# WAF (Nginx + ModSecurity/OWASP CRS) — même pattern que
# projet_gestion_commande/docker-prod/backend/Dockerfile (stage "waf") :
# seul point de terminaison TLS + reverse-proxy devant web/api.
FROM owasp/modsecurity-crs:nginx-alpine

USER root

RUN mkdir -p /var/log/modsec /etc/nginx/certs && \
    chown -R nginx:nginx /var/log/modsec /etc/nginx/certs /usr/share/nginx/html

COPY nginx.conf /etc/nginx/conf.d/app.conf
COPY custom-rules.conf /etc/nginx/modsec/custom-rules.conf
RUN echo "Include /etc/nginx/modsec/custom-rules.conf" > /etc/nginx/modsec/custom-includes.conf && \
    rm -f /etc/nginx/templates/conf.d/default.conf.template || true

USER nginx
EXPOSE 80 443
CMD ["nginx", "-g", "daemon off;"]