feat: add app download

2026-08-09 15:35:29 +02:00
parent 0609ca30d0
commit d8794358c5
13 changed files with 520 additions and 24 deletions
@@ -0,0 +1,48 @@
+# Exclure le corps des requêtes/réponses de l'audit log pour garder des
+# lignes de taille raisonnable.
+SecAuditLogParts ABIFHZ
+
+SecRule IP:BANNED "@eq 1" \
+  "id:100000,phase:1,deny,status:403,log,\
+   msg:'IP is banned'"
+
+SecRule IP:REPUTATION_SCORE "@ge 100" \
+  "id:100099,phase:1,deny,status:403,log,\
+   msg:'Critical reputation score',\
+   setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'"
+
+SecRule TX:SQL_INJECTION_SCORE "@ge 5" \
+  "id:100001,phase:2,deny,status:403,log,\
+   msg:'SQL Injection detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule TX:XSS_SCORE "@ge 5" \
+  "id:100010,phase:2,deny,status:403,log,\
+   msg:'XSS detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule TX:RCE_SCORE "@ge 5" \
+  "id:100020,phase:2,deny,status:403,log,\
+   msg:'RCE detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=259200'"
+
+SecRule TX:LFI_SCORE "@ge 5" \
+  "id:100030,phase:2,deny,status:403,log,\
+   msg:'LFI detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule TX:INBOUND_ANOMALY_SCORE "@ge 20" \
+  "id:100060,phase:2,deny,status:403,log,\
+   msg:'Critical anomaly score',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+# Rate limit basique par IP (indépendant du RateLimit Go déjà en place sur
+# /auth/login côté control-plane — celui-ci protège tout le reste).
+SecAction \
+  "id:400161,phase:1,nolog,pass,\
+   setvar:'ip.request_window_1sec=+1',\
+   expirevar:'ip.request_window_1sec=1'"
+
+SecRule IP:REQUEST_WINDOW_1SEC "@gt 20" \
+  "id:400160,phase:1,deny,status:429,log,\
+   msg:'Too many requests'"