How to apply WAF globally ? #48
Assignees
Comments
|
Helo, here's how you can structure your Caddyfile: {
# Global Options (can define metrics)
waf {
metrics_endpoint /waf_metrics
}
route {
@wafmetrics {
path /waf_metrics
}
handle @wafmetrics {
# This empty handler allows the metrics endpoint to be called.
respond "" 200
}
}
}
# Subdomain 1: Uses default rules and blacklists
subdomain1.mydomain.com {
handle {
waf {
rule_file owasp_rules.json
ip_blacklist_file ip_blacklist.txt
dns_blacklist_file dns_blacklist.txt
}
reverse_proxy localhost:8080
}
}
# Subdomain 2: Uses custom rules
subdomain2.mydomain.com {
handle {
waf {
rule_file custom_rules_subdomain2.json
ip_blacklist_file ip_blacklist.txt
dns_blacklist_file dns_blacklist.txt
}
reverse_proxy localhost:8081
}
}
# Subdomain 3: Uses default rules and blacklists (again)
subdomain3.mydomain.com {
handle {
waf {
rule_file owasp_rules.json
ip_blacklist_file ip_blacklist.txt
dns_blacklist_file dns_blacklist.txt
}
reverse_proxy localhost:8082
}
}
# Add more subdomains as needed, always configure each handle with a reverse proxyplease let me know if this works since docs needs some improvements in such area and this kind of additions will be more than useful for others caddy users :) |
|
Doesn't seem to be working for me: Caddyfile: |
|
I am having the same error with this example. |
|
Hello buddies, can you refer to this updated example and provide feedback? It will be helpful to improve docs 🙏 |
|
Caddyfile: |
|
Hi, same error here. Route is apparently not a global option. My current caddyfile is the following: I don't quite understand what needs to be global and what needs to be per website. I would like to use snippets as much as possible to avoid redundancy. I have added With this setup, when trying to access |
|
Maybe we need to investigate into that a bit more :) This approach uses snippets to define the WAF configuration once and then import it into each site, minimizing repetition. Explanation:
Customization: If you need to customize the WAF configuration for a specific site, you can override settings after the import: Order of tests:
Additional examplesHere a series of Caddyfile examples that gradually increase in complexity, building from the absolute simplest to a more practical configuration incorporating the caddy-waf plugin. Level 1: The Bare Minimum (Illustrating Global vs. Site) This example shows the most basic configuration and highlights the difference between global and site-specific directives.
Level 2: Adding Basic Logging (Site-Specific) This example adds basic logging to the site configuration.
Level 3: Introducing handle Blocks (Route Management) This example introduces handle blocks for more precise route management, while keeping things relatively simple.
Level 4: Integrating caddy-waf (Minimal Implementation) This example shows the minimal integration of caddy-waf within a Caddyfile. Crucially, we place it before the other handle blocks.
Level 5: A More Usable caddy-waf Configuration (Practical) This example expands on the previous example, adding more common caddy-waf settings and showing how to exempt certain paths from WAF processing.
Additional notes:
Please let me know if such progressive how-to can be useful to be integrated in the repo docs, TIA! |
|
Thanks a lot for your very complete answer. It appears directive My full caddyfile is the following: After adding Now, when accessing |
I checked and, if I am not completely dumb... this should work :) let me know ;) |
|
At the same time i am releasein a fix for the issue you encountered (Add nil checks for the http.ResponseWriter in the extractResponseBody and extractDynamicResponseHeader functions.), thank you ! |
|
Thank you for your answer. I am unfamiliar with Caddy variables, I have set one When trying to access I have rebuilt my caddy image. I can see that I have the version 0.0.4 that you recently released. Is this the same error or another one ? |
|
I need to investigate more but i can only on weekends, i tried to push some projects a bit more into the community via Reddit post, hopefully some contributors PRs will come to speed up updates :) Just to say what is going to be added:
|
|
That looks awesome ! My interest into your project is because it looks like it is the closest to what bunkerweb is for nginx, but for caddy. If there is anything I can do to provide more information on the error, I'm available. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi,
I am a begginer with caddy-WAF. I would like to apply it globally on all my subdomains, while the only setting specific to each subdomains would be rule edits to avoid false positives (I was using Bunkerweb previously, which by default uses owasp CRS too, and there is A LOT of false positives with the services I am using).
I can't find what the Caddyfile structure would be to achieve this.
Could someone help me with some examples ?
Thanks in advance for any answer, have a nice day.
My Dockerfile is the following:
I am trying to apply it this way globally, so far:
Thanks in advance for any answer
The text was updated successfully, but these errors were encountered: