chore: add waf

docker/backend/Dockerfile

@@ -5,7 +5,7 @@ WORKDIR /app
 RUN apk add --no-cache git ca-certificates tzdata gcc musl-dev
 
 # Copier go mod files
-COPY backend/backend/gestion/go.mod backend/backend/gestion/go.sum ./
+COPY backend/gestion/go.mod backend/gestion/go.sum ./
 
 # Configurer Go et télécharger les dépendances
 ENV GOPROXY=https://proxy.golang.org,direct
@@ -16,7 +16,7 @@ ENV CGO_ENABLED=0
 RUN go mod download
 
 # Copier tout le code source
-COPY backend/backend/gestion/ .
+COPY backend/gestion/ .
 
 # Build le binaire
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
@@ -26,7 +26,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
 # =========================================================
 # Stage 2: Runtime
 # =========================================================
-FROM alpine:latest
+FROM alpine:latest AS runtime
 
 # Installer les dépendances runtime
 RUN apk --no-cache add ca-certificates tzdata wget
@@ -55,3 +55,30 @@ USER app
 EXPOSE 8080
 
 ENTRYPOINT ["./entrypoint.sh"]
+
+# =========================================================
+# Stage 3: WAF (Nginx + ModSecurity)
+# =========================================================
+FROM owasp/modsecurity-crs:nginx-alpine AS waf
+
+USER root
+
+# Logs ModSecurity
+RUN mkdir -p /var/log/modsec && chown -R nginx:nginx /var/log/modsec
+
+# Certificats SSL
+RUN mkdir -p /etc/nginx/certs
+COPY docker/backend/certs/cert.pem /etc/nginx/certs/cert.pem
+COPY docker/backend/certs/key.pem /etc/nginx/certs/key.pem
+RUN chown -R nginx:nginx /etc/nginx/certs && chmod 640 /etc/nginx/certs/key.pem
+
+COPY docker/backend/nginx.conf /etc/nginx/conf.d/app.conf
+COPY docker/backend/custom-rules.conf /etc/nginx/modsec/custom-rules.conf
+RUN echo "Include /etc/nginx/modsec/custom-rules.conf" > /etc/nginx/modsec/custom-includes.conf
+
+RUN rm -f /etc/nginx/templates/conf.d/default.conf.template || true
+RUN chown -R nginx:nginx /usr/share/nginx/html
+
+USER nginx
+EXPOSE 80 443
+CMD ["nginx", "-g", "daemon off;"]