-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support all the currently supported NAP WAF distributions (#272)
- Loading branch information
Showing
11 changed files
with
146 additions
and
38 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,39 +1,51 @@ | ||
| --- | ||
| - name: (Alpine Linux) Set up NGINX App Protect DoS signing key | ||
| - name: (Alpine Linux) Set up NGINX App Protect and security updates signing key | ||
| when: ansible_facts['os_family'] == "Alpine" | ||
| block: | ||
| - name: (Alpine Linux) Set up NGINX App Protect DoS signing key URL | ||
| - name: (Alpine Linux) Set up NGINX App Protect WAF/DoS signing key URL | ||
| ansible.builtin.set_fact: | ||
| keysite: "{{ nginx_app_protect_signing_key['nginx_plus'] | default(nginx_app_protect_default_signing_key_rsa_pub) }}" | ||
|
|
||
| - name: (Alpine Linux) Download NGINX App Protect DoS signing key | ||
| - name: (Alpine Linux) Download NGINX App Protect WAF/DoS signing key | ||
| ansible.builtin.get_url: | ||
| url: "{{ keysite }}" | ||
| dest: /etc/apk/keys/nginx_signing.rsa.pub | ||
| mode: "0400" | ||
|
|
||
| - name: (Alpine Linux) Set up NGINX App Protect WAF security updates signing key URL | ||
| ansible.builtin.set_fact: | ||
| keysite_security_updates: "{{ nginx_app_protect_signing_key['waf_security_updates'] | default(nginx_app_protect_waf_security_updates_default_signing_key_rsa_pub) }}" | ||
| when: nginx_app_protect_waf_enable | bool | ||
|
|
||
| - name: (Alpine Linux) Download NGINX App Protect WAF security updates signing key | ||
| ansible.builtin.get_url: | ||
| url: "{{ keysite_security_updates }}" | ||
| dest: /etc/apk/keys/app-protect-security-updates.rsa.pub | ||
| mode: "0400" | ||
| when: nginx_app_protect_waf_enable | bool | ||
|
|
||
| - name: (Debian/Ubuntu) Set up NGINX App Protect and security updates signing key | ||
| when: ansible_facts['os_family'] == "Debian" | ||
| block: | ||
| - name: (Debian/Ubuntu) Add NGINX Plus signing key | ||
| - name: (Debian/Ubuntu) Add NGINX App Protect WAF/DoS signing key | ||
| ansible.builtin.apt_key: | ||
| keyring: /usr/share/keyrings/nginx-archive-keyring.gpg | ||
| url: "{{ nginx_app_protect_signing_key['nginx_plus'] | default(nginx_app_protect_default_signing_key_pgp) }}" | ||
|
|
||
| - name: (Debian/Ubuntu) Add NGINX App Protect security updates signing key | ||
| - name: (Debian/Ubuntu) Add NGINX App Protect WAF security updates signing key | ||
| ansible.builtin.apt_key: | ||
| keyring: /usr/share/keyrings/nginx-archive-keyring.gpg | ||
| url: "{{ nginx_app_protect_waf_signing_key['waf_security_updates'] | default(nginx_app_protect_waf_security_updates_default_signing_key_pgp) }}" | ||
| when: (nginx_app_protect_waf_install_signatures | bool) or (nginx_app_protect_waf_install_threat_campaigns | bool) | ||
| when: nginx_app_protect_waf_enable | bool | ||
|
|
||
| - name: (Amazon Linux/CentOS/RHEL) Set up NGINX App Protect and security updates signing key | ||
| when: ansible_facts['os_family'] == "RedHat" | ||
| block: | ||
| - name: (CentOS/RHEL) Add NGINX Plus signing key | ||
| - name: (CentOS/RHEL) Add NGINX WAF/DoS signing key | ||
| ansible.builtin.rpm_key: | ||
| key: "{{ nginx_app_protect_signing_key['nginx_plus'] | default(nginx_app_protect_default_signing_key_pgp) }}" | ||
|
|
||
| - name: (Amazon Linux/CentOS/RHEL) Add NGINX App Protect security updates signing key | ||
| - name: (Amazon Linux/CentOS/RHEL) Add NGINX App Protect WAF security updates signing key | ||
| ansible.builtin.rpm_key: | ||
| key: "{{ nginx_app_protect_waf_signing_key['waf_security_updates'] | default(nginx_app_protect_waf_security_updates_default_signing_key_pgp) }}" | ||
| when: (nginx_app_protect_waf_install_signatures | bool) or (nginx_app_protect_waf_install_threat_campaigns | bool) | ||
| when: nginx_app_protect_waf_enable | bool |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| --- | ||
| - name: (Alpine Linux) {{ nginx_app_protect_license_status is defined | ternary('Remove', 'Configure') }} NGINX Plus repository | ||
| ansible.builtin.lineinfile: | ||
| path: /etc/apk/repositories | ||
| insertafter: EOF | ||
| line: "{{ nginx_plus_repository | default(nginx_plus_default_repository_alpine) }}" | ||
| state: "{{ nginx_app_protect_license_status | default((nginx_app_protect_waf_setup == 'uninstall') | ternary('absent', 'present')) }}" | ||
| when: nginx_app_protect_waf_manage_repo | bool | ||
|
|
||
| - name: (Alpine Linux) {{ nginx_app_protect_license_status is defined | ternary('Remove', 'Configure') }} NGINX App Protect WAF repository | ||
| ansible.builtin.lineinfile: | ||
| path: /etc/apk/repositories | ||
| insertafter: EOF | ||
| line: "{{ nginx_app_protect_waf_repository | default(nginx_app_protect_waf_default_repository_alpine) }}" | ||
| state: "{{ nginx_app_protect_license_status | default((nginx_app_protect_waf_setup == 'uninstall') | ternary('absent', 'present')) }}" | ||
| when: nginx_app_protect_waf_manage_repo | bool | ||
|
|
||
| - name: (Alpine Linux) {{ nginx_app_protect_license_status is defined | ternary('Remove', 'Configure') }} NGINX App Protect WAF security updates repository | ||
| ansible.builtin.lineinfile: | ||
| path: /etc/apk/repositories | ||
| insertafter: EOF | ||
| line: "{{ nginx_app_protect_waf_security_updates_repository | default(nginx_app_protect_waf_security_updates_default_repository_alpine) }}" | ||
| state: "{{ nginx_app_protect_license_status | default((nginx_app_protect_waf_setup == 'uninstall') | ternary('absent', 'present')) }}" | ||
| when: nginx_app_protect_waf_manage_repo | bool | ||
|
|
||
| - name: (Alpine Linux) {{ nginx_app_protect_waf_setup | capitalize }} NGINX Plus | ||
| community.general.apk: | ||
| name: nginx-plus | ||
| repository: "{{ nginx_plus_repository | default(nginx_plus_default_repository_alpine) }}" | ||
| state: "{{ nginx_app_protect_waf_state }}" | ||
| ignore_errors: "{{ ansible_check_mode }}" | ||
| when: nginx_app_protect_license_status is not defined | ||
| notify: (Handler - NGINX App Protect) Run NGINX | ||
|
|
||
| - name: (Alpine Linux) {{ nginx_app_protect_waf_setup | capitalize }} NGINX App Protect WAF | ||
| community.general.apk: | ||
| name: app-protect | ||
| state: "{{ nginx_app_protect_waf_state }}" | ||
| ignore_errors: "{{ ansible_check_mode }}" | ||
| when: nginx_app_protect_license_status is not defined | ||
| notify: (Handler - NGINX App Protect) Run NGINX | ||
|
|
||
| - name: (Alpine Linux) {{ nginx_app_protect_waf_setup | capitalize }} NGINX App Protect WAF signatures {{ nginx_app_protect_waf_signatures_version is defined | ternary(nginx_app_protect_signatures_version, '') }} | ||
| community.general.apk: | ||
| name: app-protect-attack-signatures{{ nginx_app_protect_waf_signatures_version | default('') }} | ||
| state: "{{ nginx_app_protect_waf_state }}" | ||
| ignore_errors: "{{ ansible_check_mode }}" | ||
| when: nginx_app_protect_license_status is not defined | ||
| notify: (Handler - NGINX App Protect) Run NGINX | ||
|
|
||
| - name: (Alpine Linux) {{ nginx_app_protect_waf_setup | capitalize }} NGINX App Protect WAF threat campaigns {{ nginx_app_protect_waf_signatures_version is defined | ternary(nginx_app_protect_signatures_version, '') }} | ||
| community.general.apk: | ||
| name: app-protect-threat-campaigns{{ nginx_app_protect_waf_threat_campaigns_version | default('') }} | ||
| state: "{{ nginx_app_protect_waf_state }}" | ||
| ignore_errors: "{{ ansible_check_mode }}" | ||
| when: nginx_app_protect_license_status is not defined | ||
| notify: (Handler - NGINX App Protect) Run NGINX |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters