-
Notifications
You must be signed in to change notification settings - Fork 13
/
Copy pathDockerfile
191 lines (155 loc) · 5.78 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
FROM ubuntu:18.04 as modsecurity-build
LABEL maintainer="krish512 <krish512@hotmail.com>"
# Install Prereqs
ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update -qq && \
apt install -qq -y --no-install-recommends --no-install-suggests \
ca-certificates \
automake \
autoconf \
build-essential \
libcurl4-openssl-dev \
libpcre++-dev \
libtool \
libxml2-dev \
libyajl-dev \
lua5.2-dev \
git \
pkgconf \
ssdeep \
libgeoip-dev \
wget && \
apt-get clean && rm -rf /var/lib/apt/lists/*
RUN cd /opt && \
git clone --depth 1 -b v3/master --single-branch https://github.com/SpiderLabs/ModSecurity && \
cd ModSecurity && \
git submodule init && \
git submodule update && \
./build.sh && \
./configure && \
make && \
make install
RUN strip /usr/local/modsecurity/bin/* /usr/local/modsecurity/lib/*.a /usr/local/modsecurity/lib/*.so*
FROM ubuntu:18.04 AS nginx-build
ENV DEBIAN_FRONTEND noninteractive
ENV NGINX_VERSION 1.15.0
RUN apt-get update -qq && \
apt install -qq -y --no-install-recommends --no-install-suggests \
ca-certificates \
autoconf \
automake \
build-essential \
libtool \
pkgconf \
wget \
git \
zlib1g-dev \
libssl-dev \
libpcre3-dev \
libxml2-dev \
libyajl-dev \
lua5.2-dev \
libgeoip-dev \
libcurl4-openssl-dev \
openssl
RUN cd /opt && \
git clone --depth 1 https://github.com/SpiderLabs/ModSecurity-nginx.git
RUN cd /opt && \
git clone --recursive https://github.com/google/ngx_brotli.git
COPY --from=modsecurity-build /usr/local/modsecurity/ /usr/local/modsecurity/
RUN wget -q -P /opt https://nginx.org/download/nginx-"$NGINX_VERSION".tar.gz
RUN tar xvzf /opt/nginx-"$NGINX_VERSION".tar.gz -C /opt
RUN cd /opt/nginx-"$NGINX_VERSION" && \
./configure \
--prefix=/usr/local/nginx \
--sbin-path=/usr/local/nginx/nginx \
--modules-path=/usr/local/nginx/modules \
--conf-path=/etc/nginx/nginx.conf \
--error-log-path=/var/log/nginx/error.log \
--http-log-path=/var/log/nginx/access.log \
--pid-path=/run/nginx.pid \
--lock-path=/var/lock/nginx.lock \
--user=www-data \
--group=www-data \
--with-pcre-jit \
--with-file-aio \
--with-threads \
--with-http_addition_module \
--with-http_auth_request_module \
--with-http_flv_module \
--with-http_gunzip_module \
--with-http_gzip_static_module \
--with-http_mp4_module \
--with-http_random_index_module \
--with-http_realip_module \
--with-http_slice_module \
--with-http_ssl_module \
--with-http_sub_module \
--with-http_stub_status_module \
--with-http_v2_module \
--with-http_secure_link_module \
--with-stream \
--with-stream_realip_module \
--add-module=/opt/ModSecurity-nginx \
--add-module=/opt/ngx_brotli \
--with-cc-opt='-g -O2 -specs=/usr/share/dpkg/no-pie-compile.specs -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' \
--with-ld-opt='-specs=/usr/share/dpkg/no-pie-link.specs -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie' \
--with-http_dav_module
RUN cd /opt/nginx-"$NGINX_VERSION" && \
make && \
make install && \
make modules
RUN mkdir -p /var/log/nginx/
RUN touch /var/log/nginx/access.log
RUN touch /var/log/nginx/error.log
EXPOSE 80
STOPSIGNAL SIGTERM
CMD ["/usr/local/nginx/nginx", "-g", "daemon off;"]
FROM ubuntu:18.04
ENV DEBIAN_FRONTEND noninteractive
# Libraries for ModSecurity
RUN apt update && \
apt-get install --no-install-recommends --no-install-suggests -y \
ca-certificates \
libcurl4-openssl-dev \
libyajl-dev \
lua5.2-dev \
libgeoip-dev \
vim \
libxml2
RUN apt clean && \
rm -rf /var/lib/apt/lists/*
COPY --from=modsecurity-build /usr/local/modsecurity/ /usr/local/modsecurity/
RUN ldconfig
COPY --from=nginx-build /usr/local/nginx/nginx /usr/local/nginx/nginx
COPY --from=nginx-build /etc/nginx /etc/nginx
COPY --from=nginx-build /usr/local/nginx/html /usr/local/nginx/html
# NGiNX Create log dirs
RUN mkdir -p /var/log/nginx/
RUN touch /var/log/nginx/access.log
RUN touch /var/log/nginx/error.log
RUN sed -i '38i modsecurity on;\n\tmodsecurity_rules_file /etc/nginx/modsecurity.d/include.conf;' /etc/nginx/nginx.conf
RUN mkdir -p /etc/nginx/modsecurity.d
RUN echo "include /etc/nginx/modsecurity.d/modsecurity.conf" > /etc/nginx/modsecurity.d/include.conf
COPY --from=modsecurity-build /opt/ModSecurity/modsecurity.conf-recommended /etc/nginx/modsecurity.d
RUN cd /etc/nginx/modsecurity.d && \
mv modsecurity.conf-recommended modsecurity.conf
## Version for ModSecurity Core Rule Set
ARG VERSION=3.0.2
## Install Curl
RUN apt-get update && apt-get install curl -y && apt-get clean
## Get ModSecurity CRS
RUN curl -s https://codeload.github.com/SpiderLabs/owasp-modsecurity-crs/tar.gz/v${VERSION} --output ~/modsec.tar.gz
RUN tar -xzf ~/modsec.tar.gz -C /etc/nginx
RUN rm ~/modsec.tar.gz
## Install ModSecurity CRS
RUN cat /etc/nginx/owasp-modsecurity-crs-${VERSION}/crs-setup.conf.example /etc/nginx/owasp-modsecurity-crs-${VERSION}/rules/*.conf >> /etc/nginx/modsecurity.d/crs.conf
RUN cp /etc/nginx/owasp-modsecurity-crs-${VERSION}/rules/*.data /etc/nginx/modsecurity.d/
RUN rm -rf /etc/nginx/owasp-modsecurity-crs-*
RUN echo "include /etc/nginx/modsecurity.d/crs.conf">>/etc/nginx/modsecurity.d/include.conf
RUN sed -i -e 's/SecRuleEngine DetectionOnly/SecRuleEngine On/g' /etc/nginx/modsecurity.d/modsecurity.conf
## Update nginx config
COPY nginx /etc/nginx/
EXPOSE 80
STOPSIGNAL SIGTERM
CMD ["/usr/local/nginx/nginx", "-g", "daemon off;"]