Enable mod security rules

small-hack / argocd-apps

Common Argo CD templates we use for self hosted cloud stuff. We're still working towards full stability, but feel free to take things or ask questions :)

GNU General Public License v3.0

16 stars 1 forks source link

Enable mod security rules #1015

Closed jessebot closed 5 days ago

jessebot commented 1 week ago

We want to start slowly enabling the rules to actually block traffic, because nextcloud and matrix are just getting hammered. (nextcloud the most though) We've been testing this for probably around a week now?

This PR contains:

a ModSecurity dashboard for prometheus
enables the rule engine to allow the WAF (ModSecurity) to actually block suspicious requests via the ingress-nginx configMap
provides a configMap with the coreruleset/nextcloud-rule-exclusions-plugin
adds rule exceptions plugin to the nextcloud ingress resource via the modsecurity-snippets annotation

jessebot commented 1 week ago

hmmm we're currently getting 🤔 :

Error reloading NGINX:
-------------------------------------------------------------------------------
Error: exit status 1 2024/06/27 10:05:04 [emerg] 30#30:
unexpected "2" in /tmp/nginx/nginx-cfg823489972:135 nginx:
[emerg] unexpected "2" in /tmp/nginx/nginx-cfg823489972:135 nginx: 
configuration file /tmp/nginx/nginx-cfg823489972 test failed
-------------------------------------------------------------------------------

I think this is because we had line breaks in the config...