itik/bgwaf
Private
Public Access
2
0
Fork 0
Code Issues Pull Requests Releases 9 Activity
Files
0e83e7d593e8934279bc029dc26363c48f7671c8
bgwaf/seb4itik/byow/roles/caddy/vars/main.yml
S. Namèche 295b19aaa8 doc
2026-02-12 06:46:54 +01:00

472 lines
14 KiB
YAML
Raw Blame History

# Sites default parameter values
caddy_global_sites_defaults:
# Site settings
site_aliases: []
site_redirect_from_aliases: true
# Log settings
# If log_to_file is true, logs will go:
# - for each site, in: /var/log/<caddy_my_name>/site_<site id>.log
# - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
log_to_file: false
log_format: "json"
# Proxy settings
# See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#lb_policy
proxy_lb_policy: "ip_hash" # random
# random_choose <n>
# first
# round_robin
# weighted_round_robin <weights...>
# least_conn
# ip_hash
# client_ip_hash
# uri_hash
# query [key]
# header [field]
# cookie [<name> [<secret>]]
# Upstreams active checks
# See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#active-health-checks
proxy_active_checks: false
proxy_active_checks_uri: "/"
proxy_active_checks_port: 80
proxy_active_checks_interval: "30s"
proxy_active_checks_timeout: "5s"
proxy_active_checks_method: "GET"
proxy_active_checks_status: "2xx"
proxy_active_checks_body: null
# Upstreams passive checks
# See: https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#passive-health-checks
proxy_passive_checks: false
proxy_passive_checks_fail_duration: "30s"
proxy_passive_checks_max_fails: 1
proxy_passive_checks_unhealthy_status: "5xx"
proxy_passive_checks_unhealthy_latency: "2000ms"
proxy_passive_checks_unhealthy_request_count: null
# Filters
filter_blacklist: [] # Superseeds filter_whitelist
filter_whitelist: ["127.0.0.1"]
# Custom TLS certificate
custom_cert: false
custom_cert_file: null # Mandatory if custum_cert is true
custom_cert_key_file: null # Mandatory if custum_cert is true
# CORS - Cross Origin Resource Sharing
cors: false
cors_allowed_origins: [] # Minimum 1 required
cors_allowed_methods:
# These variables can be used for adding and removing methods from the list:
# cors_allowed_methods_add: ["XXX"]
# cors_allowed_methods_del: ["YYY"]
- "GET"
- "HEAD"
- "POST"
- "OPTIONS"
cors_allowed_headers:
# These variables can be used for adding and removing headers from the list:
# cors_allowed_headers_add: ["Xxx"]
# cors_allowed_headers_del: ["Yyy"]
- "Cache-Control"
- "Content-Type"
- "If-Modified-Since"
- "Range"
- "User-Agent"
cors_max_age: 3600
cors_allowed_credentials: false
cors_vary:
# These variables can be used for adding and removing headers from the list:
# cors_vary_add: ["Xxx"]
# cors_vary_del: ["Yyy"]
- "Origin"
cors_exposed_headers:
# These variables can be used for adding and removing headers from the list:
# cors_exposed_headers_add: ["Xxx"]
# cors_exposed_headers_del: ["Yyy"]
- "Content-Length"
- "Content-Range"
# Security headers
header_content_security_policy:
# https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#detailed-csp-directives
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy#directives
## Fetch directives
child-src: "'self'"
connect-src: "'self'"
font-src: "'self'"
img-src: "'self'"
manifest-src: "'self'"
media-src: "'self'"
# Deprecated: prefetch-src: "'self'"
object-src: "'none'"
script-src: "'none'"
script-src-attr: "'none'"
script-src-elem: "'none'"
style-src: "'self'"
style-src-attr: "'self'"
style-src-elem: "'self'"
default-src: "'self'"
## Document directives
# base-uri
# plugin-types
# sandbox
## Navigation directives
form-action: "'self'"
frame-ancestors: "'self'"
# https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-src
frame-src: "'self'"
# https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/worker-src
worker-src: "'self'"
# https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/block-all-mixed-content
block-all-mixed-content:
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/fenced-frame-src
fenced-frame-src: "'self'"
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/upgrade-insecure-requests
upgrade-insecure-requests:
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
header_cross_origin_embedder_policy: "require-corp"
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
header_cross_origin_opener_policy: "same-origin"
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Resource-Policy
header_cross_origin_resource_policy: "same-site"
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
header_permissions_policy:
accelerometer: "()"
ambient-light-sensor: "()"
aria-notify: "()"
attribution-reporting: "()"
autoplay: "()"
bluetooth: "()"
browsing-topics: "()"
camera: "()"
captured-surface-control: "()"
compute-pressure: "()"
cross-origin-isolated: "()"
deferred-fetch: "()"
deferred-fetch-minimal: "()"
display-capture: "()"
encrypted-media: "()"
fullscreen: "()"
gamepad: "()"
geolocation: "()"
gyroscope: "()"
hid: "()"
identity-credentials-get: "()"
idle-detection: "()"
language-detector: "()"
local-fonts: "()"
magnetometer: "()"
microphone: "()"
midi: "()"
on-device-speech-recognition: "()"
otp-credentials: "()"
payment: "()"
picture-in-picture: "()"
private-state-token-issuance: "()"
private-state-token-redemption: "()"
publickey-credentials-create: "()"
publickey-credentials-get: "()"
screen-wake-lock: "()"
serial: "()"
speaker-selection: "()"
storage-access: "()"
translator: "()"
summarizer: "()"
usb: "()"
web-share: "()"
window-management: "()"
xr-spatial-tracking: "()"
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#floc-federated-learning-of-cohorts
interest-cohort: "()"
# ???
battery: "()"
document-domain: "()"
execution-while-not-rendered: "()"
execution-while-out-of-viewport: "()"
navigation-override: "()"
# https://www.geeksforgeeks.org/computer-networks/http-headers-feature-policy/
header_feature_policy:
accelerometer: "'none'"
ambient-light-sensor: "'none'"
autoplay: "'none'"
battery: "'none'"
camera: "'none'"
display-capture: "'none'"
document-domain: "'none'"
encrypted-media: "'none'"
fullscreen: "'none'"
geolocation: "'none'"
gyroscope: "'none'"
layout-animation: "'none'"
legacy-image-formats: "'none'"
magnetometer: "'none'"
microphone: "'none'"
midi: "'none'"
oversized-images: "'none'"
payment: "'none'"
picture-in-picture: "'none'"
publickey-credentials-get: "'none'"
sync-xhr: "'none'"
usb: "'none'"
screen-wake-lock: "'none'"
xr-spatial-tracking: "'none'"
# ???
execution-while-not-rendered: "'none'"
execution-while-out-of-viewport: "'none'"
navigation-override: "'none'"
speaker-selection: "'none'"
unoptimized-images: "'none'"
unsized-media: "'none'"
web-share: "'none'"
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy
header_referrer_policy: "strict-origin-when-cross-origin"
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
header_strict_transport_security: "max-age=2635200; includeSubDomains"
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
header_x_content_type_options: "nosniff"
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options
header_x_frame_options: "DENY"
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-robots-tag
header_x_robots_tag: "noindex, nofollow"
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#content-type
header_default_content_type: "text/html; charset=UTF-8"
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#set-cookie
header_cookies_attributes: "SameSite=None; Secure;"
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-dns-prefetch-control
# FIXME
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#server
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnet-version
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnetmvc-version
# https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by
header_delete:
- "Server"
- "Via"
- "X-AspNet-Version"
- "X-AspNetMvc-Version"
- "X-Powered-By"
header_add:
- name: "X-BYOW"
value: "🍷"
# caddy-ratelimit
rate_limit: true
rate_limit_events: 1000
rate_limit_window: "1m"
# steffenbusch/caddy-bot-barrier
bot_barrier: false
bot_barrier_secret: null # Required
bot_barrier_complexity: 18
bot_barrier_valid_for: "60m"
# corazawaf/coraza-caddy
crs: true
crs_version: "4.22.0"
crs_log_only: false
crs_plugins: []
crs_exceptions:
before_request: []
after_response: []
crs_paranoia_level: 4
crs_detection_paranoia_level: null
crs_enforce_bodyproc_urlencoded: 1
crs_critical_anomaly_score: 5
crs_error_anomaly_score: 4
crs_warning_anomaly_score: 3
crs_notice_anomaly_score: 2
crs_inbound_anomaly_score_threshold: 5
crs_outbound_anomaly_score_threshold: 4
crs_reporting_level: 4
crs_max_num_args: 255
crs_arg_name_length: 100
crs_arg_length: 1000
crs_total_arg_length: 64000
crs_max_file_size: 10485760 # 10 Mo
crs_combined_file_sizes: 20970520 # 20 Mo
crs_sampling_percentage: 100
crs_allow_method_override_parameter: 0
crs_allowed_methods:
# These variables can be used for adding and removing methods from the list:
# crs_allowed_methods_add: ["XXX"]
# crs_allowed_methods_del: ["YYY"]
- "GET"
- "HEAD"
- "POST"
- "OPTIONS"
crs_allowed_request_content_type:
# These variables can be used for adding and removing content types from the list:
# crs_allowed_request_content_type_add: ["|xxx/yyy|"]
# crs_allowed_request_content_type_del: ["|zzz/aaa|"]
- "|application/json|"
- "|application/soap+xml|"
- "|application/x-www-form-urlencoded|"
- "|application/xml|"
- "|multipart/form-data|"
- "|text/xml|"
crs_restricted_extensions:
# These variables can be used for adding and removing extensions from the list:
# crs_restricted_extensions_add: [".xxx/"]
# crs_restricted_extensions_del: [".yyy/"]
- ".ani/"
- ".asa/"
- ".asax/"
- ".ascx/"
- ".back/"
- ".backup/"
- ".bak/"
- ".bat/"
- ".bck/"
- ".bk/"
- ".bkp/"
- ".cdx/"
- ".cer/"
- ".cfg/"
- ".cmd/"
- ".cnf/"
- ".com/"
- ".compositefont/"
- ".conf/"
- ".config/"
- ".copy/"
- ".crt/"
- ".cs/"
- ".csproj/"
- ".csr/"
- ".dat/"
- ".db/"
- ".dbf/"
- ".dist/"
- ".dll/"
- ".dos/"
- ".dpkg-dist/"
- ".drv/"
- ".gadget/"
- ".hta/"
- ".htr/"
- ".htw/"
- ".ida/"
- ".idc/"
- ".idq/"
- ".inc/"
- ".inf/"
- ".ini/"
- ".jks/"
- ".jse/"
- ".key/"
- ".licx/"
- ".lnk/"
- ".log/"
- ".mdb/"
- ".msc/"
- ".ocx/"
- ".old/"
- ".pass/"
- ".pdb/"
- ".pem/"
- ".pfx/"
- ".pif/"
- ".pol/"
- ".prf/"
- ".printer/"
- ".pwd/"
- ".rdb/"
- ".rdp/"
- ".reg/"
- ".resources/"
- ".resx/"
- ".sav/"
- ".save/"
- ".scr/"
- ".sct/"
- ".sh/"
- ".shs/"
- ".sql/"
- ".sqlite/"
- ".sqlite3/"
- ".swap/"
- ".swo/"
- ".swp/"
- ".sys/"
- ".temp/"
- ".tfstate/"
- ".tlb/"
- ".tmp/"
- ".vb/"
- ".vbe/"
- ".vbproj/"
- ".vbs/"
- ".vsdisco/"
- ".vxd/"
- ".webinfo/"
- ".ws/"
- ".wsc/"
- ".wsf/"
- ".wsh/"
- ".xsd/"
- ".xsx/"
crs_restricted_headers_basic:
# These variables can be used for adding and removing headers from the list:
# crs_restricted_headers_basic_add: ["/xxx/"]
# crs_restricted_headers_basic_del: ["/yyy/"]
- "/content-encoding/"
- "/content-range/"
- "/expect/"
- "/if/"
- "/lock-token/"
- "/proxy/"
- "/x-http-method-override/"
- "/x-http-method/"
- "/x-method-override/"
- "/x-middleware-subrequest/"
crs_restricted_headers_extended:
# These variables can be used for adding and removing headers from the list:
# crs_restricted_headers_extended_add: ["/xxx/"]
# crs_restricted_headers_extended_del: ["/yyy/"]
- "/accept-charset/"
crs_allowed_http_versions:
# These variables can be used for adding and removing protocols from the list:
# crs_allowed_http_versions_add: ["HTTP/x.x"]
# crs_allowed_http_versions_del: ["HTTP/y.y"]
- "HTTP/1.0"
- "HTTP/1.1"
- "HTTP/2"
- "HTTP/2.0"
- "HTTP/3"
- "HTTP/3.0"
crs_allowed_request_content_type_charset:
# These variables can be used for adding and removing charsets from the list:
# crs_allowed_request_content_type_charset_add: ["|xxx|"]
# crs_allowed_request_content_type_charset_del: ["|yyy|"]
- "|utf-8|"
- "|iso-8859-1|"
- "|iso-8859-15|"
- "|windows-1252|"
# github.com/zhangjiayin/caddy-geoip2
geoip: false
geoip_debug: false
geoip_filter_expression: '{geoip2.country_code} == "UNK"'
Reference in New Issue View Git Blame Copy Permalink