Elgato_dark/bunkerweb
1
0
Fork 0
mirror of https://github.com/bunkerity/bunkerweb synced 2026-05-24 09:28:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: replace custom ModSecurity configuration with CRS plugin URL for Nextcloud examples

Browse source
This commit is contained in:
Théophile Diot 2024-11-20 16:09:54 +01:00
parent 1d7182a48d
commit 6d90307bf9
No known key found for this signature in database
GPG key ID: FA995104A0BA376A
9 changed files with 12 additions and 74 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
examples/nextcloud/autoconf.yml
View file

@ -32,27 +32,8 @@ services:
- bunkerweb.LIMIT_REQ_RATE_2=8r/s
- bunkerweb.LIMIT_REQ_URL_3=/core/preview
- bunkerweb.LIMIT_REQ_RATE_3=5r/s
- |
bunkerweb.CUSTOM_CONF_MODSEC_CRS_nextcloud=
SecAction \
"id:900130,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:tx.crs_exclusions_nextcloud=1"
# WebDAV
SecAction \
"id:900200,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:'tx.allowed_methods=GET POST HEAD COPY DELETE LOCK MKCOL MOVE PROPFIND PROPPATCH PUT UNLOCK OPTIONS'"
- |
bunkerweb.CUSTOM_CONF_MODSEC_nextcloud=
SecRule REQUEST_FILENAME "@rx ^/remote.php/dav/files/" "id:2000,ctl:ruleRemoveByTag=attack-protocol,ctl:ruleRemoveByTag=attack-generic,nolog"
# This is a CRS plugin specific to Nextcloud
- bunkerweb.MODSECURITY_CRS_PLUGIN_URLS=https://github.com/coreruleset/nextcloud-rule-exclusions-plugin/archive/refs/tags/v1.2.0.tar.gz
mydb:
image: mariadb:11

16
examples/nextcloud/bw-data/configs/modsec-crs/nextcloud.conf
View file

@ -1,16 +0,0 @@
SecAction \
"id:900130,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:tx.crs_exclusions_nextcloud=1"
# WebDAV
SecAction \
"id:900200,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:'tx.allowed_methods=GET POST HEAD COPY DELETE LOCK MKCOL MOVE PROPFIND PROPPATCH PUT UNLOCK OPTIONS'"

1
examples/nextcloud/bw-data/configs/modsec/nextcloud.conf
View file

@ -1 +0,0 @@
SecRule REQUEST_FILENAME "@rx ^/remote.php/dav/files/" "id:2000,ctl:ruleRemoveByTag=attack-protocol,ctl:ruleRemoveByTag=attack-generic,nolog"

24
examples/nextcloud/docker-compose.yml
View file

@ -3,8 +3,9 @@ services:
image: bunkerity/bunkerweb:1.6.0-beta
container_name: bunkerweb
ports:
- "80:8080"
- "443:8443"
- "80:8080/tcp"
- "443:8443/tcp"
- "443:8443/udp" # for QUIC
environment:
API_WHITELIST_IP: "127.0.0.1 10.20.30.0/24"
restart: "unless-stopped"
@ -41,24 +42,7 @@ services:
LIMIT_REQ_RATE_2: "8r/s"
LIMIT_REQ_URL_3: "/core/preview"
LIMIT_REQ_RATE_3: "5r/s"
CUSTOM_CONF_MODSEC_CRS_nextcloud: |
SecAction \
"id:900130,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:tx.crs_exclusions_nextcloud=1"
# WebDAV
SecAction \
"id:900200,\
phase:1,\
nolog,\
pass,\
t:none,\
setvar:'tx.allowed_methods=GET POST HEAD COPY DELETE LOCK MKCOL MOVE PROPFIND PROPPATCH PUT UNLOCK OPTIONS'"
CUSTOM_CONF_MODSEC_nextcloud: |
SecRule REQUEST_FILENAME "@rx ^/remote.php/dav/files/" "id:2000,ctl:ruleRemoveByTag=attack-protocol,ctl:ruleRemoveByTag=attack-generic,nolog"
MODSECURITY_CRS_PLUGIN_URLS: "https://github.com/coreruleset/nextcloud-rule-exclusions-plugin/archive/refs/tags/v1.2.0.tar.gz" # This is a CRS plugin specific to Nextcloud
restart: "unless-stopped"
networks:
- bw-universe

2
examples/nextcloud/kubernetes.yml
View file

@ -14,6 +14,8 @@ metadata:
bunkerweb.io/www.example.com_LIMIT_REQ_RATE_2: "8r/s"
bunkerweb.io/www.example.com_LIMIT_REQ_URL_3: "/core/preview"
bunkerweb.io/www.example.com_LIMIT_REQ_RATE_3: "5r/s"
# This is a CRS plugin specific to Nextcloud
bunkerweb.io/www.example.com_MODSECURITY_CRS_PLUGIN_URLS: "https://github.com/coreruleset/nextcloud-rule-exclusions-plugin/archive/refs/tags/v1.2.0.tar.gz"
spec:
rules:
- host: www.example.com

1
examples/nextcloud/setup-linux.sh
View file

@ -19,4 +19,3 @@ cp -r /tmp/nextcloud/* /var/www/html
chown -R $user:nginx /var/www/html
find /var/www/html -type f -exec chmod 0640 {} \;
find /var/www/html -type d -exec chmod 0750 {} \;
cp -r bw-data/configs/* /etc/bunkerweb/configs

15
examples/nextcloud/setup-swarm.sh
View file

@ -1,15 +0,0 @@
#!/bin/bash
# docker-compose doesn't support assigning labels to configs
# so we need to create the configs with the CLI
# bunkerweb.CONFIG_TYPE accepted values are http, stream, server-http, server-stream, default-server-http, modsec and modsec-crs
# bunkerweb.CONFIG_SITE lets you choose on which web service the config should be applied (MULTISITE mode) and if it's not set, the config will be applied for all services
# more info at https://docs.bunkerweb.io
# remove configs if existing
docker config rm cfg_nextcloud_modsec
docker config rm cfg_nextcloud_modsec_crs
# create configs
docker config create -l bunkerweb.CONFIG_TYPE=modsec -l bunkerweb.CONFIG_SITE=www.example.com cfg_nextcloud_modsec ./bw-data/configs/modsec/nextcloud.conf
docker config create -l bunkerweb.CONFIG_TYPE=modsec-crs -l bunkerweb.CONFIG_SITE=www.example.com cfg_nextcloud_modsec_crs ./bw-data/configs/modsec-crs/nextcloud.conf

2
examples/nextcloud/swarm.yml
View file

@ -34,6 +34,8 @@ services:
- bunkerweb.LIMIT_REQ_RATE_2=8r/s
- bunkerweb.LIMIT_REQ_URL_3=/core/preview
- bunkerweb.LIMIT_REQ_RATE_3=5r/s
# This is a CRS plugin specific to Nextcloud
- bunkerweb.MODSECURITY_CRS_PLUGIN_URLS=https://github.com/coreruleset/nextcloud-rule-exclusions-plugin/archive/refs/tags/v1.2.0.tar.gz
mydb:
image: mariadb:11

2
examples/nextcloud/variables.env
View file

@ -18,3 +18,5 @@ LIMIT_REQ_URL_2=/apps/text/session/sync
LIMIT_REQ_RATE_2=8r/s
LIMIT_REQ_URL_3=/core/preview
LIMIT_REQ_RATE_3=5r/s
# This is a CRS plugin specific to Nextcloud
MODSECURITY_CRS_PLUGIN_URLS=https://github.com/coreruleset/nextcloud-rule-exclusions-plugin/archive/refs/tags/v1.2.0.tar.gz