2026-02-12 16:24:52 +01:00
7 changed files with 161 additions and 93 deletions
--- a/seb4itik/byow/roles/caddy/defaults/main.yml
+++ b/seb4itik/byow/roles/caddy/defaults/main.yml
@@ -1,36 +1,48 @@
-# Defaults
-caddy_config_only: false
-caddy_debug: false
+# Several instances of the WAF can be deployed onto the same host if their
+# names are different and they bind to different ports/interfaces. These
+# instances may use different versions of Go, xcaddy, Caddy, and Coraza.
+caddy_my_name: "mywaf"
 caddy_http_port: 80
 caddy_https_port: 443
 caddy_default_bind: ""

-caddy_version: "2.10.2"
-caddy_go_version: "1.25.6"
-caddy_xcaddy_version: "0.4.5"
-caddy_coraza_caddy_version: "2.1.0"  # Coraza v3.3.3
-caddy_owasp_crs_versions: ["4.22.0"]
+# If true, will not install software, just deploy Caddy and OWASP CRS
+# configuration files.
+caddy_config_only: false

-caddy_my_name: "mywaf"
-caddy_system_user: "{{ caddy_my_name }}"
-caddy_system_group: "{{ caddy_my_name }}"
-caddy_home_dir: "/opt/{{ caddy_my_name }}"
-caddy_config_dir: "/etc/{{ caddy_my_name }}"
-caddy_log_dir: "/var/log/{{ caddy_my_name }}"
+# Debug will go to /var/log/<caddy_my_name>/debug.log.
+caddy_debug: false

-# Required for Let's Encrypt auto certificates
+# Required for Let's Encrypt auto certificates.
 caddy_email: null

-# If a custom CA root have to be used
+# If a custom CA root have to be used.
 caddy_ca_root: null

+# Accound id and license key are required if a site use Geoip filtering.
 # See: https://dev.maxmind.com/geoip/updating-databases/
 caddy_geoip_account_id: null    
 caddy_geoip_license_key: null
 caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
 caddy_geoip_update_frequency: 86400   # In seconds

+# Sotware versions
+caddy_version: "2.10.2"
+caddy_go_version: "1.25.6"
+caddy_xcaddy_version: "0.4.5"
+caddy_coraza_caddy_version: "v2@v2.1.0"  # Coraza v3.3.3
+# Different sites can use different versions of OWASP CRS
+caddy_owasp_crs_versions: ["4.22.0"]

+# Paths
+caddy_binary: "/usr/local/bin/{{ caddy_my_name }}"
+caddy_system_user: "{{ caddy_my_name }}"
+caddy_system_group: "{{ caddy_my_name }}"
+caddy_home_dir: "/opt/{{ caddy_my_name }}"
+caddy_config_dir: "/etc/{{ caddy_my_name }}"
+caddy_log_dir: "/var/log/{{ caddy_my_name }}"
+
+# OWASP CRS plugins that will can be actived per site.
 # Cf.: https://github.com/coreruleset/plugin-registry
 caddy_crs_plugins:
  - name: "drupal-rule-exclusions"
@@ -52,15 +64,16 @@ caddy_crs_plugins:
    provider: "EsadCetiner"


-# For each site, mandatories parameters
+# Sites
 caddy_sites: []
-# - id: ""
-#   name: ""
-#   paths:
-#     - path: ""  (default "*")
-#       addrs:    (minimum 1 required)
-#         - ""
+# - id: ""            # Mandatory: short id for the site (for site specific directories and files)
+#   name: ""          # Mandatory: canonical domain name
+#   paths:            # Mandatory: targets for the reverse proxy
+#     - path: ""      # Optionnal: path of the request, default "*"
+#       addrs:        # Mandatory: upstreams
+#         - ""        # Mandatory: URL of the upstream, minimum 1 required


-# Will be merged with caddy_global_sites_defaults
+# For overriding default global parameters. Will be merged with
+# caddy_global_sites_defaults (in vars/main.yml).
 caddy_my_sites_defaults: {}
--- a/seb4itik/byow/roles/caddy/tasks/caddy_install.yml
+++ b/seb4itik/byow/roles/caddy/tasks/caddy_install.yml
@@ -4,7 +4,6 @@
      - "git"
      - "libnss3-tools"
      - "ssl-cert"
-#     - "geoipupdate"

 - name: Create Go directory
  ansible.builtin.file:
@@ -35,15 +34,15 @@
    caddy_build_command: >
      /usr/local/xcaddy-{{ caddy_xcaddy_version }}/xcaddy build v{{ caddy_version }}
      --with github.com/pteich/caddy-tlsconsul
-      --with github.com/corazawaf/coraza-caddy/v2@v{{ caddy_coraza_caddy_version }}
+      --with github.com/corazawaf/coraza-caddy/{{ caddy_coraza_caddy_version }}
      --with github.com/mholt/caddy-ratelimit
      --with github.com/steffenbusch/caddy-bot-barrier
      --with github.com/zhangjiayin/caddy-geoip2
-      --output /usr/local/bin/{{ caddy_my_name }}
+      --output {{ caddy_binary }}

 - name: Remember and test Caddy version
  ansible.builtin.copy:
-    dest: "/usr/local/bin/.caddy.build"
+    dest: "/usr/local/bin/.caddy.{{ caddy_my_name }}.build"
    content: >
      XCADDY_WHICH_GO=/usr/local/go-{{ caddy_go_version }}/go/bin/go
      {{ caddy_build_command }}"
@@ -57,7 +56,7 @@
    XCADDY_WHICH_GO: "/usr/local/go-{{ caddy_go_version }}/go/bin/go"
  ansible.builtin.command:
    cmd: "{{ caddy_build_command }}"
-    creates: "/usr/local/bin/{{ caddy_my_name }}"
+    creates: "{{ caddy_binary }}"
  notify:
    - "Restart Caddy"

@@ -75,23 +74,21 @@
    system: true
    home: "{{ caddy_home_dir }}"

- name: Create Caddy config directories
+- name: Create Caddy directories
  ansible.builtin.file:
-    path: "{{ item }}"
+    path: "{{ item.path }}"
    state: "directory"
+    owner: "{{ item.owner | default('root') }}"
    group: "{{ caddy_system_group }}"
-    mode: "0750"
+    mode: "{{ item.mode | default('0750') }}"
  loop:
-    - "{{ caddy_config_dir }}"
-    - "{{ caddy_config_dir }}/crs-plugins"
-    - "{{ caddy_config_dir }}/sites"
-
- name: Create Caddy log dir
-  ansible.builtin.file:
-    path: "{{ caddy_log_dir }}"
-    state: "directory"
-    group: "{{ caddy_system_group }}"
-    mode: "0770"
+    - path: "{{ caddy_config_dir }}"
+    - path: "{{ caddy_config_dir }}/crs-plugins"
+    - path: "{{ caddy_config_dir }}/sites"
+    - path: "{{ caddy_log_dir }}"
+      mode: "0770"
+    - path: "{{ caddy_home_dir }}/geoip2"
+      owner: "{{ caddy_system_user }}"

 - name: Install OWASP CRS
  loop: "{{ caddy_owasp_crs_versions }}"
@@ -105,7 +102,7 @@
  loop: "{{ caddy_crs_plugins }}"
  loop_control:
    loop_var: "plugin"
-  ansible.builtin.include_tasks: "plugin_install.yml"
+  ansible.builtin.include_tasks: "caddy_install_plugin.yml"

 - name: Deploy caddy service file
  ansible.builtin.template:
--- a/seb4itik/byow/roles/caddy/tasks/caddy_install_plugin.yml
+++ b/seb4itik/byow/roles/caddy/tasks/caddy_install_plugin.yml
--- a/seb4itik/byow/roles/caddy/templates/Caddyfile
+++ b/seb4itik/byow/roles/caddy/templates/Caddyfile
@@ -13,8 +13,8 @@
  geoip2 {
    accountId         "{{ caddy_geoip_account_id }}"
    licenseKey        "{{ caddy_geoip_license_key }}"
-    databaseDirectory "{{ caddy_home_dir }}"
-    lockFile          "{{ caddy_home_dir }}/.geoip2.lock"
+    databaseDirectory "{{ caddy_home_dir }}/geoip2"
+    lockFile          "{{ caddy_home_dir }}/geoip2/.geoip2.lock"
    editionID         "{{ caddy_geoip_edition_ids }}"
    updateUrl         "https://updates.maxmind.com"
    updateFrequency   {{ caddy_geoip_update_frequency }}
@@ -90,13 +90,10 @@
 {% for site in caddy_sites %}

 {% if (site.site_redirect_from_aliases | default(caddy_sites_defaults.site_redirect_from_aliases)) and (site.site_aliases | default([]) | length) > 0 %}
-
 {{ site.site_aliases | join(', ') }} {
  redir https://{{ site.name }}{uri}
 }
-
 {% else %}
-
 {% for alias in site.site_aliases | default(caddy_sites_defaults.site_aliases) %}
 {{ alias }},
 {% endfor %}
@@ -110,19 +107,27 @@
      to {{ path.addrs | join(' ') }}
      header_up X-Real-IP {remote}
      lb_policy {{ site.proxy_lb_policy | default(caddy_sites_defaults.proxy_lb_policy) }}
-      # Active checks
-#     health_uri /
-#     health_interval 10s
-#     health_timeout 5s
-#     health_status 200
-      # Passive checks
-      fail_duration 30s
-      max_fails 3
-      unhealthy_latency 2000ms
-      transport http {
-#       tls_server_name {host}
-#       tls_insecure_skip_verify
-      }
+
+{% if site.proxy_active_checks | default(caddy_sites_defaults.proxy_active_checks) %}
+      health_uri {{ site.proxy_active_checks_uri | default(caddy_sites_defaults.proxy_active_checks_uri) }}
+      health_port {{ site.proxy_active_checks_port | default(caddy_sites_defaults.proxy_active_checks_port) }}
+      health_interval {{ site.proxy_active_checks_interval | default(caddy_sites_defaults.proxy_active_checks_interval) }}
+      health_timeout {{ site.proxy_active_checks_timeout | default(caddy_sites_defaults.proxy_active_checks_timeout) }}
+      health_method {{ site.proxy_active_checks_method | default(caddy_sites_defaults.proxy_active_checks_method) }}
+      health_status {{ site.proxy_active_checks_status | default(caddy_sites_defaults.proxy_active_checks_status) }}
+{% if site.proxy_active_checks_body | default(caddy_sites_defaults.proxy_active_checks_body) != None %}
+      health_body {{ site.proxy_active_checks_body | default(caddy_sites_defaults.proxy_active_checks_body) }}
+{% endif %}
+{% endif %}
+{% if site.proxy_passive_checks | default(caddy_sites_defaults.proxy_passive_checks) %}
+      fail_duration {{ site.proxy_passive_checks_fail_duration | default(caddy_sites_defaults.proxy_passive_checks_fail_duration) }}
+      max_fails {{ site.proxy_passive_checks_max_fails | default(caddy_sites_defaults.proxy_passive_checks_max_fails) }}
+      unhealthy_status {{ site.proxy_passive_checks_unhealthy_status | default(caddy_sites_defaults.proxy_passive_checks_unhealthy_status) }}
+      unhealthy_latency {{ site.proxy_passive_checks_unhealthy_latency | default(caddy_sites_defaults.proxy_passive_checks_unhealthy_latency) }}
+{% if site.proxy_passive_checks_unhealthy_request_count | default(caddy_sites_defaults.proxy_passive_checks_unhealthy_request_count) != None %}
+      unhealthy_request_count {{ site.proxy_passive_checks_unhealthy_request_count | default(caddy_sites_defaults.proxy_passive_checks_unhealthy_request_count) }}
+{% endif %}
+{% endif %}
    }
  }
 {% endfor %}
@@ -216,7 +221,13 @@

 {% if site.cors | default(caddy_sites_defaults.cors) %}
 {% for origin in site.cors_allow_origins | mandatory %}
-  import cors {{ origin }} "{{ site.cors_allow_methods | default(caddy_sites_defaults.cors_allow_methods) | join(', ') }}" "{{ site.cors_allow_headers | default(caddy_sites_defaults.cors_allow_headers) | join(', ') }}" "{{ site.cors_allow_credentials | default(caddy_sites_defaults.cors_allow_credentials) | ternary('true', 'false') }}" "{{ site.cors_max_age | default(caddy_sites_defaults.cors_max_age) }}" "{{ site.cors_vary | default(caddy_sites_defaults.cors_vary) | join(', ') }}" "{{ site.cors_expose_headers | default(caddy_sites_defaults.cors_expose_headers) | join(', ') }}"
+  import cors {{ origin }} "{{
+    site.cors_allow_methods | default(caddy_sites_defaults.cors_allow_methods) | listadddel(site.cors_allow_methods_add | default([]), site.cors_allow_methods_del | default([])) | join(', ') }}" "{{
+    site.cors_allow_headers | default(caddy_sites_defaults.cors_allow_headers) | listadddel(site.cors_allow_headers_add | default([]), site.cors_allow_headers_del | default([])) | join(', ') }}" "{{
+    site.cors_allow_credentials | default(caddy_sites_defaults.cors_allow_credentials) | ternary('true', 'false') }}" "{{
+    site.cors_max_age | default(caddy_sites_defaults.cors_max_age) }}" "{{
+    site.cors_vary | default(caddy_sites_defaults.cors_vary) | listadddel(site.cors_vary_add | default([]), site.cors_vary_del | default([]))  | join(', ') }}" "{{
+    site.cors_expose_headers | default(caddy_sites_defaults.cors_expose_headers) | listadddel(site.cors_expose_headers_add | default([]), site.cors_expose_headers_del | default([]))  | join(', ') }}"
 {% endfor %}
  import cors-deny
 {% endif %}
@@ -235,10 +246,9 @@

  header {
    Content-Security-Policy      "{{ caddy_sites_defaults.header_content_security_policy | combine(site.header_content_security_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
-# FIXME
-#   Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_sites_defaults.header_cross_origin_embedder_policy) }}"
-#   Cross-Origin-Opener-Policy   "{{ site.header_cross_origin_opener_policy | default(caddy_sites_defaults.header_cross_origin_opener_policy) }}"
-#   Cross-Origin-Resource-Policy "{{ site.header_cross_origin_resource_policy | default(caddy_sites_defaults.header_cross_origin_resource_policy) }}"
+    Cross-Origin-Embedder-Policy "{{ site.header_cross_origin_embedder_policy | default(caddy_sites_defaults.header_cross_origin_embedder_policy) }}"
+    Cross-Origin-Opener-Policy   "{{ site.header_cross_origin_opener_policy | default(caddy_sites_defaults.header_cross_origin_opener_policy) }}"
+    Cross-Origin-Resource-Policy "{{ site.header_cross_origin_resource_policy | default(caddy_sites_defaults.header_cross_origin_resource_policy) }}"
    Feature-Policy               "{{ caddy_sites_defaults.header_feature_policy | combine(site.header_feature_policy | default({})) | dict2str(sep1=' ', sep2='; ', sep3=';') }}"
    Permissions-Policy           "{{ caddy_sites_defaults.header_permissions_policy | combine(site.header_permissions_policy | default({})) | dict2str(sep2=', ') }}"
    Referrer-Policy              "{{ site.header_referrer_policy | default(caddy_sites_defaults.header_referrer_policy) }}"
--- a/seb4itik/byow/roles/caddy/templates/caddy.service
+++ b/seb4itik/byow/roles/caddy/templates/caddy.service
@@ -1,5 +1,5 @@
 [Unit]
-Description=WAF {{ caddy_my_name }} (built with BYOW: Build Your Own WAF)
+Description=WAF ({{ caddy_my_name }}) (built with BYOW: Build Your Own WAF)
 After=network.target network-online.target
 Requires=network-online.target

@@ -7,8 +7,8 @@ Requires=network-online.target
 Type=notify
 User={{ caddy_system_user }}
 Group={{ caddy_system_group }}
-ExecStart=/usr/local/bin/{{ caddy_my_name }} run --environ --config {{ caddy_config_dir }}/Caddyfile
-ExecReload=/usr/local/bin/{{ caddy_my_name }} reload --config {{ caddy_config_dir }}/Caddyfile --force
+ExecStart={{ caddy_binary }} run --environ --config {{ caddy_config_dir }}/Caddyfile
+ExecReload={{ caddy_binary }} reload --config {{ caddy_config_dir }}/Caddyfile --force
 TimeoutStopSec=15s
 LimitNOFILE=1048576
 PrivateTmp=true
--- a/seb4itik/byow/roles/caddy/templates/crs-setup.conf
+++ b/seb4itik/byow/roles/caddy/templates/crs-setup.conf
@@ -112,7 +112,7 @@ SecAction \
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
    setvar:tx.enable_default_collections=1"

-## HTTP Policy Settings
+## Allowed HTTP methods
 SecAction \
    "id:900200,\
    phase:1,\
@@ -121,7 +121,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.allowed_methods={{ site.crs_allowed_methods | default(caddy_sites_defaults.crs_allowed_methods) | join(" ") }}'"
+    setvar:'tx.allowed_methods={{ site.crs_allowed_methods | default(caddy_sites_defaults.crs_allowed_methods) | listadddel(site.crs_allowed_methods_add | default([]), site.crs_allowed_methods_del | default([])) | join(" ") }}'"

 ## Content-Types that a client is allowed to send in a request
 SecAction \
@@ -132,7 +132,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.allowed_request_content_type={{ site.crs_allowed_request_content_type | default(caddy_sites_defaults.crs_allowed_request_content_type) | join(" ") }}'"
+    setvar:'tx.allowed_request_content_type={{ site.crs_allowed_request_content_type | default(caddy_sites_defaults.crs_allowed_request_content_type) | listadddel(site.crs_allowed_request_content_type_add | default([]), site.crs_allowed_request_content_type_del | default([])) | join(" ") }}'"

 ## Allowed HTTP versions
 SecAction \
@@ -143,7 +143,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.allowed_http_versions={{ site.crs_allowed_http_versions | default(caddy_sites_defaults.crs_allowed_http_versions) | join(" ") }}'"
+    setvar:'tx.allowed_http_versions={{ site.crs_allowed_http_versions | default(caddy_sites_defaults.crs_allowed_http_versions) | listadddel(site.crs_allowed_http_versions_add | default([]), site.crs_allowed_http_versions_del | default([])) | join(" ") }}'"

 ## Forbidden file extensions
 SecAction \
@@ -154,7 +154,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.restricted_extensions={{ site.crs_restricted_extensions | default(caddy_sites_defaults.crs_restricted_extensions) | join(" ") }}'"
+    setvar:'tx.restricted_extensions={{ site.crs_restricted_extensions | default(caddy_sites_defaults.crs_restricted_extensions) | listadddel(site.crs_restricted_extensions_add | default([]), site.crs_restricted_extensions_del | default([])) | join(" ") }}'"

 ## Restricted request headers
 SecAction \
@@ -165,7 +165,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.restricted_headers_basic={{ site.crs_restricted_headers_basic | default(caddy_sites_defaults.crs_restricted_headers_basic) | join(" ") }}'"
+    setvar:'tx.restricted_headers_basic={{ site.crs_restricted_headers_basic | default(caddy_sites_defaults.crs_restricted_headers_basic) | listadddel(site.restricted_headers_basic_add | default([]), site.restricted_headers_basic_del | default([])) | join(" ") }}'"

 ## Extended restricted request headers (forbidden at a higher paranoia level)
 SecAction \
@@ -176,7 +176,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.restricted_headers_extended={{ site.crs_restricted_headers_extended | default(caddy_sites_defaults.crs_restricted_headers_extended) | join(" ") }}'"
+    setvar:'tx.restricted_headers_extended={{ site.crs_restricted_headers_extended | default(caddy_sites_defaults.crs_restricted_headers_extended) | listadddel(site.restricted_headers_extended_add | default([]), site.restricted_headers_extended_del | default([])) | join(" ") }}'"

 ## Content-Types charsets that a client is allowed to send in a request
 SecAction \
@@ -187,7 +187,7 @@ SecAction \
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
-    setvar:'tx.allowed_request_content_type_charset={{ caddy_sites_defaults.crs_allowed_request_content_type_charset | default(caddy_sites_defaults.crs_allowed_request_content_type_charset) | join(" ") }}'"
+    setvar:'tx.allowed_request_content_type_charset={{ caddy_sites_defaults.crs_allowed_request_content_type_charset | default(caddy_sites_defaults.crs_allowed_request_content_type_charset) | listadddel(site.allowed_request_content_type_charset_add | default([]), site.allowed_request_content_type_charset_del | default([])) | join(" ") }}'"

 ## Block request if number of arguments is too high
 SecAction \
--- a/seb4itik/byow/roles/caddy/vars/main.yml
+++ b/seb4itik/byow/roles/caddy/vars/main.yml
@@ -5,13 +5,15 @@ caddy_global_sites_defaults:
  site_aliases: []
  site_redirect_from_aliases: true

-
  # Log settings
+  # If log_to_file is true, logs will go:
+  # - for each site, in: /var/log/<caddy_my_name>/site_<site id>.log
+  # - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
  log_to_file: false
  log_format: "json"

-
  # Proxy settings
+  # See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#lb_policy
  proxy_lb_policy: "ip_hash"  # random
                              # random_choose <n>
                              # first
@@ -25,27 +27,50 @@ caddy_global_sites_defaults:
                              # header [field]
                              # cookie [<name> [<secret>]]

+  # Upstreams active checks
+  # See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#active-health-checks
+  proxy_active_checks: false
+  proxy_active_checks_uri: "/"
+  proxy_active_checks_port: 80
+  proxy_active_checks_interval: "30s"
+  proxy_active_checks_timeout: "5s"
+  proxy_active_checks_method: "GET"
+  proxy_active_checks_status: "2xx"
+  proxy_active_checks_body: null
+
+  # Upstreams passive checks
+  # See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#passive-health-checks
+  proxy_passive_checks: false
+  proxy_passive_checks_fail_duration: "30s"
+  proxy_passive_checks_max_fails: 1
+  proxy_passive_checks_unhealthy_status: "5xx"
+  proxy_passive_checks_unhealthy_latency: "2000ms"
+  proxy_passive_checks_unhealthy_request_count: null

  # Filters
-  filter_blacklist: []   # Superseeds filter_whitelist
+  filter_blacklist: []        # Superseeds filter_whitelist
  filter_whitelist: ["127.0.0.1"]

-
  # Custom TLS certificate
  custom_cert: false
-  custom_cert_file: ""
-  custom_cert_key_file: ""
-
+  custom_cert_file: null      # Mandatory if custum_cert is true
+  custom_cert_key_file: null  # Mandatory if custum_cert is true

  # CORS - Cross Origin Resource Sharing
  cors: false
-  cors_allow_origins: null        # Mandatory
+  cors_allow_origins: []      # Minimum 1 required
  cors_allow_methods:
+  # These variables can be used for adding and removing extensions from the list:
+  # cors_allow_methods_add: ["XXX"]
+  # cors_allow_methods_del: ["YYY"]
    - "GET"
    - "HEAD"
    - "POST"
    - "OPTIONS"
  cors_allow_headers:
+  # These variables can be used for adding and removing extensions from the list:
+  # cors_allow_headers_add: ["Xxx"]
+  # cors_allow_headers_del: ["Yyy"]
    - "Cache-Control"
    - "Content-Type"
    - "If-Modified-Since"
@@ -54,8 +79,14 @@ caddy_global_sites_defaults:
  cors_max_age: 3600
  cors_allow_credentials: false
  cors_vary:
+  # These variables can be used for adding and removing extensions from the list:
+  # cors_vary_add: ["Xxx"]
+  # cors_vary_del: ["Yyy"]
    - "Origin"
  cors_expose_headers:
+  # These variables can be used for adding and removing extensions from the list:
+  # cors_expose_headers_add: ["Xxx"]
+  # cors_expose_headers_del: ["Yyy"]
    - "Content-Length"
    - "Content-Range"

@@ -240,20 +271,17 @@ caddy_global_sites_defaults:
    - name: "X-BYOW"
      value: "🍷"

-
  # caddy-ratelimit
  rate_limit: true
  rate_limit_events: 1000
  rate_limit_window: "1m"

-
  # steffenbusch/caddy-bot-barrier
  bot_barrier: false
  bot_barrier_secret: null     # Required
  bot_barrier_complexity: 18
  bot_barrier_valid_for: "60m"

-
  # corazawaf/coraza-caddy
  crs: true
  crs_version: "4.22.0"
@@ -262,7 +290,7 @@ caddy_global_sites_defaults:
  crs_exceptions:
    before_request: []
    after_response: []
-  crs_paranoia_level: 1
+  crs_paranoia_level: 4
  crs_detection_paranoia_level: null
  crs_enforce_bodyproc_urlencoded: 1
  crs_critical_anomaly_score: 5
@@ -280,11 +308,17 @@ caddy_global_sites_defaults:
  crs_combined_file_sizes: 20970520  # 20 Mo
  crs_sampling_percentage: 100
  crs_allowed_methods:
+  # These variables can be used for adding and removing extensions from the list:
+  # crs_allowed_methods_add: ["XXX"]
+  # crs_allowed_methods_del: ["YYY"]
    - "GET"
    - "HEAD"
    - "POST"
    - "OPTIONS"
  crs_allowed_request_content_type:
+  # These variables can be used for adding and removing extensions from the list:
+  # crs_allowed_request_content_type_add: ["|xxx/yyy|"]
+  # crs_allowed_request_content_type_del: ["|zzz/aaa|"]
    - "|application/csp-report|"
    - "|application/json|"
    - "|application/reports+json|"
@@ -294,6 +328,9 @@ caddy_global_sites_defaults:
    - "|multipart/form-data|"
    - "|text/xml|"
  crs_restricted_extensions:
+  # These variables can be used for adding and removing extensions from the list:
+  # crs_restricted_extensions_add: [".xxx/"]
+  # crs_restricted_extensions_del: [".yyy/"]
    - ".ani/"
    - ".asa/"
    - ".asax/"
@@ -388,6 +425,9 @@ caddy_global_sites_defaults:
    - ".xsd/"
    - ".xsx/"
  crs_restricted_headers_basic:
+  # These variables can be used for adding and removing extensions from the list:
+  # crs_restricted_headers_basic_add: ["/xxx/"]
+  # crs_restricted_headers_basic_del: ["/yyy/"]
    - "/content-encoding/"
    - "/content-range/"
    - "/expect/"
@@ -399,8 +439,14 @@ caddy_global_sites_defaults:
    - "/x-method-override/"
    - "/x-middleware-subrequest/"
  crs_restricted_headers_extended:
+  # These variables can be used for adding and removing extensions from the list:
+  # crs_restricted_headers_extended_add: ["/xxx/"]
+  # crs_restricted_headers_extended_del: ["/yyy/"]
    - "/accept-charset/"
  crs_allowed_http_versions:
+  # These variables can be used for adding and removing extensions from the list:
+  # crs_allowed_http_versions_add: ["HTTP/x.x"]
+  # crs_allowed_http_versions_del: ["HTTP/y.y"]
    - "HTTP/1.0"
    - "HTTP/1.1"
    - "HTTP/2"
@@ -408,12 +454,14 @@ caddy_global_sites_defaults:
    - "HTTP/3"
    - "HTTP/3.0"
  crs_allowed_request_content_type_charset:
+  # These variables can be used for adding and removing extensions from the list:
+  # crs_allowed_request_content_type_charset_add: ["|xxx|"]
+  # crs_allowed_request_content_type_charset_del: ["|yyy|"]
    - "|utf-8|"
    - "|iso-8859-1|"
    - "|iso-8859-15|"
    - "|windows-1252|"

-
  # github.com/zhangjiayin/caddy-geoip2
  geoip: false
  geoip_debug: false