steve/debian13-secure-platform
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(waf): migrate default WAF to CrowdSec 1.8.1 with AppSec Coraza and Web UI #8

Merged
steve merged 1 commit from feat/crowdsec-waf-migration into main 2026-09-07 04:43:18 +00:00
Conversation 0 Commits 1 Files changed 18 +888 -43
steve commented 2026-09-07 04:43:10 +00:00
Owner
Copy link
  • Switch default WAF provider from ModSecurity to CrowdSec 1.8.1 while retaining ModSecurity as fallback option via 'waf_provider: modsecurity'
  • Deploy CrowdSec rootless Podman stack with Local API (LAPI) on 127.0.0.1:18085, AppSec on 17422, Prometheus metrics on 18086, and Web UI on 18092
  • Port all ModSecurity Core Rule Set exclusions to Coraza AppSec native SecLang rules (Forgejo user content, SigNoz logs explorer, Wazuh search, Git CLI, and bot challenge bypasses)
  • Enable default collections including linux, traefik, appsec-virtual-patching, appsec-generic-rules, appsec-bot-challenge, and http-cve
  • Integrate Traefik v3 using crowdsec-bouncer plugin (v1.7.1) for LAPI decision enforcement and AppSec request inspection
  • Protect CrowdSec Web UI under Authentik SSO forward-auth at 'waf.'
  • Update OpenTelemetry collector to scrape CrowdSec Prometheus metrics
  • Update generate-vault.sh, vault.yml.example, and README.md with CrowdSec credentials and architecture documentation
  • Add comprehensive render assertion tests covering both CrowdSec default and ModSecurity fallback configurations
- Switch default WAF provider from ModSecurity to CrowdSec 1.8.1 while retaining ModSecurity as fallback option via 'waf_provider: modsecurity' - Deploy CrowdSec rootless Podman stack with Local API (LAPI) on 127.0.0.1:18085, AppSec on 17422, Prometheus metrics on 18086, and Web UI on 18092 - Port all ModSecurity Core Rule Set exclusions to Coraza AppSec native SecLang rules (Forgejo user content, SigNoz logs explorer, Wazuh search, Git CLI, and bot challenge bypasses) - Enable default collections including linux, traefik, appsec-virtual-patching, appsec-generic-rules, appsec-bot-challenge, and http-cve - Integrate Traefik v3 using crowdsec-bouncer plugin (v1.7.1) for LAPI decision enforcement and AppSec request inspection - Protect CrowdSec Web UI under Authentik SSO forward-auth at 'waf.<domain>' - Update OpenTelemetry collector to scrape CrowdSec Prometheus metrics - Update generate-vault.sh, vault.yml.example, and README.md with CrowdSec credentials and architecture documentation - Add comprehensive render assertion tests covering both CrowdSec default and ModSecurity fallback configurations
- Switch default WAF provider from ModSecurity to CrowdSec 1.8.1 while retaining ModSecurity as fallback option via 'waf_provider: modsecurity'
- Deploy CrowdSec rootless Podman stack with Local API (LAPI) on 127.0.0.1:18085, AppSec on 17422, Prometheus metrics on 18086, and Web UI on 18092
- Port all ModSecurity Core Rule Set exclusions to Coraza AppSec native SecLang rules (Forgejo user content, SigNoz logs explorer, Wazuh search, Git CLI, and bot challenge bypasses)
- Enable default collections including linux, traefik, appsec-virtual-patching, appsec-generic-rules, appsec-bot-challenge, and http-cve
- Integrate Traefik v3 using crowdsec-bouncer plugin (v1.7.1) for LAPI decision enforcement and AppSec request inspection
- Protect CrowdSec Web UI under Authentik SSO forward-auth at 'waf.<domain>'
- Update OpenTelemetry collector to scrape CrowdSec Prometheus metrics
- Update generate-vault.sh, vault.yml.example, and README.md with CrowdSec credentials and architecture documentation
- Add comprehensive render assertion tests covering both CrowdSec default and ModSecurity fallback configurations
steve merged commit a77289183c into main 2026-09-07 04:43:18 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
steve/debian13-secure-platform!8
No description provided.