Skip to content

Commit e843a27

Browse files
ADubhlaoichADubhlaoich
committed
feat: Finish Plus Docker instructions
1 parent 84a6141 commit e843a27

File tree

9 files changed

+262
-220
lines changed

9 files changed

+262
-220
lines changed

‎content/includes/waf/default-conf-localhost.md‎

Lines changed: 0 additions & 39 deletions
This file was deleted.

‎content/includes/waf/install-services-compose.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
nd-docs:
3+
---
4+
5+
Create a _docker-compose.yml_ file with the following contents in your host environment, replacing image tags as appropriate:
6+
7+
```yaml
8+
services:
9+
waf-enforcer:
10+
container_name: waf-enforcer
11+
image: waf-enforcer:5.2.0
12+
environment:
13+
- ENFORCER_PORT=50000
14+
ports:
15+
- "50000:50000"
16+
volumes:
17+
- /opt/app_protect/bd_config:/opt/app_protect/bd_config
18+
networks:
19+
- waf_network
20+
restart: always
21+
22+
waf-config-mgr:
23+
container_name: waf-config-mgr
24+
image: waf-config-mgr:5.2.0
25+
volumes:
26+
- /opt/app_protect/bd_config:/opt/app_protect/bd_config
27+
- /opt/app_protect/config:/opt/app_protect/config
28+
- /etc/app_protect/conf:/etc/app_protect/conf
29+
restart: always
30+
network_mode: none
31+
depends_on:
32+
waf-enforcer:
33+
condition: service_started
34+
35+
networks:
36+
waf_network:
37+
driver: bridge
38+
```
39+
40+
{{< call-out "caution" >}}
41+
42+
In some operating systems, security mechanisms like SELinux or AppArmor are enabled by default, potentially blocking necessary file access for the nginx process and waf-config-mgr and waf-enforcer containers.
43+
44+
To ensure NGINX App Protect WAF operates smoothly without compromising security, consider setting up a custom SELinux policy or AppArmor profile.
45+
46+
For short-term troubleshooting, you may use permissive (SELinux) or complain (AppArmor) mode to avoid these restrictions, but this is inadvisable for prolonged use.
47+
48+
{{< /call-out >}}
49+
50+
To start the F5 WAF for NGINX services, use `docker compose up` in the same folder as the _docker-compose.yml_ file:
51+
52+
```shell
53+
sudo docker compose up -d
54+
```

‎content/includes/waf/install-services-docker.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
nd-docs:
3+
---
4+
5+
{{< call-out "warning" >}}
6+
7+
This section **only** applies to V5 packages.
8+
9+
Skip to [Post-installation checks](#post-installation-checks) if you're using a V4 package.
10+
11+
{{< /call-out>}}
12+
13+
F5 WAF for NGINX uses Docker containers for its services when installed with a V5 package, which requires some extra set-up steps.
14+
15+
First, create new directories for the services:
16+
17+
```shell
18+
sudo mkdir -p /opt/app_protect/config /opt/app_protect/bd_config
19+
```
20+
21+
Then assign new owners, with `101:101` as the default UID/GID
22+
23+
```shell
24+
sudo chown -R 101:101 /opt/app_protect/
25+
```

‎content/includes/waf/install-services-images.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
nd-docs:
3+
---
4+
5+
Download the `waf-enforcer` and `waf-config-mgr` images.
6+
7+
Replace `5.2.0` with the release version you are deploying.
8+
9+
```shell
10+
docker pull private-registry.nginx.com/nap/waf-enforcer:5.2.0
11+
docker pull private-registry.nginx.com/nap/waf-config-mgr:5.2.0
12+
```

‎content/includes/waf/install-services-registry.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
nd-docs:
3+
---
4+
5+
Create a directory and copy your certificate and key to this directory:
6+
7+
```shell
8+
mkdir -p /etc/docker/certs.d/private-registry.nginx.com
9+
cp <path-to-your-nginx-repo.crt> /etc/docker/certs.d/private-registry.nginx.com/client.cert
10+
cp <path-to-your-nginx-repo.key> /etc/docker/certs.d/private-registry.nginx.com/client.key
11+
```

‎content/includes/waf/install-update-configuration.md‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
nd-docs:
3+
---
4+
5+
Once you have installed F5 WAF for NGINX, you must load it as a module in the main context of your NGINX configuration.
6+
7+
```nginx
8+
load_module modules/ngx_http_app_protect_module.so;
9+
```
10+
11+
The Enforcer address must be added at the _http_ context:
12+
13+
```nginx
14+
app_protect_enforcer_address 127.0.0.1:50000;
15+
```
16+
17+
And finally, F5 WAF for NGINX can enabled on a _http_, _server_ or _location_ context:
18+
19+
```nginx
20+
app_protect_enable on;
21+
```
22+
23+
{{< call-out "warning" >}}
24+
25+
You should only enable F5 WAF for NGINX on _proxy_pass_ and _grpc_pass_ locations.
26+
27+
{{< /call-out >}}
28+
29+
Here are two examples of how these additions could look in configuration files:
30+
31+
{{<tabs name="example-configuration-files">}}
32+
33+
{{% tab name="nginx.conf" %}}
34+
35+
`/etc/nginx/nginx.conf`
36+
37+
```nginx
38+
user nginx;
39+
worker_processes auto;
40+
41+
# NGINX App Protect WAF
42+
load_module modules/ngx_http_app_protect_module.so;
43+
44+
error_log /var/log/nginx/error.log notice;
45+
pid /var/run/nginx.pid;
46+
47+
events {
48+
worker_connections 1024;
49+
}
50+
51+
http {
52+
include /etc/nginx/mime.types;
53+
default_type application/octet-stream;
54+
55+
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
56+
'$status $body_bytes_sent "$http_referer" '
57+
'"$http_user_agent" "$http_x_forwarded_for"';
58+
59+
access_log /var/log/nginx/access.log main;
60+
61+
sendfile on;
62+
#tcp_nopush on;
63+
64+
keepalive_timeout 65;
65+
66+
#gzip on;
67+
68+
# NGINX App Protect WAF
69+
app_protect_enforcer_address 127.0.0.1:50000;
70+
71+
include /etc/nginx/conf.d/*.conf;
72+
}
73+
```
74+
75+
76+
{{% /tab %}}
77+
78+
{{% tab name="default.conf" %}}
79+
80+
`/etc/nginx/conf.d/default.conf`
81+
82+
```nginx
83+
server {
84+
listen 80;
85+
server_name domain.com;
86+
87+
proxy_http_version 1.1;
88+
89+
location / {
90+
91+
# NGINX App Protect WAF
92+
app_protect_enable on;
93+
94+
client_max_body_size 0;
95+
default_type text/html;
96+
proxy_pass http://127.0.0.1:8080/;
97+
}
98+
}
99+
100+
server {
101+
listen 8080;
102+
server_name localhost;
103+
104+
location / {
105+
root /usr/share/nginx/html;
106+
index index.html index.htm;
107+
}
108+
109+
# redirect server error pages to the static page /50x.html
110+
#
111+
error_page 500 502 503 504 /50x.html;
112+
location = /50x.html {
113+
root /usr/share/nginx/html;
114+
}
115+
}
116+
```
117+
118+
{{% /tab %}}
119+
120+
{{< /tabs >}}
121+
122+
Once you have updated your configuration files, you can reload NGINX to apply the changes. You have two options depending on your environment:
123+
124+
- `nginx -s reload`
125+
- `sudo systemctl reload nginx`
126+
127+
If you are using a V4 package, you have finished installing F5 WAF for NGINX and can look at [Post-installation checks](#post-installation-checks).

‎content/includes/waf/nginx-conf-localhost.md‎

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎content/waf/install/plus/docker.md‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,14 @@ nd-product: NAP-WAF
1414

1515
{{< call-out "warning" "Information architecture note" >}}
1616

17-
- [v4]({{< ref "/nap-waf/v4/admin-guide/install.md#docker-deployments" >}})
18-
- [v5]({{< ref "/nap-waf/v5/admin-guide/deploy-on-docker.md" >}})
17+
Content sources: [v4]({{< ref "/nap-waf/v4/admin-guide/install.md#docker-deployments" >}}) & [v5]({{< ref "/nap-waf/v5/admin-guide/deploy-on-docker.md" >}})
18+
19+
There's some v5 specific content around mTLS that should be spun into its own page:
20+
21+
- [Docker Compose File with mTLS]({{< ref "/nap-waf/v5/admin-guide/deploy-on-docker.md#docker-compose-file-with-mtls" >}})
22+
- [Secure Traffic Between NGINX and App Protect Enforcer using mTLS]({{< ref "/nap-waf/v5/configuration-guide/configuration.md#secure-traffic-between-nginx-and-app-protect-enforcer-using-mtls" >}})
23+
24+
I haven't found reference to it in v5 content, but I don't see why it couldn't/wouldn't apply to v4 too?
1925

2026
{{</ call-out>}}
2127

@@ -972,6 +978,26 @@ Verify the new container is running using the `docker ps` command:
972978
docker ps
973979
```
974980

981+
## Update configuration files
982+
983+
{{< include "waf/install-update-configuration.md" >}}
984+
985+
## Configure Docker services
986+
987+
{{< include "waf/install-services-docker.md" >}}
988+
989+
### Configure Docker for the F5 Container Registry
990+
991+
{{< include "waf/install-services-registry.md" >}}
992+
993+
### Download Docker images
994+
995+
{{< include "waf/install-services-images.md" >}}
996+
997+
### Create and run a Docker Compose file
998+
999+
{{< include "waf/install-services-compose.md" >}}
1000+
9751001
## Post-installation checks
9761002

9771003
{{< include "waf/install-post-checks.md" >}}

0 commit comments

Comments
 (0)