Skip to content

Commit 1ede095

Browse files
ADubhlaoichADubhlaoich
committed
feat: Finish Docker installation doc
1 parent 427ea92 commit 1ede095

File tree

10 files changed

+364
-543
lines changed

10 files changed

+364
-543
lines changed

‎content/includes/waf/install-build-image.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
---
3+
4+
Your folder should contain the following files:
5+
6+
- _nginx-repo.cert_
7+
- _nginx-repo.key_
8+
- _nginx.conf_
9+
- _entrypoint.sh_
10+
- _Dockerfile_
11+
- _custom_log_format.json_ (Optional)
12+
13+
To build an image, use the following command, replacing `<your-image-name>` as appropriate:
14+
15+
```shell
16+
sudo docker build --no-cache --platform linux/amd64 --secret id=nginx-crt,src=nginx-repo.cert --secret id=nginx-key,src=nginx-repo.key -t <your-image-name> .
17+
```
18+
19+
A RHEL-based system would use the following command instead:
20+
21+
```shell
22+
podman build --no-cache --secret id=nginx-crt,src=nginx-repo.cert --secret id=nginx-key,src=nginx-repo.key -t <your-image-name> .
23+
```
24+
25+
{{< call-out "note" >}}
26+
27+
The `--no-cache` option is used to ensure the image is built from scratch, installing the latest versions of NGINX Plus and F5 WAF for NGINX.
28+
29+
{{< /call-out >}}
30+
31+
Verify that your image has been created using the `docker images` command:
32+
33+
```shell
34+
docker images <your-image-name>
35+
```
36+
37+
Create a container based on this image, replacing <your-container-name> as appropriate:
38+
39+
```shell
40+
docker run --name <your-container-name> -p 80:80 -d <your-image-name>
41+
```
42+
43+
Verify the new container is running using the `docker ps` command:
44+
45+
```shell
46+
docker ps
47+
```

‎content/includes/waf/install-create-configuration.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
---
3+
4+
Copy or move your subscription files into a new folder.
5+
6+
In the same folder, create three files:
7+
8+
- _nginx.conf_ - An NGINX configuration file with F5 WAF for NGINX enabled
9+
- _entrypoint.sh_ - A Docker startup script which spins up all F5 WAF for NGINX processes, requiring executable permissions
10+
- _custom_log_format.json_ - An optional user-defined security log format file
11+
12+
{{< call-out "note" >}}
13+
14+
If you are not using using `custom_log_format.json`, you should remove any references to it from your nginx.conf and entrypoint.sh files.
15+
16+
{{< /call-out >}}
17+
18+
Here are examples of the file contents:

‎content/includes/waf/install-next-steps.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@ nd-docs:
44

55
Once you have successfully installed F5 WAF for NGINX, there are some topics you may want to follow afterwards:
66

7+
- [Configure NGINX features with F5 WAF]({{< ref "/waf/configure/nginx-features.md" >}}), to see common configurations
78
- [Configure policies]({{< ref "/waf/policies/configuration.md" >}}), to begin customizing your deployment
8-
- [Secure traffic using mTLS]({{< ref "/waf/configure/secure-mtls.md" >}}), for an extra layer of security between NGINX and F5 WAF enforcer
9-
- [IP intelligence]({{< ref "/waf/policies/ip-intelligence.md">}}), to enable the IP intelligence feature
109
- [Converter tools]({{< ref "/waf/configure/converters.md" >}}), to convert existing resources from a BIG-IP environment
1110
- [Changelog]({{< ref "/waf/changelog.md" >}}), to view information from the latest releases

‎content/includes/waf/install-services-compose.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,4 @@ To start the F5 WAF for NGINX services, use `docker compose up` in the same fold
4141

4242
```shell
4343
sudo docker compose up -d
44-
```
45-
46-
F5 WAF for NGINX should now be operational, and you can move onto [Post-installation checks](#post-installation-checks).
44+
```

‎content/includes/waf/install-update-configuration.md‎

Lines changed: 1 addition & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -26,100 +26,4 @@ You should only enable F5 WAF for NGINX on _proxy_pass_ and _grpc_pass_ location
2626

2727
{{< /call-out >}}
2828

29-
Here are two examples of how these additions could look in configuration files:
30-
31-
{{<tabs name="example-configuration-files">}}
32-
33-
{{% tab name="nginx.conf" %}}
34-
35-
`/etc/nginx/nginx.conf`
36-
37-
```nginx
38-
user nginx;
39-
worker_processes auto;
40-
41-
# F5 WAF for NGINX
42-
load_module modules/ngx_http_app_protect_module.so;
43-
44-
error_log /var/log/nginx/error.log notice;
45-
pid /var/run/nginx.pid;
46-
47-
events {
48-
worker_connections 1024;
49-
}
50-
51-
http {
52-
include /etc/nginx/mime.types;
53-
default_type application/octet-stream;
54-
55-
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
56-
'$status $body_bytes_sent "$http_referer" '
57-
'"$http_user_agent" "$http_x_forwarded_for"';
58-
59-
access_log /var/log/nginx/access.log main;
60-
61-
sendfile on;
62-
#tcp_nopush on;
63-
64-
keepalive_timeout 65;
65-
66-
#gzip on;
67-
68-
# F5 WAF for NGINX
69-
app_protect_enforcer_address 127.0.0.1:50000;
70-
71-
include /etc/nginx/conf.d/*.conf;
72-
}
73-
```
74-
75-
76-
{{% /tab %}}
77-
78-
{{% tab name="default.conf" %}}
79-
80-
`/etc/nginx/conf.d/default.conf`
81-
82-
```nginx
83-
server {
84-
listen 80;
85-
server_name domain.com;
86-
87-
proxy_http_version 1.1;
88-
89-
location / {
90-
91-
# F5 WAF for NGINX
92-
app_protect_enable on;
93-
94-
client_max_body_size 0;
95-
default_type text/html;
96-
proxy_pass http://127.0.0.1:8080/;
97-
}
98-
}
99-
100-
server {
101-
listen 8080;
102-
server_name localhost;
103-
104-
location / {
105-
root /usr/share/nginx/html;
106-
index index.html index.htm;
107-
}
108-
109-
# redirect server error pages to the static page /50x.html
110-
#
111-
error_page 500 502 503 504 /50x.html;
112-
location = /50x.html {
113-
root /usr/share/nginx/html;
114-
}
115-
}
116-
```
117-
118-
{{% /tab %}}
119-
120-
{{< /tabs >}}
121-
122-
Once you have updated your configuration files, you can reload NGINX to apply the changes. You have two options depending on your environment:
123-
124-
- `nginx -s reload`
125-
- `sudo systemctl reload nginx`
29+
Here are two examples of how these additions could look in configuration files:

‎content/waf/changelog.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,23 +28,23 @@ _September 29th, 2025_
2828

2929
### New features
3030

31-
- Added Policy lifecycle management
31+
- Added [Policy lifecycle management]({{< ref "/waf/policies/lifecycle-management.md" >}})
3232

3333
### Packages
3434

3535
{{< table >}}
3636

37-
| Distribution name | NGINX Open Source | NGINX Plus | V4 |
37+
| Distribution name | NGINX Open Source | NGINX Plus | NGINX Plus (Virtual/Single container) |
3838
| ------------------------ | ----------------------------------------------------------------- | -------------------------------------------------------------- |------------------ |
3939
| Alpine 3.19 | _app-protect-module-oss-1.29.0+5.498.0-r1.apk_ | _app-protect-module-plus-35+5.498.0-r1.apk_ | _app-protect-35.5.498.0-r1.apk_ |
4040
| Amazon Linux 2023 | _app-protect-module-oss-1.29.0+5.498.0-1.amzn2023.ngx.x86_64.rpm_ | _app-protect-module-plus-35+5.498.0-1.amzn2023.ngx.x86_64.rpm_ | _app-protect-35+5.498.0-1.amzn2023.ngx.x86_64.rpm_ |
4141
| Debian 11 | _app-protect-module-oss_1.29.0+5.498.0-1\~bullseye_amd64.deb_ | _app-protect-module-plus_35+5.498.0-1\~bullseye_amd64.deb_ | _app-protect_35+5.498.0-1\~bullseye_amd64.deb_ |
4242
| Debian 12 | _app-protect-module-oss_1.29.0+5.498.0-1\~bookworm_amd64.deb_ | _app-protect-module-plus_35+5.498.0-1\~bookworm_amd64.deb_ | _app-protect_35+5.498.0-1\~bookworm_amd64.deb_ |
4343
| Oracle Linux 8.1 | _app-protect-module-oss-1.29.0+5.498.0-1.el8.ngx.x86_64.rpm_ | _app-protect-module-plus-35+5.498.0-1.el8.ngx.x86_64.rpm_ | _app-protect-35+5.498.0-1.el8.ngx.x86_64.rpm_ |
44-
| Ubuntu 22.04 | _app-protect-module-oss_1.29.0+5.498.0-1\~jammy_amd64.deb_ | _app-protect-module-plus_35+5.498.0-1\~jammy_amd64.deb_ | _app-protect_35+5.498.0-1\~jammy_amd64.deb_ |
45-
| Ubuntu 24.04 | _app-protect-module-oss_1.29.0+5.498.0-1\~noble_amd64.deb_ | _app-protect-module-plus_35+5.498.0-1\~noble_amd64.deb_ | _app-protect_35+5.498.0-1\~noble_amd64.deb_ |
4644
| RHEL 8 and Rocky Linux 8 | _app-protect-module-oss-1.29.0+5.498.0-1.el8.ngx.x86_64.rpm_ | _app-protect-module-plus-35+5.498.0-1.el8.ngx.x86_64.rpm_ | _app-protect-35+5.498.0-1.el8.ngx.x86_64.rpm_ |
4745
| RHEL 9 and Rocky Linux 9 | _app-protect-module-oss-1.29.0+5.498.0-1.el9.ngx.x86_64.rpm_ | _app-protect-module-plus-35+5.498.0-1.el8.ngx.x86_64.rpm_ | _app-protect-35+5.498.0-1.el9.ngx.x86_64.rpm_ |
46+
| Ubuntu 22.04 | _app-protect-module-oss_1.29.0+5.498.0-1\~jammy_amd64.deb_ | _app-protect-module-plus_35+5.498.0-1\~jammy_amd64.deb_ | _app-protect_35+5.498.0-1\~jammy_amd64.deb_ |
47+
| Ubuntu 24.04 | _app-protect-module-oss_1.29.0+5.498.0-1\~noble_amd64.deb_ | _app-protect-module-plus_35+5.498.0-1\~noble_amd64.deb_ | _app-protect_35+5.498.0-1\~noble_amd64.deb_ |
4848

4949
{{< /table >}}
5050

‎content/waf/fundamentals/overview.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,19 +21,20 @@ It provides protection for the OWASP Top 10, with additional functionality:
2121
- Meta character checking
2222
- Disallowing file types
2323

24-
For more details, see the [Supported security policy features]({{< ref "/waf/fundamentals/technical-specifications.md#supported-security-policy-features">}}).
24+
For more details, see the [Supported security policy features]({{< ref "/waf/policies/configuration.md#supported-security-policy-features">}}).
2525

26-
It is platform-agnostic and supports a range of deployment options for operational needs:
26+
It is platform-agnostic and supports a range of deployment options:
2727

2828
1. [Virtual machine or bare metal]({{< ref "/waf/install/virtual-environment.md" >}})
29-
- NGINX operates on the host system
30-
- WAF components are deployed in containers
29+
- NGINX and WAF components operate on the host system
3130
- Ideal for existing NGINX virtual environments
3231
1. [Kubernetes]({{< ref "/waf/install/kubernetes.md" >}})
3332
- Integrates NGINX and WAF components in a single pod
3433
- Ideal for scalable, cloud-native environments
3534
1. [Docker]({{< ref "/waf/install/docker.md" >}})
3635
- NGINX and WAF components are deployed as containers
37-
- Suitable for environments with multiple deployment stages
36+
- Ideal for environments with multiple deployment stages
37+
38+
For more details, see the [Technical specifications]({{< ref "/waf/fundamentals/technical-specifications.md" >}}).
3839

3940
F5 WAF for NGINX is part of the [NGINX One](https://www.f5.com/products/nginx/one) premium packages and runs natively on [NGINX Plus](https://www.f5.com/products/nginx/nginx-plus) and [NGINX Ingress Controller](https://www.f5.com/products/nginx/nginx-ingress-controller).

‎content/waf/fundamentals/technical-specifications.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ This page outlines the technical specifications for F5 WAF for NGINX, which incl
1818

1919
You can deploy F5 WAF for NGINX in the following environments:
2020

21-
- [**Virtual environment** (Bare metal)]({{< ref "/waf/install/virtual-environment.md" >}})
21+
- [**Virtual machine or bare metal**]({{< ref "/waf/install/virtual-environment.md" >}})
2222
- [**Docker**]({{< ref "/waf/install/docker.md" >}})
2323
- [**Kubernetes**]({{< ref "/waf/install/kubernetes.md" >}})
2424

0 commit comments

Comments
 (0)