Adding stuff

2024-12-18 11:46:51 +00:00
commit e8043f036d
11 changed files with 406 additions and 0 deletions
@@ -0,0 +1,21 @@
+js_import /usr/share/nginx-plus-module-prometheus/prometheus.js;
+    # ...
+    server {
+        listen 10.40.32.42:8080;
+        # ...
+        location /api {
+            api write=on;
+            allow 10.0.0.0/8;
+            deny  all;
+        }
+        location = /dashboard.html {
+            auth_basic "Password Required";
+            auth_basic_user_file /etc/nginx/.htpasswd;
+            root   /usr/share/nginx/html;
+	    allow 10.0.0.0/8;
+	    deny all;
+        }
+	location = /metrics {
+	    js_content prometheus.metrics;
+	}
+}
@@ -0,0 +1,23 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+map $remote_addr $proxy_forwarded_elem {
+    # IPv4 addresses can be sent as-is
+    ~^[0-9.]+$          "for=$remote_addr";
+
+    # IPv6 addresses need to be bracketed and quoted
+    ~^[0-9A-Fa-f:.]+$   "for=\"[$remote_addr]\"";
+
+    # Unix domain socket names cannot be represented in RFC 7239 syntax
+    default             "for=unknown";
+}
+
+map $http_forwarded $proxy_add_forwarded {
+    # If the incoming Forwarded header is syntactically valid, append to it
+    "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";
+
+    # Otherwise, replace it
+    default "$proxy_forwarded_elem";
+}
@@ -0,0 +1,4 @@
+   app_protect_enable on; # This is how you enable NGINX App Protect WAF in the relevant context/block
+   app_protect_policy_file "/etc/app_protect/conf/NginxDefaultPolicy.json"; # This is a reference to the policy file to use. If not defined, the default policy is used
+   app_protect_security_log_enable on; # This section enables the logging capability
+   app_protect_security_log "/etc/app_protect/conf/log_default.json" syslog:server=127.0.0.1:514;