digitaldemocratic/dd-sso/docker-compose-parts/waf-modsecurity.yml

version: '3.7'
services:
  dd-waf-apache:
    image: registry.dd-work.space/dd/waf-apache:${DD_BUILD:-latest}
    build:
      context: ${BUILD_SSO_ROOT_PATH}/docker/waf-modsecurity
      dockerfile: Dockerfile
      target: production
    container_name: dd-waf-apache
    environment:
      DISABLE_WAF: ${DISABLE_WAF:-true}
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
    networks:
      - dd_net
Initial config modsecurity 2022-10-25 13:48:10 +02:00			`version: '3.7'`
			`services:`
			`dd-waf-apache:`
update haproxy and image from repository 2022-11-16 13:07:49 +01:00			`image: registry.dd-work.space/dd/waf-apache:${DD_BUILD:-latest}`
Initial config modsecurity 2022-10-25 13:48:10 +02:00			`build:`
[WAF] Consolidate proxies and documentation The environment / dd.conf variables: PROXY_PROTOCOL and DISABLE_WAF determine how DD and HAProxy will behave. - PROXY_PROTOCOL: whether or not the PROXY protocol will be accepted - DISABLE_WAF: whether or not WAF will be enabled This simplifies maintenance, as well as the overall architecture and operation. While at it, we now publish images for DD's HAProxy as well. 2022-11-23 20:10:13 +01:00			`context: ${BUILD_SSO_ROOT_PATH}/docker/waf-modsecurity`
Initial config modsecurity 2022-10-25 13:48:10 +02:00			`dockerfile: Dockerfile`
			`target: production`
			`container_name: dd-waf-apache`
[docker] Cleanup environment files By having the environment explicit on each service, we both document the settings and have more control over what each service is allowed to see. This avoids weird things like nginx having access to postgresql's credentials on its environment. As a bonus: we are able to use one single environment file, which is basically dd.conf with some values that are dynamically-calculated and added from dd-ctl. 2023-01-10 16:58:17 +01:00			`environment:`
			`DISABLE_WAF: ${DISABLE_WAF:-true}`
Initial config modsecurity 2022-10-25 13:48:10 +02:00			`restart: unless-stopped`
			`volumes:`
			`- /etc/localtime:/etc/localtime:ro`
			`networks:`
exclude rules 2022-11-10 00:28:20 +01:00			`- dd_net`