Skip to content

Commit 39a5cc0

Browse files
ADubhlaoichADubhlaoich
committed
feat: Add NAP-WAF Refactor POC
1 parent e3e0bc0 commit 39a5cc0

31 files changed

+753
-0
lines changed

‎_banners/waf-v4-warning.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{{< banner "caution" "This page is for NGINX App Protect v4.xx" >}}
2+
This documentation is intended for NGINX App Protect v4.xx.
3+
4+
For an NGINX App Protect v5.xx installation, see [Install NGINX App Protect and NGINX Ingress Controller with Docker and Helm]({{< ref "/waf/kubernetes/install-nic.md">}})
5+
{{</ banner >}}

‎_banners/waf-v5-warning.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{{< banner "caution" "This page is for NGINX App Protect v5.xx" >}}
2+
This documentation is intended for NGINX App Protect v5.xx.
3+
4+
For an NGINX App Protect v4.xx installation, see [Deploy NGINX App Protect WAF in a virtual environment]({{< ref "/waf/install/virtual-environment.md">}})
5+
{{</ banner >}}

‎content/waf/_index.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
# The title is the product name
3+
title: F5 NGINX App Protect WAF
4+
# The URL is the base of the deployed path, becoming "docs.nginx.com/<url>/<other-pages>"
5+
url: /app-protect-waf/
6+
# The cascade directive applies its nested parameters down the page tree until overwritten
7+
cascade:
8+
# The logo file is resolved from the theme, in the folder /static/images/icons/
9+
logo: NGINX-App-Protect-WAF-product-icon.svg
10+
# The subtitle displays directly underneath the heading of a given page
11+
nd-subtitle: A lightweight, high-performance web application firewall for protecting APIs and applications
12+
# Indicates that this is a custom landing page
13+
nd-landing-page: true
14+
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
15+
nd-content-type: landing-page
16+
# Intended for internal catalogue and search, case sensitive:
17+
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
18+
nd-product: NAP-WAF
19+
---
20+
21+
## About
22+
23+
Defend your applications and APIs with a software security solution that seamlessly integrates into DevOps environments as a lightweight web application firewall (WAF), layer 7 denial-of-service (DoS) protection, bot protection, API security, and threat intelligence services.
24+
25+
## Featured content
26+
[//]: # "You can add a maximum of three cards: any extra will not display."
27+
[//]: # "One card will take full width page: two will take half width each. Three will stack like an inverse pyramid."
28+
[//]: # "Some examples of content could be the latest release note, the most common install path, and a popular new feature."
29+
30+
{{<card-layout>}}
31+
{{<card-section showAsCards="true" isFeaturedSection="true">}}
32+
{{<card title="Install NGINX App Protect WAF" titleUrl="/waf/install" icon="chevrons-right" >}}
33+
Explore the methods available to deploy NGINX App Protect WAF in your environment.
34+
{{</card>}}
35+
<!-- The titleURL and icon are both optional -->
36+
<!-- Lucide icon names can be found at https://lucide.dev/icons/ -->
37+
{{<card title="Changelog" titleUrl="/waf/changelog" icon="archive">}}
38+
Review the latest changes and improvements to NGINX App Protect WAF.
39+
{{</card>}}
40+
{{</card-section>}}
41+
{{</card-layout>}}
42+
43+
<!-- ## Other content
44+
45+
[//]: # "You can add any extra content for the page here, such as additional cards, diagrams or text." -->

‎content/waf/changelog.md

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
---
2+
# We use sentence case and present imperative tone
3+
title: "Changelog"
4+
# Weights are assigned in increments of 100: determines sorting order
5+
weight: 800
6+
# Creates a table of contents and sidebar, useful for large documents
7+
toc: true
8+
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
9+
nd-content-type: reference
10+
# Intended for internal catalogue and search, case sensitive:
11+
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
12+
nd-product: NAP-WAF
13+
---
14+
15+
{{< call-out "warning" "Information architecture note" >}}
16+
17+
The design intention for this page is to act as a single reference point for changes between each release. "Changelog" is the term being adopted across the entire NGINX product ecosystem.
18+
19+
Since both versions of NGINX App Protect WAF are released at the same time, they can be stored in the same note. Change items for only one specific version are explicitly annotated when necessary.
20+
21+
Updating the content of this page will likely be automated in the future, following some procedural changes to how tickets are managed within JIRA.
22+
23+
{{</ call-out>}}
24+
25+
This changelog lists all of the information for F5 NGINX App Protect WAF releases in 2025.
26+
27+
For older releases, check the changelogs for previous years: [2024](), [2023]().
28+
29+
## NGINX App Protect WAF 5.7 / 4.15
30+
31+
### New features
32+
33+
- Added support for Rocky Linux 9
34+
- Added support for IP Intelligence
35+
- Added support for Override rules for IP Address Lists
36+
37+
### Important notes
38+
39+
- Ubuntu 20.04 is no longer supported
40+
- (12447) Upgrade libk5crypto3 package
41+
- (12520) Upgrade Go compiler to 1.23.8
42+
43+
### Resolved issues
44+
45+
- (12527) Remove CPAN - installed certs and source files
46+
- (11112) Remove systemd/init.d leftovers in NAP WAF v5 pkgs
47+
- (12400) Cookie attributes are not added to a TS cookie when there is more than one TS cookie
48+
- (12498) Undefined behavior when using huge XFF
49+
- (12731) Multiple clean_resp_reset internal error messages in logs when loading NAP
50+
51+
### 5.7 packages
52+
53+
#### NGINX Open Source
54+
55+
| Distribution name | Package file |
56+
|--------------------------|-------------------------------------------------------------------|
57+
| Alpine 3.19 | _app-protect-module-oss-1.27.4+5.442.0-r1.apk_ |
58+
| Amazon Linux 2023 | _app-protect-module-oss-1.27.4+5.442.0-1.amzn2023.ngx.x86_64.rpm_ |
59+
| Debian 11 | _app-protect-module-oss_1.27.4+5.442.0-1\~bullseye_amd64.deb_ |
60+
| Debian 12 | _app-protect-module-oss_1.27.4+5.442.0-1\~bookworm_amd64.deb_ |
61+
| Oracle Linux 8.1 | _app-protect-module-oss-1.27.4+5.442.0-1.el8.ngx.x86_64.rpm_ |
62+
| Ubuntu 22.04 | _app-protect-module-oss_1.27.4+5.442.0-1\~jammy_amd64.deb_ |
63+
| Ubuntu 24.04 | _app-protect-module-oss_1.27.4+5.442.0-1\~noble_amd64.deb_ |
64+
| RHEL 8 and Rocky Linux 8 | _app-protect-module-oss-1.27.4+5.442.0-1.el8.ngx.x86_64.rpm_ |
65+
| RHEL 9 and Rocky Linux 9 | _app-protect-module-oss-1.27.4+5.442.0-1.el9.ngx.x86_64.rpm_ |
66+
67+
#### NGINX Plus
68+
69+
| Distribution name | Package file |
70+
|--------------------------|----------------------------------------------------------------|
71+
| Alpine 3.19 | _app-protect-module-plus-34+5.442.0-r1.apk_ |
72+
| Amazon Linux 2023 | _app-protect-module-plus-34+5.442.0-1.amzn2023.ngx.x86_64.rpm_ |
73+
| Debian 11 | _app-protect-module-plus_34+5.442.0-1\~bullseye_amd64.deb_ |
74+
| Debian 12 | _app-protect-module-plus_34+5.442.0-1\~bookworm_amd64.deb_ |
75+
| Oracle Linux 8.1 | _app-protect-module-plus-34+5.442.0-1.el8.ngx.x86_64.rpm_ |
76+
| Ubuntu 22.04 | _app-protect-module-plus_34+5.442.0-1\~jammy_amd64.deb_ |
77+
| Ubuntu 24.04 | _app-protect-module-plus_34+5.442.0-1\~noble_amd64.deb_ |
78+
| RHEL 8 and Rocky Linux 8 | _app-protect-module-plus-34+5.442.0-1.el8.ngx.x86_64.rpm_ |
79+
| RHEL 9 and Rocky Linux 9 | _app-protect-module-plus-34+5.442.0-1.el9.ngx.x86_64.rpm_ |
80+
81+
### 4.15 packages
82+
83+
| Distribution name | Package file |
84+
|--------------------------|----------------------------------------------------|
85+
| Alpine 3.19 | _app-protect-34.5.442.0-r1.apk_ |
86+
| Amazon Linux 2023 | _app-protect-34+5.442.0-1.amzn2023.ngx.x86_64.rpm_ |
87+
| Debian 11 | _app-protect_34+5.442.0-1\~bullseye_amd64.deb_ |
88+
| Debian 12 | _app-protect_34+5.442.0-1\~bookworm_amd64.deb_ |
89+
| Oracle Linux 8.1 | _app-protect-34+5.442.0-1.el8.ngx.x86_64.rpm_ |
90+
| Ubuntu 22.04 | _app-protect_34+5.442.0-1\~jammy_amd64.deb_ |
91+
| Ubuntu 24.04 | _app-protect_34+5.442.0-1\~noble_amd64.deb_ |
92+
| RHEL 8 and Rocky Linux 8 | _app-protect-34+5.442.0-1.el8.ngx.x86_64.rpm_ |
93+
| RHEL 9 and Rocky Linux 9 | _app-protect-34+5.442.0-1.el9.ngx.x86_64.rpm_ |
94+
95+
## NGINX App Protect WAF 5.6 / 4.14
96+
97+
### New features
98+
99+
- Added support for NGINX Plus R34
100+
- **5.6 Only:** You can now [deploy NGINX App Protect WAF 5+ using a Helm chart]({{< ref "/nap-waf/v5/admin-guide/deploy-with-helm.md">}})
101+
102+
### Important notes
103+
104+
- Alpine 3.17 is no longer supported
105+
106+
### Resolved issues
107+
108+
- Upgraded the Go compiler to 1.23.7
109+
- (12140) Changed the maximum memory of the XML processing engine to 8GB
110+
- (12254) A modified YAML file referenced by a JSON policy file causes a reload error when running `nginx -t`
111+
- (12296) "Violation Bad Unescape" is not enabled by default
112+
- (12297) "Violation Encoding" is not enabled by default
113+
114+
### 5.6 packages
115+
116+
#### NGINX Open Source
117+
118+
| Distribution name | Package file |
119+
|--------------------------|-------------------------------------------------------------------|
120+
| Alpine 3.19 | _app-protect-module-oss-1.27.4+5.342.0-r1.apk_ |
121+
| Amazon Linux 2023 | _app-protect-module-oss-1.27.4+5.342.0-1.amzn2023.ngx.x86_64.rpm_ |
122+
| Debian 11 | _app-protect-module-oss_1.27.4+5.342.0-1\~bullseye_amd64.deb_ |
123+
| Debian 12 | _app-protect-module-oss_1.27.4+5.342.0-1\~bookworm_amd64.deb_ |
124+
| Oracle Linux 8.1 | _app-protect-module-oss-1.27.4+5.342.0-1.el8.ngx.x86_64.rpm_ |
125+
| Ubuntu 20.04 | _app-protect-module-oss_1.27.4+5.342.0-1\~focal_amd64.deb_ |
126+
| Ubuntu 22.04 | _app-protect-module-oss_1.27.4+5.342.0-1\~jammy_amd64.deb_ |
127+
| Ubuntu 24.04 | _app-protect-module-oss_1.27.4+5.342.0-1\~noble_amd64.deb_ |
128+
| RHEL 8 and Rocky Linux 8 | _app-protect-module-oss-1.27.4+5.342.0-1.el8.ngx.x86_64.rpm_ |
129+
| RHEL 9 | _app-protect-module-oss-1.27.4+5.342.0-1.el9.ngx.x86_64.rpm_ |
130+
131+
#### NGINX Plus
132+
133+
| Distribution name | Package file |
134+
|--------------------------|----------------------------------------------------------------|
135+
| Alpine 3.19 | _app-protect-module-plus-34+5.342.0-r1.apk_ |
136+
| Amazon Linux 2023 | _app-protect-module-plus-34+5.342.0-1.amzn2023.ngx.x86_64.rpm_ |
137+
| Debian 11 | _app-protect-module-plus_34+5.342.0-1\~bullseye_amd64.deb_ |
138+
| Debian 12 | _app-protect-module-plus_34+5.342.0-1\~bookworm_amd64.deb_ |
139+
| Oracle Linux 8.1 | _app-protect-module-plus-34+5.342.0-1.el8.ngx.x86_64.rpm_ |
140+
| Ubuntu 20.04 | _app-protect-module-plus_34+5.342.0-1\~focal_amd64.deb_ |
141+
| Ubuntu 22.04 | _app-protect-module-plus_34+5.342.0-1\~jammy_amd64.deb_ |
142+
| Ubuntu 24.04 | _app-protect-module-plus_34+5.342.0-1\~noble_amd64.deb_ |
143+
| RHEL 8 and Rocky Linux 8 | _app-protect-module-plus-34+5.342.0-1.el8.ngx.x86_64.rpm_ |
144+
| RHEL 9 | _app-protect-module-plus-34+5.342.0-1.el9.ngx.x86_64.rpm_ |
145+
146+
### 4.14 packages
147+
148+
| Distribution name | Package file |
149+
|--------------------------|----------------------------------------------------|
150+
| Alpine 3.19 | _app-protect-34.5.342.0-r1.apk_ |
151+
| Amazon Linux 2023 | _app-protect-34+5.342.0-1.amzn2023.ngx.x86_64.rpm_ |
152+
| Debian 11 | _app-protect_34+5.342.0-1\~bullseye_amd64.deb_ |
153+
| Debian 12 | _app-protect_34+5.342.0-1\~bookworm_amd64.deb_ |
154+
| Oracle Linux 8.1 | _app-protect-34+5.342.0-1.el8.ngx.x86_64.rpm_ |
155+
| Ubuntu 20.04 | _app-protect_34+5.342.0-1\~focal_amd64.deb_ |
156+
| Ubuntu 22.04 | _app-protect_34+5.342.0-1\~jammy_amd64.deb_ |
157+
| Ubuntu 24.04 | _app-protect_34+5.342.0-1\~noble_amd64.deb_ |
158+
| RHEL 8 and Rocky Linux 8 | _app-protect-34+5.342.0-1.el8.ngx.x86_64.rpm_ |
159+
| RHEL 9 | _app-protect-34+5.342.0-1.el9.ngx.x86_64.rpm_ |

‎content/waf/features/_index.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
title: "Features"
3+
url: /app-protect-waf/features/
4+
weight: 700
5+
draft: true
6+
---

‎content/waf/fundamentals/_index.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
title: "Fundamentals"
3+
url: /app-protect-waf/fundamentals/
4+
weight: 100
5+
---

‎content/waf/fundamentals/overview.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
# We use sentence case and present imperative tone
3+
title: "Overview"
4+
# Weights are assigned in increments of 100: determines sorting order
5+
weight: 100
6+
# Creates a table of contents and sidebar, useful for large documents
7+
toc: false
8+
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
9+
nd-content-type: how-to
10+
# Intended for internal catalogue and search, case sensitive:
11+
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
12+
nd-product: NAP-WAF
13+
---
14+
15+
{{< call-out "warning" "Information architecture note" >}}
16+
17+
The design intention for this page is to describing what NGINX App Protect is, expanding on the detail from the [landing page]({{< ref "/waf/" >}}).
18+
19+
It is also an opportunity to explain the difference between NGINX App Protect versions, and how integrates with other products in the NGINX ecosystem.
20+
21+
The text here will likely be synthesized from the Overview descriptions at the top of the [Administration Guides]({{< ref "/nap-waf/v4/admin-guide/install.md#overview" >}}), but there's also detail from [F5.com](https://www.f5.com/products/nginx/nginx-app-protect) that can be added.
22+
23+
{{</ call-out>}}

‎content/waf/fundamentals/technical-specifications.md

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
# We use sentence case and present imperative tone
3+
title: "Technical specifications"
4+
# Weights are assigned in increments of 100: determines sorting order
5+
weight: 200
6+
# Creates a table of contents and sidebar, useful for large documents
7+
toc: false
8+
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
9+
nd-content-type: how-to
10+
# Intended for internal catalogue and search, case sensitive:
11+
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
12+
nd-product: NAP-WAF
13+
---
14+
15+
{{< call-out "warning" "Information architecture note" >}}
16+
17+
The design intention for this page is to act as a single source of truth for supported operating systems and version compatibility.
18+
19+
It follows a design pattern set by other NGINX product sets, showing various compatibility matrices:
20+
21+
- [NGINX Plus]({{< ref "/nginx/technical-specs.md" >}})
22+
- [NGINX Instance Manager]({{< ref "/nim/fundamentals/tech-specs.md" >}})
23+
- [NGINX Ingress Controller]({{< ref "/nic/technical-specifications.md" >}})
24+
25+
It is also where information about the [Supported Security Policy Features]({{< ref "/nap-waf/v4/configuration-guide/configuration.md#supported-security-policy-features" >}}) could be referenced, though most of that detail will instead be kept in the new top-level "Policies" section.
26+
27+
{{</ call-out>}}

‎content/waf/install/_index.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
title: "Install"
3+
url: /app-protect-waf/install/
4+
weight: 200
5+
---

‎content/waf/install/disconnect-environment.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
# We use sentence case and present imperative tone
3+
title: "Deploy NGINX App Protect WAF in a disconnected environment"
4+
# Weights are assigned in increments of 100: determines sorting order
5+
weight: 200
6+
# Creates a table of contents and sidebar, useful for large documents
7+
toc: false
8+
# Types have a 1:1 relationship with Hugo archetypes, so you shouldn't need to change this
9+
nd-content-type: how-to
10+
# Intended for internal catalogue and search, case sensitive:
11+
# Agent, N4Azure, NIC, NIM, NGF, NAP-DOS, NAP-WAF, NGINX One, NGINX+, Solutions, Unit
12+
nd-product: NAP-WAF
13+
---
14+
15+
{{< call-out "warning" "Information architecture note" >}}
16+
17+
The term _disconnected environment_ has become the more commmon synonym for an air-gapped or offline installation. It follows the precedent set by NGINX Instance Manager: [Deploy in a disconnected environment -> Install the latest NGINX Instance Manager with a script (disconnected)]({{< ref "/nim/disconnected/offline-install-guide.md" >}}).
18+
19+
The design intention for this page is as a standalone page for the operating system specific installation use cases:
20+
21+
- [v4]({{< ref "/nap-waf/v4/admin-guide/install.md#offline-installation" >}})
22+
- [v5]({{< ref "/nap-waf/v5/admin-guide/install.md#air-gap-install-secure-offline-installation" >}})
23+
24+
Instead of having separate top level folders, differences between v4 and v5 will be denoted with whole page sections, tabs, or other unique signifiers.
25+
26+
This reduces the amount of duplicate content, which makes maintainability much simpler and the text more uniform.
27+
28+
With the full context of this section, the page is shorter, being concerned only with one specific method of installation.
29+
30+
This makes it easier to link to specific instructions, and ensures that the customer sees only the critical information they need.
31+
32+
{{</ call-out>}}

0 commit comments

Comments
 (0)