bgwaf/seb4itik/byow/roles/caddy/defaults/main.yml

# Defaults
caddy_config_only: false
caddy_go_version: "1.25.5"
caddy_xcaddy_version: "0.4.5"
caddy_caddy_version: "2.10.2"
caddy_coraza_caddy_version: "2.1.0"  # Coraza v3.3.3
caddy_owasp_crs_version: "4.22.0"
caddy_system_user: "byow"
caddy_system_group: "byow"
caddy_home_dir: "/opt/{{ caddy_system_user }}"
caddy_config_dir: "/etc/{{ caddy_system_user }}"
caddy_log_dir: "/var/log/{{ caddy_system_user }}"

# Cf.: https://github.com/coreruleset/plugin-registry
caddy_crs_plugins:
  - name: "drupal-rule-exclusions"
    version: "1.0.0"
  - name: "wordpress-rule-exclusions"
    version: "1.2.0"
  - name: "nextcloud-rule-exclusions"
    version: "1.5.0"
  - name: "dokuwiki-rule-exclusions"
    version: "1.0.0"
  - name: "phpmyadmin-rule-exclusions"
    version: "1.0.0"
    has_after_config: true
  - name: "roundcube-rule-exclusions"
    version: "1.0.4"
    provider: "EsadCetiner"
  - name: "sogo-rule-exclusions"
    version: "1.0.4"
    provider: "EsadCetiner"

# Required unless not site.custom_cert
caddy_email: null

# Required if site.bot_barrier
caddy_bot_barrier_secret: null

# Optionnal
caddy_local_ca_name: null
caddy_ca_root: null

caddy_sites: []
# - name: ""
#   site: ""
#   paths:
#     - path: "*"
#       addrs:
#         - ""
#   blacklist:
#     - ""
#   aliases:
#     - ""
#   crs_exceptions:
#     before_request:
#       - ""
#     after_response:
#       - ""

caddy_waf_defaults:
  redirect_from_aliases: true
  custom_cert: false
  custom_cert_file: ""
  custom_key_file: ""

  # Security headers
  header_content_security_policy:

    # https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html#detailed-csp-directives
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy#directives
    ## Fetch directives
    child-src: "'self'"
    connect-src: "'self'"
    font-src: "'self'"
    img-src: "'self'"
    manifest-src: "'self'"
    media-src: "'self'"
    # Deprecated: prefetch-src: "'self'"
    object-src: "'none'"
    script-src: "'none'"
    script-src-attr: "'none'"
    script-src-elem: "'none'"
    style-src: "'self'"
    style-src-attr: "'self'"
    style-src-elem: "'self'"
    default-src: "'self'"
    ## Document directives
    # base-uri
    # plugin-types
    # sandbox
    ## Navigation directives
    form-action: "'self'"
    frame-ancestors: "'self'"
    # https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-src
    frame-src: "'self'"
    # https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/worker-src
    worker-src: "'self'"
    # https://developer.mozilla.org/fr/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/block-all-mixed-content
    block-all-mixed-content:
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/fenced-frame-src
    fenced-frame-src: "'self'"
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/upgrade-insecure-requests
    upgrade-insecure-requests:

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
  header_cross_origin_embedder_policy: "require-corp"

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
  header_cross_origin_opener_policy: "same-origin"

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Resource-Policy
  header_cross_origin_resource_policy: "same-site"

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
  header_permissions_policy:
    accelerometer: "()"
    ambient-light-sensor: "()"
    aria-notify: "()"
    attribution-reporting: "()"
    autoplay: "()"
    bluetooth: "()"
    browsing-topics: "()"
    camera: "()"
    captured-surface-control: "()"
    compute-pressure: "()"
    cross-origin-isolated: "()"
    deferred-fetch: "()"
    deferred-fetch-minimal: "()"
    display-capture: "()"
    encrypted-media: "()"
    fullscreen: "()"
    gamepad: "()"
    geolocation: "()"
    gyroscope: "()"
    hid: "()"
    identity-credentials-get: "()"
    idle-detection: "()"
    language-detector: "()"
    local-fonts: "()"
    magnetometer: "()"
    microphone: "()"
    midi: "()"
    on-device-speech-recognition: "()"
    otp-credentials: "()"
    payment: "()"
    picture-in-picture: "()"
    private-state-token-issuance: "()"
    private-state-token-redemption: "()"
    publickey-credentials-create: "()"
    publickey-credentials-get: "()"
    screen-wake-lock: "()"
    serial: "()"
    speaker-selection: "()"
    storage-access: "()"
    translator: "()"
    summarizer: "()"
    usb: "()"
    web-share: "()"
    window-management: "()"
    xr-spatial-tracking: "()"

    # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#floc-federated-learning-of-cohorts
    interest-cohort: "()"

    # ???
    battery: "()"
    document-domain: "()"
    execution-while-not-rendered: "()"
    execution-while-out-of-viewport: "()"
    navigation-override: "()"

  # https://www.geeksforgeeks.org/computer-networks/http-headers-feature-policy/
  header_feature_policy:
    accelerometer: "'none'"
    ambient-light-sensor: "'none'"
    autoplay: "'none'"
    battery: "'none'"
    camera: "'none'"
    display-capture: "'none'"
    document-domain: "'none'"
    encrypted-media: "'none'"
    fullscreen: "'none'"
    geolocation: "'none'"
    gyroscope: "'none'"
    layout-animation: "'none'"
    legacy-image-formats: "'none'"
    magnetometer: "'none'"
    microphone: "'none'"
    midi: "'none'"
    oversized-images: "'none'"
    payment: "'none'"
    picture-in-picture: "'none'"
    publickey-credentials-get: "'none'"
    sync-xhr: "'none'"
    usb: "'none'"
    screen-wake-lock: "'none'"
    xr-spatial-tracking: "'none'"

    # ???
    execution-while-not-rendered: "'none'"
    execution-while-out-of-viewport: "'none'"
    navigation-override: "'none'"
    speaker-selection: "'none'"
    unoptimized-images: "'none'"
    unsized-media: "'none'"
    web-share: "'none'"

  # https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy
  header_referrer_policy: "strict-origin-when-cross-origin"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
  header_strict_transport_security: "max-age=2635200; includeSubDomains"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
  header_x_content_type_options: "nosniff"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options
  header_x_frame_options: "DENY"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-robots-tag
  header_x_robots_tag: "noindex, nofollow"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#content-type
  default_content_type: "text/html; charset=UTF-8"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#set-cookie
  cookies_attributes: "SameSite=None; Secure;"

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-dns-prefetch-control
  # FIXME

  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#server
  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnet-version
  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-aspnetmvc-version
  # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-powered-by
  delete_headers:
    - "Server"
    - "Via"
    - "X-AspNet-Version"
    - "X-AspNetMvc-Version"
    - "X-Powered-By"

  custom_headers: {}
#   - name: <string>
#     value: <string>

  # caddy-ratelimit
  rate_events: 1000
  rate_window: "1m"

  # steffenbusch/caddy-bot-barrier
  bot_barrier: false

  # corazawaf/coraza-caddy
  enable_crs: true
  crs_plugins: []
  log_only: false
  paranoia_level: 1
  detection_paranoia_level: null
  enforce_bodyproc_urlencoded: 1
  critical_anomaly_score: 5
  error_anomaly_score: 4
  warning_anomaly_score: 3
  notice_anomaly_score: 2
  inbound_anomaly_score_threshold: 5
  outbound_anomaly_score_threshold: 4
  reporting_level: 4
  max_num_args: 255
  arg_name_length: 100
  arg_length: 1000
  total_arg_length: 64000
  max_file_size: 10485760        # 10 Mo
  combined_file_sizes: 20970520  # 20 Mo
  sampling_percentage: 100
  allowed_methods:
    - "GET"
    - "HEAD"
    - "POST"
    - "OPTIONS"
  allowed_request_content_type:
    - "|application/csp-report|"
    - "|application/json|"
    - "|application/reports+json|"
    - "|application/soap+xml|"
    - "|application/x-www-form-urlencoded|"
    - "|application/xml|"
    - "|multipart/form-data|"
    - "|text/xml|"
  restricted_extensions:
    - ".ani/"
    - ".asa/"
    - ".asax/"
    - ".ascx/"
    - ".back/"
    - ".backup/"
    - ".bak/"
    - ".bat/"
    - ".bck/"
    - ".bk/"
    - ".bkp/"
    - ".cdx/"
    - ".cer/"
    - ".cfg/"
    - ".cmd/"
    - ".cnf/"
    - ".com/"
    - ".compositefont/"
    - ".conf/"
    - ".config/"
    - ".copy/"
    - ".crt/"
    - ".cs/"
    - ".csproj/"
    - ".csr/"
    - ".dat/"
    - ".db/"
    - ".dbf/"
    - ".dist/"
    - ".dll/"
    - ".dos/"
    - ".dpkg-dist/"
    - ".drv/"
    - ".gadget/"
    - ".hta/"
    - ".htr/"
    - ".htw/"
    - ".ida/"
    - ".idc/"
    - ".idq/"
    - ".inc/"
    - ".inf/"
    - ".ini/"
    - ".jse/"
    - ".key/"
    - ".licx/"
    - ".lnk/"
    - ".log/"
    - ".mdb/"
    - ".msc/"
    - ".ocx/"
    - ".old/"
    - ".pass/"
    - ".pdb/"
    - ".pem/"
    - ".pfx/"
    - ".pif/"
    - ".pol/"
    - ".prf/"
    - ".printer/"
    - ".pwd/"
    - ".rdb/"
    - ".rdp/"
    - ".reg/"
    - ".resources/"
    - ".resx/"
    - ".sav/"
    - ".save/"
    - ".scr/"
    - ".sct/"
    - ".sh/"
    - ".shs/"
    - ".sql/"
    - ".sqlite/"
    - ".sqlite3/"
    - ".swp/"
    - ".sys/"
    - ".temp/"
    - ".tlb/"
    - ".tmp/"
    - ".vb/"
    - ".vbe/"
    - ".vbproj/"
    - ".vbs/"
    - ".vsdisco/"
    - ".vxd/"
    - ".webinfo/"
    - ".ws/"
    - ".wsc/"
    - ".wsf/"
    - ".wsh/"
    - ".xsd/"
    - ".xsx/"
  restricted_headers_basic:
    - "/content-encoding/"
    - "/content-range/"
    - "/expect/"
    - "/if/"
    - "/lock-token/"
    - "/proxy/"
    - "/x-http-method-override/"
    - "/x-http-method/"
    - "/x-method-override/"
    - "/x-middleware-subrequest/"
  restricted_headers_extended:
    - "/accept-charset/"
  allowed_http_versions:
    - "HTTP/1.0"
    - "HTTP/1.1"
    - "HTTP/2"
    - "HTTP/2.0"
    - "HTTP/3"
    - "HTTP/3.0"
  allowed_request_content_type_charset:
    - "|utf-8|"
    - "|iso-8859-1|"
    - "|iso-8859-15|"
    - "|windows-1252|"