itik/bgwaf
Private
Public Access
2
0
Fork 0
Code Issues Pull Requests Releases 9 Activity

dev #16

Merged
seb merged 29 commits from dev into main 2026-02-12 16:24:52 +01:00
Conversation 0 Commits 29 Files Changed 37 +16 -3
3 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 501cfacfe6 - Show all commits

2
seb4itik/byow/roles/caddy/defaults/main.yml
View File

@@ -32,7 +32,7 @@ caddy_go_version: "1.25.6"
caddy_xcaddy_version: "0.4.5" caddy_xcaddy_version: "0.4.5"
caddy_coraza_caddy_version: "v2@v2.1.0" # Coraza v3.3.3 caddy_coraza_caddy_version: "v2@v2.1.0" # Coraza v3.3.3
# Different sites can use different versions of OWASP CRS # Different sites can use different versions of OWASP CRS
caddy_owasp_crs_versions: ["4.22.0"] caddy_owasp_crs_versions: ["4.23.0"]
# Paths # Paths
caddy_binary: "/usr/local/bin/{{ caddy_my_name }}" caddy_binary: "/usr/local/bin/{{ caddy_my_name }}"

10
seb4itik/byow/roles/caddy/templates/crs-setup.conf
View File

@@ -123,6 +123,16 @@ SecAction \
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\ ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
setvar:'tx.allowed_methods={{ site.crs_allowed_methods | default(caddy_sites_defaults.crs_allowed_methods) | listadddel(site.crs_allowed_methods_add | default([]), site.crs_allowed_methods_del | default([])) | join(" ") }}'" setvar:'tx.allowed_methods={{ site.crs_allowed_methods | default(caddy_sites_defaults.crs_allowed_methods) | listadddel(site.crs_allowed_methods_add | default([]), site.crs_allowed_methods_del | default([])) | join(" ") }}'"
## HTTP Method Override Parameter
SecAction \
"id:900210,\
phase:1,\
pass,\
nolog,\
tag:'OWASP_CRS',\
ver:'OWASP_CRS/{{ site.crs_version | default(caddy_sites_defaults.crs_version) }}',\
setvar:'tx.allow_method_override_parameter={{ site.allow_method_override_parameter | default(caddy_sites_defaults.allow_method_override_parameter) }}'"
## Content-Types that a client is allowed to send in a request ## Content-Types that a client is allowed to send in a request
SecAction \ SecAction \
"id:900220,\ "id:900220,\

7
seb4itik/byow/roles/caddy/vars/main.yml
View File

@@ -307,6 +307,7 @@ caddy_global_sites_defaults:
crs_max_file_size: 10485760 # 10 Mo crs_max_file_size: 10485760 # 10 Mo
crs_combined_file_sizes: 20970520 # 20 Mo crs_combined_file_sizes: 20970520 # 20 Mo
crs_sampling_percentage: 100 crs_sampling_percentage: 100
crs_allow_method_override_parameter: 0
crs_allowed_methods: crs_allowed_methods:
# These variables can be used for adding and removing extensions from the list: # These variables can be used for adding and removing extensions from the list:
# crs_allowed_methods_add: ["XXX"] # crs_allowed_methods_add: ["XXX"]
@@ -319,9 +320,7 @@ caddy_global_sites_defaults:
# These variables can be used for adding and removing extensions from the list: # These variables can be used for adding and removing extensions from the list:
# crs_allowed_request_content_type_add: ["|xxx/yyy|"] # crs_allowed_request_content_type_add: ["|xxx/yyy|"]
# crs_allowed_request_content_type_del: ["|zzz/aaa|"] # crs_allowed_request_content_type_del: ["|zzz/aaa|"]
- "|application/csp-report|"
- "|application/json|" - "|application/json|"
- "|application/reports+json|"
- "|application/soap+xml|" - "|application/soap+xml|"
- "|application/x-www-form-urlencoded|" - "|application/x-www-form-urlencoded|"
- "|application/xml|" - "|application/xml|"
@@ -374,6 +373,7 @@ caddy_global_sites_defaults:
- ".inc/" - ".inc/"
- ".inf/" - ".inf/"
- ".ini/" - ".ini/"
- ".jks/"
- ".jse/" - ".jse/"
- ".key/" - ".key/"
- ".licx/" - ".licx/"
@@ -406,9 +406,12 @@ caddy_global_sites_defaults:
- ".sql/" - ".sql/"
- ".sqlite/" - ".sqlite/"
- ".sqlite3/" - ".sqlite3/"
- ".swap/"
- ".swo/"
- ".swp/" - ".swp/"
- ".sys/" - ".sys/"
- ".temp/" - ".temp/"
- ".tfstate/"
- ".tlb/" - ".tlb/"
- ".tmp/" - ".tmp/"
- ".vb/" - ".vb/"