }}"
|
||||
Strict-Transport-Security "{{ site.header_strict_transport_security | default(caddy_sites_defaults.header_strict_transport_security) }}"
|
||||
X-Content-Type-Options "{{ site.header_x_content_type_options | default(caddy_sites_defaults.header_x_content_type_options) }}"
|
||||
X-Frame-Options "{{ site.header_x_frame_options | default(caddy_sites_defaults.header_x_frame_options) }}"
|
||||
X-Robots-Tag "{{ site.header_x_robots_tag | default(caddy_sites_defaults.header_x_robots_tag) }}"
|
||||
?Content-Type "{{ site.header_default_content_type | default(caddy_sites_defaults.header_default_content_type) }}"
|
||||
>Set-Cookie "(.*)" "$1; {{ site.header_cookies_attributes | default(caddy_sites_defaults.header_cookies_attributes) }}"
|
||||
{% for header in site.header_delete | default(caddy_sites_defaults.header_delete) %}
|
||||
-{{ header }}
|
||||
{% endfor %}
|
||||
{% for header in site.custom_headers | default(caddy_waf_defaults.custom_headers) %}
|
||||
{% for header in site.header_add | default(caddy_sites_defaults.header_add) %}
|
||||
{{ header.name }} "{{ header.value }}"
|
||||
{% endfor %}
|
||||
}
|
||||
|
||||
handle_errors 403 {
|
||||
header X-Blocked "true"
|
||||
respond "Your request was blocked."
|
||||
respond "Your request was blocked. 🔴"
|
||||
}
|
||||
|
||||
log {
|
||||
format json
|
||||
output file {{ caddy_log_dir }}/site_{{ site.name }}.log
|
||||
output file {{ caddy_log_dir }}/site_{{ site.id }}.log
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
[Unit]
|
||||
Description=Caddy
|
||||
Documentation=https://caddyserver.com/docs/
|
||||
Description=WAF {{ caddy_my_name }} (built with BYOW: Build Your Own WAF)
|
||||
After=network.target network-online.target
|
||||
Requires=network-online.target
|
||||
|
||||
@@ -8,8 +7,8 @@ Requires=network-online.target
|
||||
Type=notify
|
||||
User={{ caddy_system_user }}
|
||||
Group={{ caddy_system_group }}
|
||||
ExecStart=/usr/local/bin/caddy run --environ --config {{ caddy_config_dir }}/Caddyfile
|
||||
ExecReload=/usr/local/bin/caddy reload --config {{ caddy_config_dir }}/Caddyfile --force
|
||||
ExecStart=/usr/local/bin/{{ caddy_my_name }} run --environ --config {{ caddy_config_dir }}/Caddyfile
|
||||
ExecReload=/usr/local/bin/{{ caddy_my_name }} reload --config {{ caddy_config_dir }}/Caddyfile --force
|
||||
TimeoutStopSec=15s
|
||||
LimitNOFILE=1048576
|
||||
PrivateTmp=true
|
||||
|
||||
@@ -10,9 +10,9 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.blocking_paranoia_level={{ site.paranoia_level | default(caddy_waf_defaults.paranoia_level) }}"
|
||||
{% if site.detection_paranoia_level | default(caddy_waf_defaults.detection_paranoia_level) != None %}
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.blocking_crs_paranoia_level={{ site.crs_paranoia_level | default(caddy_sites_defaults.crs_paranoia_level) }}"
|
||||
{% if site.crs_detection_paranoia_level | default(caddy_sites_defaults.crs_detection_paranoia_level) != None %}
|
||||
|
||||
## Detection paranoia level
|
||||
SecAction \
|
||||
@@ -22,8 +22,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.detection_paranoia_level={{ site.detection_paranoia_level | default(caddy_waf_defaults.detection_paranoia_level) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_detection_paranoia_level={{ site.crs_detection_paranoia_level | default(caddy_sites_defaults.crs_detection_paranoia_level) }}"
|
||||
{% endif %}
|
||||
|
||||
## Enforce Body Processor URLENCODED
|
||||
@@ -34,8 +34,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.enforce_bodyproc_urlencoded={{ site.enforce_bodyproc_urlencoded | default(caddy_waf_defaults.enforce_bodyproc_urlencoded) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_enforce_bodyproc_urlencoded={{ site.crs_enforce_bodyproc_urlencoded | default(caddy_sites_defaults.crs_enforce_bodyproc_urlencoded) }}"
|
||||
|
||||
## Anomaly Scoring Mode Severity Levels
|
||||
SecAction \
|
||||
@@ -45,11 +45,11 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.critical_anomaly_score={{ site.critical_anomaly_score | default(caddy_waf_defaults.critical_anomaly_score) }},\
|
||||
setvar:tx.error_anomaly_score={{ site.error_anomaly_score | default(caddy_waf_defaults.error_anomaly_score) }},\
|
||||
setvar:tx.warning_anomaly_score={{ site.warning_anomaly_score | default(caddy_waf_defaults.warning_anomaly_score) }},\
|
||||
setvar:tx.notice_anomaly_score={{ site.notice_anomaly_score | default(caddy_waf_defaults.notice_anomaly_score) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_critical_anomaly_score={{ site.crs_critical_anomaly_score | default(caddy_sites_defaults.crs_critical_anomaly_score) }},\
|
||||
setvar:tx.crs_error_anomaly_score={{ site.crs_error_anomaly_score | default(caddy_sites_defaults.crs_error_anomaly_score) }},\
|
||||
setvar:tx.crs_warning_anomaly_score={{ site.crs_warning_anomaly_score | default(caddy_sites_defaults.crs_warning_anomaly_score) }},\
|
||||
setvar:tx.crs_notice_anomaly_score={{ site.crs_notice_anomaly_score | default(caddy_sites_defaults.crs_notice_anomaly_score) }}"
|
||||
|
||||
## Anomaly Scoring Mode Blocking Threshold Levels
|
||||
SecAction \
|
||||
@@ -59,9 +59,9 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.inbound_anomaly_score_threshold={% if site.log_only | default(caddy_waf_defaults.log_only) %}1000{% else %}{{ site.inbound_anomaly_score_threshold | default(caddy_waf_defaults.inbound_anomaly_score_threshold) }}{% endif %},\
|
||||
setvar:tx.outbound_anomaly_score_threshold={% if site.log_only | default(caddy_waf_defaults.log_only) %}1000{% else %}{{ site.outbound_anomaly_score_threshold | default(caddy_waf_defaults.outbound_anomaly_score_threshold) }}{% endif %}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_inbound_anomaly_score_threshold={% if site.crs_log_only | default(caddy_sites_defaults.crs_log_only) %}1000{% else %}{{ site.crs_inbound_anomaly_score_threshold | default(caddy_sites_defaults.crs_inbound_anomaly_score_threshold) }}{% endif %},\
|
||||
setvar:tx.crs_outbound_anomaly_score_threshold={% if site.crs_log_only | default(caddy_sites_defaults.crs_log_only) %}1000{% else %}{{ site.crs_outbound_anomaly_score_threshold | default(caddy_sites_defaults.crs_outbound_anomaly_score_threshold) }}{% endif %}"
|
||||
|
||||
## Application Specific Rule Exclusions
|
||||
# FIXME
|
||||
@@ -87,8 +87,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.reporting_level={{ site.reporting_level | default(caddy_waf_defaults.reporting_level) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_reporting_level={{ site.crs_reporting_level | default(caddy_sites_defaults.crs_reporting_level) }}"
|
||||
|
||||
## Early Anomaly Scoring Mode Blocking
|
||||
SecAction \
|
||||
@@ -98,7 +98,7 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.early_blocking=0"
|
||||
|
||||
## Initialize Default Collections
|
||||
@@ -109,7 +109,7 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.enable_default_collections=1"
|
||||
|
||||
## HTTP Policy Settings
|
||||
@@ -120,8 +120,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.allowed_methods={{ site.allowed_methods | default(caddy_waf_defaults.allowed_methods) | join(" ") }}'"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:'tx.crs_allowed_methods={{ site.crs_allowed_methods | default(caddy_sites_defaults.crs_allowed_methods) | join(" ") }}'"
|
||||
|
||||
## Content-Types that a client is allowed to send in a request
|
||||
SecAction \
|
||||
@@ -131,8 +131,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.allowed_request_content_type={{ site.allowed_request_content_type | default(caddy_waf_defaults.allowed_request_content_type) | join(" ") }}'"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:'tx.crs_allowed_request_content_type={{ site.crs_allowed_request_content_type | default(caddy_sites_defaults.crs_allowed_request_content_type) | join(" ") }}'"
|
||||
|
||||
## Allowed HTTP versions
|
||||
SecAction \
|
||||
@@ -142,8 +142,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.allowed_http_versions={{ site.allowed_http_versions | default(caddy_waf_defaults.allowed_http_versions) | join(" ") }}'"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:'tx.crs_allowed_http_versions={{ site.crs_allowed_http_versions | default(caddy_sites_defaults.crs_allowed_http_versions) | join(" ") }}'"
|
||||
|
||||
## Forbidden file extensions
|
||||
SecAction \
|
||||
@@ -153,8 +153,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.restricted_extensions={{ site.restricted_extensions | default(caddy_waf_defaults.restricted_extensions) | join(" ") }}'"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:'tx.crs_restricted_extensions={{ site.crs_restricted_extensions | default(caddy_sites_defaults.crs_restricted_extensions) | join(" ") }}'"
|
||||
|
||||
## Restricted request headers
|
||||
SecAction \
|
||||
@@ -164,8 +164,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.restricted_headers_basic={{ site.restricted_headers_basic | default(caddy_waf_defaults.restricted_headers_basic) | join(" ") }}'"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:'tx.crs_restricted_headers_basic={{ site.crs_restricted_headers_basic | default(caddy_sites_defaults.crs_restricted_headers_basic) | join(" ") }}'"
|
||||
|
||||
## Extended restricted request headers (forbidden at a higher paranoia level)
|
||||
SecAction \
|
||||
@@ -175,8 +175,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.restricted_headers_extended={{ site.restricted_headers_extended | default(caddy_waf_defaults.restricted_headers_extended) | join(" ") }}'"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:'tx.crs_restricted_headers_extended={{ site.crs_restricted_headers_extended | default(caddy_sites_defaults.crs_restricted_headers_extended) | join(" ") }}'"
|
||||
|
||||
## Content-Types charsets that a client is allowed to send in a request
|
||||
SecAction \
|
||||
@@ -186,8 +186,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:'tx.allowed_request_content_type_charset={{ caddy_waf_defaults.allowed_request_content_type_charset | default(caddy_waf_defaults.allowed_request_content_type_charset) | join(" ") }}'"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:'tx.crs_allowed_request_content_type_charset={{ caddy_sites_defaults.crs_allowed_request_content_type_charset | default(caddy_sites_defaults.crs_allowed_request_content_type_charset) | join(" ") }}'"
|
||||
|
||||
## Block request if number of arguments is too high
|
||||
SecAction \
|
||||
@@ -197,8 +197,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.max_num_args={{ site.max_num_args | default(caddy_waf_defaults.max_num_args) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_max_num_args={{ site.crs_max_num_args | default(caddy_sites_defaults.crs_max_num_args) }}"
|
||||
|
||||
## Block request if the length of any argument name is too high
|
||||
SecAction \
|
||||
@@ -208,8 +208,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.arg_name_length={{ site.arg_name_length | default(caddy_waf_defaults.arg_name_length) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_arg_name_length={{ site.crs_arg_name_length | default(caddy_sites_defaults.crs_arg_name_length) }}"
|
||||
|
||||
## Block request if the length of any argument value is too high
|
||||
SecAction \
|
||||
@@ -219,8 +219,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.arg_length={{ site.arg_length | default(caddy_waf_defaults.arg_length) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_arg_length={{ site.crs_arg_length | default(caddy_sites_defaults.crs_arg_length) }}"
|
||||
|
||||
## Block request if the total length of all combined arguments is too high
|
||||
SecAction \
|
||||
@@ -230,8 +230,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.total_arg_length={{ site.total_arg_length | default(caddy_waf_defaults.total_arg_length) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_total_arg_length={{ site.crs_total_arg_length | default(caddy_sites_defaults.crs_total_arg_length) }}"
|
||||
|
||||
## Block request if the file size of any individual uploaded file is too high
|
||||
SecAction \
|
||||
@@ -241,8 +241,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.max_file_size={{ site.max_file_size | default(caddy_waf_defaults.max_file_size) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_max_file_size={{ site.crs_max_file_size | default(caddy_sites_defaults.crs_max_file_size) }}"
|
||||
|
||||
## Block request if the total size of all combined uploaded files is too high
|
||||
SecAction \
|
||||
@@ -252,8 +252,8 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.combined_file_sizes={{ site.combined_file_sizes | default(caddy_waf_defaults.combined_file_sizes) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_combined_file_sizes={{ site.crs_combined_file_sizes | default(caddy_sites_defaults.crs_combined_file_sizes) }}"
|
||||
|
||||
## Easing In / Sampling Percentage
|
||||
SecAction \
|
||||
@@ -262,8 +262,8 @@ SecAction \
|
||||
pass,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.sampling_percentage={{ site.sampling_percentage | default(caddy_waf_defaults.sampling_percentage) }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_sampling_percentage={{ site.crs_sampling_percentage | default(caddy_sites_defaults.crs_sampling_percentage) }}"
|
||||
|
||||
## Check UTF-8 encoding
|
||||
SecAction \
|
||||
@@ -273,7 +273,7 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_validate_utf8_encoding=1"
|
||||
|
||||
## Skip Checking Responses
|
||||
@@ -290,7 +290,7 @@ SecAction \
|
||||
# t:none,\
|
||||
# nolog,\
|
||||
# tag:'OWASP_CRS',\
|
||||
# ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
# ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
# setvar:tx.crs_skip_response_analysis=1"
|
||||
|
||||
## End of setup
|
||||
@@ -301,5 +301,5 @@ SecAction \
|
||||
t:none,\
|
||||
nolog,\
|
||||
tag:'OWASP_CRS',\
|
||||
ver:'OWASP_CRS/{{ caddy_owasp_crs_version }}',\
|
||||
setvar:tx.crs_setup_version={{ caddy_owasp_crs_version | regex_replace('\.', '') }}"
|
||||
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
|
||||
setvar:tx.crs_setup_version={{ site.crs_version | default(caddy_sites_defaults.crs_version) | regex_replace('\.', '') }}"
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
{% for exclusion in site.crs_exceptions.before_request | default([]) %}
|
||||
{% for exclusion in site.crs_exceptions.before_request | default(caddy_sites_defaults.crs_exceptions.before_request) %}
|
||||
{{ exclusion }}
|
||||
{% endfor %}
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
{% for exclusion in site.crs_exceptions.after_response | default([]) %}
|
||||
{% for exclusion in site.crs_exceptions.after_response | default(caddy_sites_defaults.crs_exceptions.after_response) %}
|
||||
{{ exclusion }}
|
||||
{% endfor %}
|
||||
|
||||
Reference in New Issue
Block a user