feat: use a modsecurity nginx firewall

Author: buehner

.gitignore

@@ -9,8 +9,8 @@ shogun-postgis/postgresql_data
 shogun-redis/redis_data
 shogun-solr/solr_data/data/search/data/
 shogun-solr/solr_data/logs/
-shogun-nginx/ssl/private/*.crt
-shogun-nginx/ssl/private/*.key
+*/ssl/private/*.crt
+*/ssl/private/*.key
 
 *iml
 .idea

common-services.yml

@@ -66,9 +66,6 @@ services:
       - ./shogun-admin/config/admin-client-config.js:/usr/share/nginx/html/admin/config/admin-client-config.js
       - ./shogun-admin/modelconfigs/:/usr/share/nginx/html/admin/modelconfigs/
       - ./shogun-client/config/gis-client-config.js:/usr/share/nginx/html/client/gis-client-config.js
-    ports:
-      - "80:80"
-      - "443:443"
     environment:
       KEYCLOAK_HOST: ${KEYCLOAK_HOST}
     depends_on:
@@ -80,6 +77,24 @@ services:
       - shogun-gis-client-docs
       - shogun-admin
       - shogun-admin-client-docs
+  shogun-firewall:
+    container_name: ${CONTAINER_NAME_PREFIX}-firewall
+    image: owasp/modsecurity-crs:nginx-alpine
+    ports:
+      - "80:8080"
+      - "443:8443"
+    environment:
+      BACKEND: http://shogun-nginx
+      NGINX_ALWAYS_TLS_REDIRECT: on
+      SSL_OCSP_STAPLING: on
+      LOGLEVEL: info
+      PARANOIA: 1
+      BLOCKING_PARANOIA: 1
+      ANOMALY_INBOUND: 5
+      ANOMALY_OUTBOUND: 4
+      REPORTING_LEVEL: 2
+    depends_on:
+      - shogun-nginx
   shogun-client:
     container_name: ${CONTAINER_NAME_PREFIX}-gis-client
   shogun-client-plugins:

docker-compose-prod.yml

@@ -39,9 +39,6 @@ services:
       file: ./common-services.yml
       service: shogun-nginx
     volumes:
-      # makes sure that certificates exist in the environment or use a different image that already contains the certificates
-      - ./shogun-nginx/ssl/private/localhost.crt:/etc/nginx/ssl/private/localhost.crt
-      - ./shogun-nginx/ssl/private/localhost.key:/etc/nginx/ssl/private/localhost.key
       - ./shogun-nginx/prod/default.conf:/etc/nginx/templates/default.conf.template
     restart: unless-stopped
     healthcheck:
@@ -50,6 +47,20 @@ services:
       retries: 5
       start_period: 5s
       timeout: 10s
+  shogun-firewall:
+    extends:
+      file: ./common-services.yml
+      service: shogun-firewall
+    volumes:
+      - ./shogun-nginx/ssl/private/localhost.crt://etc/nginx/conf/server.crt
+      - ./shogun-nginx/ssl/private/localhost.key:/etc/nginx/conf/server.key
+    restart: unless-stopped
+    healthcheck:
+      test: curl --fail http://localhost || exit 1
+      interval: 10s
+      retries: 5
+      start_period: 5s
+      timeout: 10s
   shogun-admin:
     extends:
       file: ./common-services.yml

docker-compose.yml

@@ -22,9 +22,14 @@ services:
       file: ./common-services.yml
       service: shogun-nginx
     volumes:
-      - ./shogun-nginx/ssl/private/localhost.crt:/etc/nginx/ssl/private/localhost.crt
-      - ./shogun-nginx/ssl/private/localhost.key:/etc/nginx/ssl/private/localhost.key
       - ./shogun-nginx/dev/default.conf:/etc/nginx/templates/default.conf.template
+  shogun-firewall:
+    extends:
+      file: ./common-services.yml
+      service: shogun-firewall
+    volumes:
+      - ./shogun-firewall/ssl/private/localhost.crt:/etc/nginx/conf/server.crt
+      - ./shogun-firewall/ssl/private/localhost.key:/etc/nginx/conf/server.key
   shogun-client:
     extends:
       file: ./common-services.yml

setEnvironment.sh

@@ -128,36 +128,36 @@ fi
 
 printf "Updating the SSL certificate\n"
 
-sed -i -E "s/IP.2    = (.+)/IP.2    = ${KEYCLOAK_HOST}/g" shogun-nginx/ssl/localhost.conf
+sed -i -E "s/IP.2    = (.+)/IP.2    = ${KEYCLOAK_HOST}/g" shogun-firewall/ssl/localhost.conf
 
 openssl req \
-  -config ./shogun-nginx/ssl/localhost.conf \
+  -config ./shogun-firewall/ssl/localhost.conf \
   -addext basicConstraints=critical,CA:TRUE,pathlen:1 \
   -batch \
   -x509 \
   -nodes \
   -days 3650 \
   -newkey rsa:2048 \
-  -keyout ./shogun-nginx/ssl/private/localhost.key \
-  -out ./shogun-nginx/ssl/private/localhost.crt
+  -keyout ./shogun-firewall/ssl/private/localhost.key \
+  -out ./shogun-firewall/ssl/private/localhost.crt
 
 printf "Updating the keystore of shogun-boot\n"
 
 if keytool -list -alias DEV -keystore ./shogun-boot/keystore/cacerts -noprompt -storepass changeit > /dev/null 2>&1; then
   keytool -delete -alias DEV -keystore ./shogun-boot/keystore/cacerts -noprompt -storepass changeit
 fi
-keytool -import -file ./shogun-nginx/ssl/private/localhost.crt -alias DEV -keystore ./shogun-boot/keystore/cacerts -noprompt -storepass changeit
+keytool -import -file ./shogun-firewall/ssl/private/localhost.crt -alias DEV -keystore ./shogun-boot/keystore/cacerts -noprompt -storepass changeit
 
 printf "Updating the keystore of shogun-geoserver\n"
 
 if keytool -list -alias DEV -keystore ./shogun-geoserver/keystore/cacerts -noprompt -storepass changeit > /dev/null 2>&1; then
   keytool -delete -alias DEV -keystore ./shogun-geoserver/keystore/cacerts -noprompt -storepass changeit
 fi
-keytool -import -file ./shogun-nginx/ssl/private/localhost.crt -alias DEV -keystore ./shogun-geoserver/keystore/cacerts -noprompt -storepass changeit
+keytool -import -file ./shogun-firewall/ssl/private/localhost.crt -alias DEV -keystore ./shogun-geoserver/keystore/cacerts -noprompt -storepass changeit
 
 printf "Updating the keystore of shogun-keycloak\n"
 
 if keytool -list -alias DEV -keystore ./shogun-keycloak/keystore/cacerts -noprompt -storepass changeit > /dev/null 2>&1; then
   keytool -delete -alias DEV -keystore ./shogun-keycloak/keystore/cacerts -noprompt -storepass changeit
 fi
-keytool -import -file ./shogun-nginx/ssl/private/localhost.crt -alias DEV -keystore ./shogun-keycloak/keystore/cacerts -noprompt -storepass changeit
+keytool -import -file ./shogun-firewall/ssl/private/localhost.crt -alias DEV -keystore ./shogun-keycloak/keystore/cacerts -noprompt -storepass changeit

shogun-nginx/ssl/localhost.conf renamed to shogun-firewall/ssl/localhost.conf

@@ -23,4 +23,4 @@ subjectAltName = @alt_names
 [alt_names]
 DNS.1   = localhost
 IP.1    = 127.0.0.1
-IP.2    = 1.2.3.4
+IP.2    = 192.168.192.60

shogun-nginx/ssl/private/.gitkeep renamed to shogun-firewall/ssl/private/.gitkeep

@@ -7,10 +7,7 @@ server {
   listen 80 default_server;
   listen [::]:80 default_server;
   server_name localhost;
-  return 308 https://$http_host$request_uri;
-}
 
-server {
   client_max_body_size 0;
   client_header_buffer_size 1024k;
   large_client_header_buffers 4 64k;
@@ -24,12 +21,7 @@ server {
   gzip_proxied any;
   gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml application/javascript application/json;
 
-  listen 443 ssl default_server;
-  listen [::]:443 ssl default_server;
   http2 on;
-  ssl_certificate /etc/nginx/ssl/private/localhost.crt;
-  ssl_certificate_key /etc/nginx/ssl/private/localhost.key;
-  server_name localhost;
 
   location /auth/ {
     proxy_pass http://shogun-keycloak:8080/auth/;