chore: add waf

2026-03-15 13:31:48 +01:00
parent 2e7340f9a6
commit 42276ca4ff
18 changed files with 164 additions and 3508 deletions
@@ -5,7 +5,7 @@ WORKDIR /app
 RUN apk add --no-cache git ca-certificates tzdata gcc musl-dev

 # Copier go mod files
-COPY backend/backend/gestion/go.mod backend/backend/gestion/go.sum ./
+COPY backend/gestion/go.mod backend/gestion/go.sum ./

 # Configurer Go et télécharger les dépendances
 ENV GOPROXY=https://proxy.golang.org,direct
@@ -16,7 +16,7 @@ ENV CGO_ENABLED=0
 RUN go mod download

 # Copier tout le code source
-COPY backend/backend/gestion/ .
+COPY backend/gestion/ .

 # Build le binaire
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
@@ -26,7 +26,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
 # =========================================================
 # Stage 2: Runtime
 # =========================================================
-FROM alpine:latest
+FROM alpine:latest AS runtime

 # Installer les dépendances runtime
 RUN apk --no-cache add ca-certificates tzdata wget
@@ -55,3 +55,30 @@ USER app
 EXPOSE 8080

 ENTRYPOINT ["./entrypoint.sh"]
+
+# =========================================================
+# Stage 3: WAF (Nginx + ModSecurity)
+# =========================================================
+FROM owasp/modsecurity-crs:nginx-alpine AS waf
+
+USER root
+
+# Logs ModSecurity
+RUN mkdir -p /var/log/modsec && chown -R nginx:nginx /var/log/modsec
+
+# Certificats SSL
+RUN mkdir -p /etc/nginx/certs
+COPY docker/backend/certs/cert.pem /etc/nginx/certs/cert.pem
+COPY docker/backend/certs/key.pem /etc/nginx/certs/key.pem
+RUN chown -R nginx:nginx /etc/nginx/certs && chmod 640 /etc/nginx/certs/key.pem
+
+COPY docker/backend/nginx.conf /etc/nginx/conf.d/app.conf
+COPY docker/backend/custom-rules.conf /etc/nginx/modsec/custom-rules.conf
+RUN echo "Include /etc/nginx/modsec/custom-rules.conf" > /etc/nginx/modsec/custom-includes.conf
+
+RUN rm -f /etc/nginx/templates/conf.d/default.conf.template || true
+RUN chown -R nginx:nginx /usr/share/nginx/html
+
+USER nginx
+EXPOSE 80 443
+CMD ["nginx", "-g", "daemon off;"]
@@ -0,0 +1,74 @@
+SecRuleRemoveById 932235
+SecRuleRemoveById 911100
+
+SecRule REQUEST_URI "@streq /api/v2/admin/protected/products" \
+  "id:399002,phase:2,nolog,pass,\
+   ctl:ruleRemoveById=920120,\
+   ctl:ruleRemoveById=920121"
+
+SecRule REQUEST_URI "@beginsWith /uploads/" \
+    "id:1000,\
+    phase:1,\
+    pass,\
+    nolog,\
+    ctl:ruleEngine=Off"
+
+SecRule IP:BANNED "@eq 1" \
+  "id:100000,phase:1,deny,status:403,log,\
+   msg:'IP is banned'"
+
+SecRule IP:REPUTATION_SCORE "@ge 100" \
+  "id:100099,phase:1,deny,status:403,log,\
+   msg:'Critical reputation score',\
+   setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'"
+
+SecRule TX:SQL_INJECTION_SCORE "@ge 5" \
+  "id:100001,phase:2,deny,status:403,log,\
+   msg:'SQL Injection detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule TX:XSS_SCORE "@ge 5" \
+  "id:100010,phase:2,deny,status:403,log,\
+   msg:'XSS detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule TX:RCE_SCORE "@ge 5" \
+  "id:100020,phase:2,deny,status:403,log,\
+   msg:'RCE detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=259200'"
+
+SecRule TX:LFI_SCORE "@ge 5" \
+  "id:100030,phase:2,deny,status:403,log,\
+   msg:'LFI detected',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule TX:INBOUND_ANOMALY_SCORE "@ge 20" \
+  "id:100060,phase:2,deny,status:403,log,\
+   msg:'Critical anomaly score',\
+   setvar:'ip.banned=1',expirevar:'ip.banned=172800'"
+
+SecRule REQUEST_URI "@streq /api/v1/panier/remove" \
+  "id:399010,phase:1,nolog,pass,\
+   ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350"
+
+SecRule REQUEST_URI "@streq /api/v1/panier/clear" \
+  "id:399011,phase:1,nolog,pass,\
+   ctl:ruleRemoveById=911100,ctl:ruleRemoveById=920350"
+
+SecRule REQUEST_URI "@streq /api/v2/admin/protected/products" \
+  "id:399001,phase:2,nolog,pass,\
+   ctl:ruleRemoveById=932235"
+
+SecAction \
+  "id:400161,phase:1,nolog,pass,\
+   setvar:'ip.request_window_1sec=+1',\
+   expirevar:'ip.request_window_1sec=1'"
+
+SecRule IP:REQUEST_WINDOW_1SEC "@gt 20" \
+  "id:400160,phase:1,deny,status:429,log,\
+   msg:'Too many requests'"
+
+SecRule IP:REPUTATION_SCORE "@ge 100" \
+  "id:409999,phase:1,deny,status:403,log,\
+   msg:'Critical reputation score',\
+   setvar:'ip.blocked=1',expirevar:'ip.blocked=86400'"
@@ -0,0 +1,90 @@
+# =========================================================
+# Request ID for correlation
+# =========================================================
+map $http_x_request_id $req_id {
+    default $http_x_request_id;
+    "" $request_id;
+}
+
+# =========================================================
+# Backend interne (réseau Docker)
+# =========================================================
+upstream backend {
+    server backend:8080;
+    keepalive 32;
+}
+
+# =========================================================
+# HTTP → HTTPS redirect
+# =========================================================
+server {
+    listen 80;
+    listen [::]:80;
+    server_name 5.181.0.112.nip.io;
+    return 301 https://$host$request_uri;
+}
+
+# =========================================================
+# HTTPS Server (WAF)
+# =========================================================
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name 5.181.0.112.nip.io;
+
+    ssl_certificate     /etc/nginx/certs/cert.pem;
+    ssl_certificate_key /etc/nginx/certs/key.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+
+    client_max_body_size 10M;
+
+    modsecurity on;
+    modsecurity_rules_file /etc/nginx/modsec/custom-rules.conf;
+
+    location / {
+        limit_except GET POST PUT PATCH DELETE OPTIONS { deny all; }
+
+        if ($request_method = 'OPTIONS') {
+            add_header 'Access-Control-Allow-Origin' "$http_origin" always;
+            add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, PATCH, DELETE, OPTIONS' always;
+            add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Request-ID' always;
+            add_header 'Access-Control-Allow-Credentials' 'true' always;
+            add_header 'Access-Control-Max-Age' 86400 always;
+            add_header 'Content-Length' 0;
+            add_header 'Content-Type' 'text/plain charset=UTF-8';
+            return 204;
+        }
+
+        proxy_pass http://backend;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Request-ID $req_id;
+        proxy_set_header Connection "";
+
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+
+    location ~* (\.env|\.git|package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose\.yml)$ {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}