caddy: crs: fix plugins versions

seb4itik/byow/galaxy.yml

@@ -1,6 +1,6 @@
 namespace: "seb4itik"
 name: "byow"
-version: "0.3.4"
+version: "0.4.1"
 readme: "README.md"
 authors:
 - "S. Namèche <sebastien@itik.fr>"

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -7,9 +7,9 @@ caddy_https_port: 443
 caddy_default_bind: null
 
 # Sotware versions
-caddy_go_version: "1.26.1"
+caddy_go_version: "1.26.3"
 caddy_xcaddy_version: "0.4.5"
-caddy_version: "2.11.2"
+caddy_version: "2.11.3"
 
 # If true, will not install software, just deploy Caddyfile and OWASP CRS
 # configuration files.
@@ -21,8 +21,8 @@ caddy_config_only: false
 # - for each site, in: /var/log/<caddy_my_name>/site_<sit.id>.log
 # - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
 caddy_log_to_file: true
-caddy_log_format: "console"                # "console" or "json"
-caddy_log_debug: false                         # Debug will go to /var/log/<caddy_my_name>/debug.log
+caddy_log_format: "console"            # "console" or "json"
+caddy_log_debug: false                 # Debug will go to /var/log/<caddy_my_name>/debug.log
 
 # Paths
 caddy_binary: "/usr/local/sbin/caddy_{{ caddy_my_name }}"  # Should begin by "caddy" for CrowdSec
@@ -74,35 +74,48 @@ caddy_bot_barrier: false
 
 # Coraza
 caddy_coraza: true
-caddy_coraza_caddy_version: "v2@v2.2.0"  # Coraza v3.3.3
+caddy_coraza_caddy_version: "v2@v2.5.0"  # Coraza v3.7.0
 # Different sites can use different versions of OWASP CRS
-caddy_coraza_crs_versions: ["4.24.1"]
+caddy_coraza_crs_versions: [
+  "4.25.0",  # LTS
+  "4.26.0"
+]
 # OWASP CRS plugins that can be actived per site.
 # Cf.: https://github.com/coreruleset/plugin-registry
+# FIXME: https://github.com/coreruleset/referer-hardening-plugin
 caddy_coraza_crs_plugins:
-  - name: "drupal-rule-exclusions"
+  - name: "cpanel-rule-exclusions"
     version: "1.0.0"
-  - name: "wordpress-rule-exclusions"
-    version: "1.2.0"
-  - name: "nextcloud-rule-exclusions"
-    version: "1.5.0"
   - name: "dokuwiki-rule-exclusions"
     version: "1.0.0"
-  - name: "phpmyadmin-rule-exclusions"
+  - name: "drupal-rule-exclusions"
     version: "1.0.0"
-    has_after_config: true
+  - name: "google-oauth2"
+    version: "1.0.0"
+  - name: "nextcloud-rule-exclusions"
+    version: "1.6.0"
+  - name: "phpbb-rule-exclusions"
+    version: "1.0.0"
+  - name: "plausible-rule-exclusions"
+    version: "1.0.0"
+    provider: "EsadCetiner"
   - name: "roundcube-rule-exclusions"
     version: "1.0.4"
     provider: "EsadCetiner"
   - name: "sogo-rule-exclusions"
     version: "1.0.4"
     provider: "EsadCetiner"
+  - name: "wordpress-rule-exclusions"
+    version: "1.2.0"
+  - name: "xenforo-rule-exclusions"
+    version: "1.0.0"
 
 
 # Sites
 caddy_sites: []
 # - id: ""                   # Mandatory: short id for the site (for site specific directories and files)
 #   name: ""                 # Mandatory: canonical domain name
+#   no_upstream_host: false  # Optionnal: Host header hostport, not upstream_hostport, default false
 #   paths:                   # Mandatory: targets for the reverse proxy
 #     - path: "*"            # Optionnal: path of the request, default "*"
 #       strip_prefix: false  # Optionnal: default "false"

seb4itik/byow/roles/caddy/templates/Caddyfile

@@ -136,7 +136,7 @@
   redir https://{{ site.name }}{uri}
 }
 {% else %}
-{% for alias in site.site_aliases | default(caddy_sites_defaults.site_aliases) %}
+{% for alias in site.site_aliases | default([]) %}
 {{ alias }},
 {% endfor %}
 {% endif %}
@@ -152,6 +152,11 @@
     reverse_proxy {
       to {{ path.addrs | join(' ') }}
       header_up X-Real-IP {remote}
+{% if site.no_upstream_host | default(caddy_sites_defaults.site_no_upstream_host) %}
+      header_up Host {hostport}
+{% else %}
+      header_up Host {upstream_hostport}
+{% endif %}
       lb_policy {{ site.proxy_lb_policy | default(caddy_sites_defaults.proxy_lb_policy) }}
 
 {% if site.proxy_active_checks | default(caddy_sites_defaults.proxy_active_checks) %}
@@ -178,8 +183,8 @@
   }
 {% endfor %}
 
-{% if site.custom_cert | default (caddy_sites_defaults.custom_cert) %}
-  tls {{ site.custom_cert_file }} {{ site.custom_cert_key_file }}
+{% if site.custom_cert | default(caddy_sites_defaults.custom_cert) %}
+  tls {{ site.custom_cert_file | default(caddy_sites_defaults.custom_cert_file) }} {{ site.custom_cert_key_file | default(caddy_sites_defaults.custom_cert_key_file) }}
 {% endif %}
 
 {% if site.filter_blacklist | default(caddy_sites_defaults.filter_blacklist) | length > 0 %}

seb4itik/byow/roles/caddy/vars/main.yml

@@ -2,8 +2,9 @@
 caddy_global_sites_defaults:
 
   # Site aliases
-  site_aliases_redirect: true
   site_aliases: []
+  site_aliases_redirect: true
+  site_no_upstream_host: false
 
   # Proxy settings
   # See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#lb_policy
@@ -280,7 +281,7 @@ caddy_global_sites_defaults:
 
   # corazawaf/coraza-caddy
   crs: true
-  crs_version: "4.24.1"
+  crs_version: "4.25.0"   # LTS
   crs_log_only: false
   crs_plugins: []
   crs_exceptions:

seb4itik/byow/roles/consul/defaults/main.yml

@@ -12,7 +12,7 @@ consul_ui_secret_id: null         # Generate with "uuidgen"
 
 # Defaults.
 consul_domain: "consul"
-consul_version: "1.22.3"
+consul_version: "1.22.7"
 consul_client_addr: "127.0.0.1"
 consul_bind_addr: "{{ ansible_default_ipv4.address }}"
 consul_default_check_interval: "15s"