nginx-waf/proxy (sha256:e37806ef4a8e9b257811c1d2e95a6257008049b7c3871d77dc9b4f5a7a68a173)
Published 2026-01-31 18:51:32 +01:00 by Manuel
Installation
docker pull git.glaeser-it.de/klueber-it/nginx-waf/proxy@sha256:e37806ef4a8e9b257811c1d2e95a6257008049b7c3871d77dc9b4f5a7a68a173sha256:e37806ef4a8e9b257811c1d2e95a6257008049b7c3871d77dc9b4f5a7a68a173Image layers
| ADD alpine-minirootfs-3.23.2-x86_64.tar.gz / # buildkit |
| CMD ["/bin/sh"] |
| ARG TZ=Europe/Berlin |
| ENV TZ=Europe/Berlin |
| RUN |1 TZ=Europe/Berlin /bin/sh -c apk update && apk upgrade --no-cache && apk add --no-cache pcre2 zlib libxml2 libxslt gd geoip lmdb yajl openssl libcurl ca-certificates curl wget jq bind-tools supervisor tzdata gettext luajit lua5.1-cjson bash coreutils libstdc++ libgcc logrotate inotify-tools lua-resty-core lua-resty-lrucache lua-resty-string lua-resty-openssl lua-resty-http git python3 py3-pip docker-cli # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c pip3 install --no-cache-dir --break-system-packages starlette==0.41.3 uvicorn==0.32.1 PyYAML==6.0.2 # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c mkdir -p /usr/local/openresty/lualib && ln -sf /usr/share/lua/5.1/resty /usr/local/openresty/lualib/resty && ln -sf /usr/share/lua/5.1/ngx /usr/local/openresty/lualib/ngx # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c git clone --depth 1 https://github.com/crowdsecurity/lua-cs-bouncer.git /tmp/lua-cs-bouncer && mkdir -p /usr/local/openresty/lualib && cp /tmp/lua-cs-bouncer/lib/crowdsec.lua /usr/local/openresty/lualib/ && cp -r /tmp/lua-cs-bouncer/lib/plugins /usr/local/openresty/lualib/ && sed -i 's/local captcha_ok = true/local captcha_ok = true\n if runtime.conf["CAPTCHA_PROVIDER"] ~= "none" then/' /usr/local/openresty/lualib/crowdsec.lua && sed -i '/captcha_ok = false/a\ end' /usr/local/openresty/lualib/crowdsec.lua && rm -rf /tmp/lua-cs-bouncer # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c (id -u nginx >/dev/null 2>&1 || adduser -D -H -s /sbin/nologin nginx) && mkdir -p /var/cache/nginx/{client_temp,proxy_temp,fastcgi_temp,uwsgi_temp,scgi_temp} /var/log/nginx/hosts /var/log/modsec_audit /var/log/supervisor /etc/nginx/modsecurity.d /etc/nginx/owasp-crs /etc/nginx/sites-available /etc/nginx/sites-enabled /etc/nginx/streams-available /etc/nginx/streams-enabled && chown -R nginx:nginx /var/cache/nginx /var/log/nginx /var/log/modsec_audit # buildkit |
| COPY /usr/sbin/nginx /usr/sbin/nginx # buildkit |
| COPY /etc/nginx /etc/nginx # buildkit |
| COPY /usr/lib/nginx /usr/lib/nginx # buildkit |
| COPY /usr/local/lib/libmodsecurity* /usr/local/lib/ # buildkit |
| COPY /usr/local/include/modsecurity /usr/local/include/modsecurity # buildkit |
| COPY /build/ModSecurity/unicode.mapping /etc/nginx/modsecurity.d/ # buildkit |
| COPY /usr/lib/nginx/modules/ngx_cp_attachment_module.so* /usr/lib/nginx/modules/ # buildkit |
| COPY /usr/lib/libosrc*.so* /usr/lib/ # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c for lib in /usr/local/lib/libmodsecurity*; do ln -sf "$lib" /usr/lib/$(basename "$lib") 2>/dev/null || true; done # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c mkdir -p /etc/nginx/owasp-crs /etc/nginx/ssl && cat > /etc/nginx/modsecurity.d/modsecurity.conf <<'EOF' SecRuleEngine On SecRequestBodyAccess On SecRequestBodyLimit 13107200 SecRequestBodyNoFilesLimit 131072 SecRequestBodyLimitAction Reject SecResponseBodyAccess On SecResponseBodyMimeType text/plain text/html text/xml SecResponseBodyLimit 524288 SecResponseBodyLimitAction ProcessPartial SecTmpDir /tmp/ SecDataDir /tmp/ SecAuditEngine RelevantOnly SecAuditLogRelevantStatus "^(?:5|4(?!04))" SecAuditLogParts ABIJDEFHZ SecAuditLogType Serial SecAuditLog /var/log/modsec_audit/modsec_audit.log SecArgumentSeparator & SecCookieFormat 0 SecUnicodeMapFile /etc/nginx/modsecurity.d/unicode.mapping 20127 SecStatusEngine On EOF # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c cat > /etc/nginx/modsecurity.d/main.conf <<'EOF' Include /etc/nginx/modsecurity.d/modsecurity.conf Include /etc/nginx/owasp-crs/crs-setup.conf Include /etc/nginx/owasp-crs/rules/*.conf EOF # buildkit |
| COPY config/nginx/nginx.conf.default /etc/nginx/nginx.conf.default # buildkit |
| COPY config/supervisor/supervisord-proxy.conf /etc/supervisor/conf.d/supervisord.conf # buildkit |
| COPY config/nginx/error-pages /etc/nginx/error-pages # buildkit |
| COPY config/nginx/conf.d/error-pages-location.inc /etc/nginx/conf.d/error-pages-location.inc # buildkit |
| COPY config/crowdsec/crowdsec-bouncer.conf /etc/nginx/crowdsec-bouncer.conf # buildkit |
| COPY config/crowdsec/crowdsec-bouncer-active.conf /etc/nginx/crowdsec-bouncer-active.conf # buildkit |
| COPY config/crowdsec/crowdsec-lua-bouncer.conf /etc/crowdsec-lua-bouncer.conf.template # buildkit |
| COPY config/nginx/openappsec-module.conf /etc/nginx/openappsec-module.conf # buildkit |
| COPY config/nginx/openappsec-attachment.conf /etc/nginx/openappsec-attachment.conf # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c mkdir -p /scripts # buildkit |
| COPY scripts/entrypoint-proxy.sh /entrypoint.sh # buildkit |
| COPY scripts/crs-update.sh /scripts/crs-update.sh # buildkit |
| COPY scripts/crs-update-scheduler.sh /scripts/crs-update-scheduler.sh # buildkit |
| COPY scripts/update-logrotate.sh /scripts/update-logrotate.sh # buildkit |
| COPY scripts/logrotate-scheduler.sh /scripts/logrotate-scheduler.sh # buildkit |
| COPY scripts/management-api.py /scripts/management-api.py # buildkit |
| COPY scripts/toggle-openappsec.sh /scripts/toggle-openappsec.sh # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c chmod +x /entrypoint.sh /scripts/*.sh /scripts/*.py # buildkit |
| RUN |1 TZ=Europe/Berlin /bin/sh -c mkdir -p /etc/cp/conf /var/log/nano_agent # buildkit |
| EXPOSE map[443/tcp:{} 80/tcp:{}] |
| HEALTHCHECK &{["CMD-SHELL" "pgrep -f \"nginx: master\" >/dev/null && curl -sf http://localhost:${PROXY_API_PORT:-9001}/health >/dev/null || exit 1"] "30s" "5s" "15s" '\x03'} |
| ENTRYPOINT ["/entrypoint.sh"] |
| CMD ["/usr/bin/supervisord" "-c" "/etc/supervisor/conf.d/supervisord.conf"] |