itik/bgwaf
Private
Public Access
2
0
Fork 0
Code Issues Pull Requests Releases 9 Activity

caddy: refact variables name, global options, add caddy_my_name

Browse Source
This commit is contained in:
Sébastien NAMECHE
2026-01-23 11:20:54 +03:00
parent 69b4bb6c88
commit c217cc8d7c
11 changed files with 560 additions and 505 deletions
Download Patch File Download Diff File Expand all files Collapse all files

128
seb4itik/byow/roles/caddy/templates/Caddyfile
View File

@@ -1,6 +1,11 @@
{
grace_period 10s
http_port {{ caddy_http_port }}
https_port {{ caddy_https_port }}
default_bind {{ caddy_default_bind }}
order coraza_waf first
admin off
persist_config off
{% if caddy_email | default(None) != None %}
email "{{ caddy_email }}"
{% endif %}
@@ -9,43 +14,38 @@
tls {
ca_root "{{ caddy_ca_root }}"
}
{% endif %}
{% if caddy_debug %}
log {
format json
level DEBUG
output file {{ caddy_log_dir }}/debug.log
}
{% endif %}
log waf {
format json
include "http.handlers.waf"
output file {{ caddy_log_dir }}/waf.log
}
{% if caddy_local_ca_name | default(None) != None %}
pki {
ca local {
name "{{ caddy_local_ca_name }}"
}
}
{% endif %}
}
{% for site in caddy_sites %}
{% if (site.redirect_from_aliases | default(true)) and (site.aliases | default([]) | length) > 0 %}
{{ site.aliases | join(', ') }} {
redir https://{{ site.site }}{uri}
{% if (site.site_redirect_from_aliases | default(caddy_sites_defaults.site_redirect_from_aliases)) and (site.site_aliases | default([]) | length) > 0 %}
{{ site.site_aliases | join(', ') }} {
redir https://{{ site.name }}{uri}
}
{% else %}
{% for alias in site.aliases | default([]) %}
{% for alias in site.site_aliases | default(caddy_sites_defaults.site_aliases) %}
{{ alias }},
{% endfor %}
{% endif %}
{{ site.site }} {
{{ site.name }} {
encode gzip zstd
{% for path in site.paths %}
@@ -53,7 +53,7 @@
reverse_proxy {
to {{ path.addrs | join(' ') }}
header_up X-Real-IP {remote}
lb_policy ip_hash
lb_policy {{ site.proxy_lb_policy | default(caddy_sites_defaults.proxy_lb_policy) }}
# Active checks
# health_uri /
# health_interval 10s
@@ -72,53 +72,61 @@
{% endfor %}
{% if site.custom_cert | default (false) %}
tls {{ site.custom_cert_file }} {{ site.custom_key_file }}
tls {{ site.custom_cert_file }} {{ site.custom_cert_key_file }}
{% endif %}
{% if site.blacklist | default([]) | length > 0 %}
{% if site.filter_blacklist | default(caddy_sites_defaults.filter_blacklist) | length > 0 %}
@blocked {
{% for ip in site.blacklist | default([]) %}
{% for ip in site.filter_blacklist | default(caddy_sites_defaults.filter_blacklist) %}
remote_ip {{ ip }}
{% endfor %}
}
respond @blocked "Access Denied" 403
{% endif %}
{% if site.bot_barrier | default (false) %}
bot_barrier {
secret {{ caddy_bot_barrier_secret }}
complexity 18
valid_for 30m
seed_cookie_name __chall_{{ site.name }}_seed
solution_cookie_name __chall_{{ site.name }}_solution
mac_cookie_name __chall_{{ site.name }}_mac
template {{ caddy_config_dir }}/bot_barrier_template.html
@not_whitelisted not {
{% for ip in site.filter_whitelist | default(caddy_sites_defaults.filter_whitelist) %}
remote_ip {{ ip }}
{% endfor %}
}
{% if site.bot_barrier | default(caddy_sites_defaults.bot_barrier) %}
bot_barrier @not_whitelisted {
secret {{ site.bot_barrier_secret | default(caddy_sites_defaults.bot_barrier_secret) | mandatory }}
complexity {{ site.bot_barrier_complexity | default(caddy_sites_defaults.bot_barrier_complexity) }}
valid_for {{ site.bot_barrier_valid_for | default(caddy_sites_defaults.bot_barrier_valid_for) }}
seed_cookie_name __chall_{{ site.id }}_seed
solution_cookie_name __chall_{{ site.id }}_solution
mac_cookie_name __chall_{{ site.id }}_mac
template {{ caddy_config_dir }}/bot_barrier_template.html
}
{% endif %}
rate_limit {
{% if site.rate_limit | default(caddy_sites_defaults.rate_limit) %}
rate_limit @not_whitelisted {
# distributed
zone remote_ip {
key {remote.ip}
events {{ site.rate_events | default('1000') }}
window {{ site.rate_window | default('1m') }}
events {{ site.rate_limit_events | default(caddy_sites_defaults.rate_limit_events) }}
window {{ site.rate_limit_window | default(caddy_sites_defaults.rate_limit_window) }}
}
}
{% if site.enable_crs | default(caddy_waf_defaults.enable_crs) %}
{% endif %}
coraza_waf {
{% if site.crs | default(caddy_sites_defaults.crs) %}
coraza_waf @not_whitelisted {
load_owasp_crs
directives `
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/coraza.conf"
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/crs-setup.conf"
{% for plugin in site.crs_plugins | default(caddy_waf_defaults.crs_plugins) %}
Include "{{ caddy_config_dir }}/sites/{{ site.id }}/coraza.conf"
Include "{{ caddy_config_dir }}/sites/{{ site.id }}/crs-setup.conf"
{% for plugin in site.crs_plugins | default(caddy_sites_defaults.crs_plugins) %}
Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-config.conf"
Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-before.conf"
{% endfor %}
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-request-before.conf"
Include "{{ caddy_config_dir }}/coreruleset-{{ caddy_owasp_crs_version }}/rules/*.conf"
Include "{{ caddy_config_dir }}/sites/{{ site.name }}/exclusions-response-after.conf"
{% for plugin in site.crs_plugins | default(caddy_waf_defaults.crs_plugins) %}
Include "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-request-before.conf"
Include "{{ caddy_config_dir }}/coreruleset-{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}/rules/*.conf"
Include "{{ caddy_config_dir }}/sites/{{ site.id }}/exclusions-response-after.conf"
{% for plugin in site.crs_plugins | default(caddy_sites_defaults.crs_plugins) %}
Include "{{ caddy_config_dir }}/crs-plugins/{{ plugin }}-after.conf"
{% endfor %}
SecRuleEngine On
@@ -127,35 +135,35 @@
{% endif %}
header {
Content-Security-Policy "{{ caddy_waf_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_waf_defaults.header_cross_origin_embedder_policy) }}"
Cross-Origin-Opener-Policy "{{ site.header_cross_origin_opener_policy | default(caddy_waf_defaults.header_cross_origin_opener_policy) }}"
Cross-Origin-Resource-Policy "{{ site.header_cross_origin_resource_policy | default(caddy_waf_defaults.header_cross_origin_resource_policy) }}"
Feature-Policy "{{ caddy_waf_defaults.header_feature_policy | combine(site.header_feature_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
Permissions-Policy "{{ caddy_waf_defaults.header_permissions_policy | combine(site.header_permissions_policy | default({})) | dict2str(sep2=', ') }}"
Referrer-Policy "{{ site.header_referrer_policy | default(caddy_waf_defaults.header_referrer_policy) }}"
Strict-Transport-Security "{{ site.header_strict_transport_security | default(caddy_waf_defaults.header_strict_transport_security) }}"
X-Content-Type-Options "{{ site.header_x_content_type_options | default(caddy_waf_defaults.header_x_content_type_options) }}"
X-Frame-Options "{{ site.header_x_frame_options | default(caddy_waf_defaults.header_x_frame_options) }}"
X-Robots-Tag "{{ site.header_x_robots_tag | default(caddy_waf_defaults.header_x_robots_tag) }}"
?Content-Type "{{ site.default_content_type | default(caddy_waf_defaults.default_content_type) }}"
>Set-Cookie "(.*)" "$1; {{ site.cookies_attributes | default(caddy_waf_defaults.cookies_attributes) }}"
{% for header in site.delete_headers | default(caddy_waf_defaults.delete_headers) %}
Content-Security-Policy "{{ caddy_sites_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_sites_defaults.header_cross_origin_embedder_policy) }}"
Cross-Origin-Opener-Policy "{{ site.header_cross_origin_opener_policy | default(caddy_sites_defaults.header_cross_origin_opener_policy) }}"
Cross-Origin-Resource-Policy "{{ site.header_cross_origin_resource_policy | default(caddy_sites_defaults.header_cross_origin_resource_policy) }}"
Feature-Policy "{{ caddy_sites_defaults.header_feature_policy | combine(site.header_feature_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
Permissions-Policy "{{ caddy_sites_defaults.header_permissions_policy | combine(site.header_permissions_policy | default({})) | dict2str(sep2=', ') }}"
Referrer-Policy "{{ site.header_referrer_policy | default(caddy_sites_defaults.header_referrer_policy) }}"
Strict-Transport-Security "{{ site.header_strict_transport_security | default(caddy_sites_defaults.header_strict_transport_security) }}"
X-Content-Type-Options "{{ site.header_x_content_type_options | default(caddy_sites_defaults.header_x_content_type_options) }}"
X-Frame-Options "{{ site.header_x_frame_options | default(caddy_sites_defaults.header_x_frame_options) }}"
X-Robots-Tag "{{ site.header_x_robots_tag | default(caddy_sites_defaults.header_x_robots_tag) }}"
?Content-Type "{{ site.header_default_content_type | default(caddy_sites_defaults.header_default_content_type) }}"
>Set-Cookie "(.*)" "$1; {{ site.header_cookies_attributes | default(caddy_sites_defaults.header_cookies_attributes) }}"
{% for header in site.header_delete | default(caddy_sites_defaults.header_delete) %}
-{{ header }}
{% endfor %}
{% for header in site.custom_headers | default(caddy_waf_defaults.custom_headers) %}
{% for header in site.header_add | default(caddy_sites_defaults.header_add) %}
{{ header.name }} "{{ header.value }}"
{% endfor %}
}
handle_errors 403 {
header X-Blocked "true"
respond "Your request was blocked."
respond "Your request was blocked. 🔴"
}
log {
format json
output file {{ caddy_log_dir }}/site_{{ site.name }}.log
output file {{ caddy_log_dir }}/site_{{ site.id }}.log
}
}