apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: coraza-waf
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "gestion-traefik.labels" . | nindent 4 }}
spec:
  plugin:
    coraza-traefik:
      directives:
        # -------------------------------------------------------
        # Moteur et body inspection
        # -------------------------------------------------------
        - "SecRuleEngine On"
        - "SecRequestBodyAccess On"
        - "SecRequestBodyLimit 104857600"
        - "SecRequestBodyInMemoryLimit 131072"
        - "SecResponseBodyAccess Off"
        - "SecDebugLogLevel 0"

        # -------------------------------------------------------
        # OWASP CRS — inclus dans le plugin Coraza
        # -------------------------------------------------------
        - "Include @coraza.conf-recommended"
        - "Include @crs-setup.conf.example"
        - "Include @owasp_crs/*.conf"

        # -------------------------------------------------------
        # Niveau de paranoia {{ .Values.waf.paranoia }}
        # -------------------------------------------------------
        - "SecAction \"id:900000,phase:1,nolog,pass,t:none,setvar:tx.paranoia_level={{ .Values.waf.paranoia }}\""
        - "SecAction \"id:900001,phase:1,nolog,pass,t:none,setvar:tx.inbound_anomaly_score_threshold={{ .Values.waf.anomalyInbound }}\""
        - "SecAction \"id:900002,phase:1,nolog,pass,t:none,setvar:tx.outbound_anomaly_score_threshold={{ .Values.waf.anomalyOutbound }}\""

        # -------------------------------------------------------
        # Suppressions CRS pour les routes légitimes
        # -------------------------------------------------------
        - "SecRuleRemoveById 932235"
        - "SecRuleRemoveById 911100"

        - "SecRule REQUEST_URI \"@streq /api/v2/admin/protected/products\" \"id:399001,phase:2,nolog,pass,ctl:ruleRemoveById=932235\""
        - "SecRule REQUEST_URI \"@streq /api/v2/admin/protected/products\" \"id:399002,phase:2,nolog,pass,ctl:ruleRemoveById=920120,ctl:ruleRemoveById=920121\""
        - "SecRule REQUEST_URI \"@streq /api/v1/panier/remove\" \"id:399010,phase:1,nolog,pass,ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350\""
        - "SecRule REQUEST_URI \"@streq /api/v1/panier/clear\" \"id:399011,phase:1,nolog,pass,ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350\""

        # Désactiver le WAF sur les uploads (fichiers statiques en lecture)
        - "SecRule REQUEST_URI \"@beginsWith /uploads/\" \"id:1000,phase:1,pass,nolog,ctl:ruleEngine=Off\""

        # -------------------------------------------------------
        # IP banning automatique sur attaques détectées
        # Note : en-mémoire par pod — pour un ban distribué utiliser Redis + Coraza persistence
        # -------------------------------------------------------
        - "SecRule TX:SQL_INJECTION_SCORE \"@ge 5\" \"id:100001,phase:2,deny,status:403,log,msg:'SQL Injection detected',setvar:'ip.banned=1',expirevar:'ip.banned=172800'\""
        - "SecRule TX:XSS_SCORE \"@ge 5\" \"id:100010,phase:2,deny,status:403,log,msg:'XSS detected',setvar:'ip.banned=1',expirevar:'ip.banned=172800'\""
        - "SecRule TX:RCE_SCORE \"@ge 5\" \"id:100020,phase:2,deny,status:403,log,msg:'RCE detected',setvar:'ip.banned=1',expirevar:'ip.banned=259200'\""
        - "SecRule TX:LFI_SCORE \"@ge 5\" \"id:100030,phase:2,deny,status:403,log,msg:'LFI detected',setvar:'ip.banned=1',expirevar:'ip.banned=172800'\""
        - "SecRule TX:INBOUND_ANOMALY_SCORE \"@ge 20\" \"id:100060,phase:2,deny,status:403,log,msg:'Critical anomaly score',setvar:'ip.banned=1',expirevar:'ip.banned=172800'\""

        - "SecRule IP:BANNED \"@eq 1\" \"id:100000,phase:1,deny,status:403,log,msg:'IP is banned'\""
        - "SecRule IP:REPUTATION_SCORE \"@ge 100\" \"id:100099,phase:1,deny,status:403,log,msg:'Critical reputation score',setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'\""