digitaldemocratic/dd-sso/docker/waf-modsecurity/000-default.conf

<VirtualHost *:80>
	modsecurity Off
	modsecurity_rules_file /etc/apache2/modsecurity.d/modsec_rules.conf
	ServerAdmin webmaster@localhost
	DocumentRoot /var/www/html
	ErrorLog /var/log/apache2/error.log
	CustomLog /var/log/apache2/access.log combined

	ProxyPreserveHost On
	ProxyRequests off
	ProxyVia Off
	# Do not touch the proxy headers, these are set by HAProxy before
	ProxyAddHeaders off
	ProxyPass "/" "http://dd-sso-haproxy:81/"
	ProxyPassReverse "/" "http://dd-sso-haproxy:81/"
</VirtualHost>
Initial config modsecurity 2022-10-25 13:48:10 +02:00			`<VirtualHost *:80>`
Volume to modsecurity 2022-11-21 11:37:02 +01:00			`modsecurity Off`
config vhost and dd rules modsecurity on volumen 2022-11-18 17:27:14 +01:00			`modsecurity_rules_file /etc/apache2/modsecurity.d/modsec_rules.conf`
Initial config modsecurity 2022-10-25 13:48:10 +02:00			`ServerAdmin webmaster@localhost`
			`DocumentRoot /var/www/html`
exclude rules 2022-11-10 00:28:20 +01:00			`ErrorLog /var/log/apache2/error.log`
			`CustomLog /var/log/apache2/access.log combined`
Initial config modsecurity 2022-10-25 13:48:10 +02:00
			`ProxyPreserveHost On`
[network] Fix handling of forwarded headers This fixes several issues where services would see the internal IP of the proxy and not that of the client. It works by first unsetting any proxy-related headers that arrive from the internet, then setting those as seen by HAProxy's entrypoint frontend. And finally making sure that neither WAF when enabled nor other HAProxy backends touch these headers, while they are actually used by the final services. Services affected: Netcloud, Keycloak, Moodle 2022-12-02 06:49:56 +01:00			`ProxyRequests off`
			`ProxyVia Off`
			`# Do not touch the proxy headers, these are set by HAProxy before`
			`ProxyAddHeaders off`
[WAF] Consolidate proxies and documentation The environment / dd.conf variables: PROXY_PROTOCOL and DISABLE_WAF determine how DD and HAProxy will behave. - PROXY_PROTOCOL: whether or not the PROXY protocol will be accepted - DISABLE_WAF: whether or not WAF will be enabled This simplifies maintenance, as well as the overall architecture and operation. While at it, we now publish images for DD's HAProxy as well. 2022-11-23 20:10:13 +01:00			`ProxyPass "/" "http://dd-sso-haproxy:81/"`
			`ProxyPassReverse "/" "http://dd-sso-haproxy:81/"`
Initial config modsecurity 2022-10-25 13:48:10 +02:00			`</VirtualHost>`