S. Namèche
5199567bda
Some checks failed
Publish collection to Galaxy / publish (push) Failing after 42s
117 lines
4.4 KiB
YAML
117 lines
4.4 KiB
YAML
# Several instances of the WAF can be deployed onto the same host if their
|
|
# names are different and they bind to different ports/interfaces. These
|
|
# instances may use different versions of Go, xcaddy, Caddy, and Coraza.
|
|
caddy_my_name: "mywaf"
|
|
caddy_http_port: 80
|
|
caddy_https_port: 443
|
|
caddy_default_bind: null
|
|
|
|
# Sotware versions
|
|
caddy_go_version: "1.26.1"
|
|
caddy_xcaddy_version: "0.4.5"
|
|
caddy_version: "2.11.2"
|
|
|
|
# If true, will not install software, just deploy Caddyfile and OWASP CRS
|
|
# configuration files.
|
|
caddy_config_only: false
|
|
|
|
# Log settings
|
|
# If log_to_file is false, will log to journald.
|
|
# If log_to_file is true, logs will go:
|
|
# - for each site, in: /var/log/<caddy_my_name>/site_<sit.id>.log
|
|
# - for WAF logs (Coraza), in /var/log/<caddy_my_name>/waf.log
|
|
caddy_log_to_file: true
|
|
caddy_log_format: "console" # "console" or "json"
|
|
caddy_log_debug: false # Debug will go to /var/log/<caddy_my_name>/debug.log
|
|
|
|
# Paths
|
|
caddy_binary: "/usr/local/bin/caddy_{{ caddy_my_name }}" # Should begin by "caddy" for CrowdSec
|
|
caddy_system_user: "{{ caddy_my_name }}"
|
|
caddy_system_group: "{{ caddy_my_name }}"
|
|
caddy_home_dir: "/opt/{{ caddy_my_name }}"
|
|
caddy_config_dir: "/etc/{{ caddy_my_name }}"
|
|
caddy_crs_plugins_dir: "{{ caddy_config_dir }}/crs-plugins"
|
|
caddy_sites_dir: "{{ caddy_config_dir }}/sites"
|
|
caddy_log_dir: "/var/log/{{ caddy_my_name }}"
|
|
|
|
# Required for Let's Encrypt auto certificates.
|
|
caddy_email: null
|
|
|
|
# For using a Consul cluster.
|
|
caddy_consul: false
|
|
caddy_consul_server: "{{ ansible_fqdn }}:8501"
|
|
caddy_consul_delegate_to: null # Required, Consul host for running Consul commands
|
|
caddy_consul_admin_token: null # Required
|
|
caddy_consul_aes_key: null # Required, 32 characters
|
|
caddy_consul_client_cert: null # Required, CN must be "server.<consul datacenter>.<consul domain>"
|
|
# At least, SANs must include:
|
|
# - "DNS:server.<consul datacenter>.<consul domain>"
|
|
# - "DNS:<host FQDN>"
|
|
caddy_consul_client_key: null # Required
|
|
|
|
# Accound id and license key are required if a site use Geoip filtering.
|
|
# See: https://dev.maxmind.com/geoip/updating-databases/
|
|
caddy_geoip: false
|
|
caddy_geoip_account_id: null # Required
|
|
caddy_geoip_license_key: null # Required
|
|
caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
|
|
caddy_geoip_update_frequency: 86400 # In seconds
|
|
|
|
# CrowdSec
|
|
caddy_crowdsec: false
|
|
caddy_crowdsec_api_key: null # Required
|
|
caddy_crowdsec_api_url: "http://127.0.0.1:8080"
|
|
caddy_crowdsec_ticker_interval: 15 # In seconds
|
|
caddy_crowdsec_appsec_url: null # "http://localhost:7422"
|
|
caddy_crowdsec_streaming: true
|
|
caddy_crowdsec_hard_fails: true
|
|
|
|
# Rate Limit
|
|
caddy_ratelimit: true
|
|
|
|
# Bot barrier
|
|
caddy_bot_barrier: false
|
|
|
|
# Coraza
|
|
caddy_coraza: true
|
|
caddy_coraza_caddy_version: "v2@v2.2.0" # Coraza v3.3.3
|
|
# Different sites can use different versions of OWASP CRS
|
|
caddy_coraza_crs_versions: ["4.24.1"]
|
|
# OWASP CRS plugins that can be actived per site.
|
|
# Cf.: https://github.com/coreruleset/plugin-registry
|
|
caddy_coraza_crs_plugins:
|
|
- name: "drupal-rule-exclusions"
|
|
version: "1.0.0"
|
|
- name: "wordpress-rule-exclusions"
|
|
version: "1.2.0"
|
|
- name: "nextcloud-rule-exclusions"
|
|
version: "1.5.0"
|
|
- name: "dokuwiki-rule-exclusions"
|
|
version: "1.0.0"
|
|
- name: "phpmyadmin-rule-exclusions"
|
|
version: "1.0.0"
|
|
has_after_config: true
|
|
- name: "roundcube-rule-exclusions"
|
|
version: "1.0.4"
|
|
provider: "EsadCetiner"
|
|
- name: "sogo-rule-exclusions"
|
|
version: "1.0.4"
|
|
provider: "EsadCetiner"
|
|
|
|
|
|
# Sites
|
|
caddy_sites: []
|
|
# - id: "" # Mandatory: short id for the site (for site specific directories and files)
|
|
# name: "" # Mandatory: canonical domain name
|
|
# paths: # Mandatory: targets for the reverse proxy
|
|
# - path: "*" # Optionnal: path of the request, default "*"
|
|
# strip_prefix: false # Optionnal: default "false"
|
|
# addrs: # Mandatory: upstreams
|
|
# - "" # Mandatory: URL of the upstream, minimum 1 required
|
|
# ... # Site configuration directives (see caddy_global_sites_defaults in vars/main.yml)
|
|
|
|
|
|
# For overriding default global parameters. Will be merged with
|
|
# caddy_global_sites_defaults (in vars/main.yml).
|
|
caddy_my_sites_defaults: {}
|