Add support for NGINX App Protect DoS module (#111)

Co-authored-by: alessfg <[email protected]>

Author: aknot242

.github/workflows/molecule.yml

@@ -22,6 +22,7 @@ jobs:
           - advanced
           - default
           - specific-version
+          - dos
     steps:
       - name: Check out the codebase
         if: github.event.pull_request.head.repo.full_name == github.repository

CHANGELOG.md

@@ -1,10 +1,11 @@
 # Changelog
 
-## 0.5.1 (Unreleased)
+## 0.6.0 (Unreleased)
 
 FEATURES:
 
-Add a `nginx_app_protect_manage_repo` feature flag which can be used to disable NGINX App Protect repo management by this role.
+*   Add support for NGINX App Protect DoS (Denial of Service) product. The `nginx_app_protect_dos_enable` variable must be set to `true` in order to install NGINX App Protect DoS.
+*   Add a `nginx_app_protect_manage_repo` feature flag which can be used to disable NGINX App Protect repo management by this role.
 
 ENHANCEMENTS:
 

README.md

@@ -4,9 +4,11 @@
 
 # 👾 *Help make the NGINX App Protect Ansible role better by participating in our [survey](https://forms.office.com/Pages/ResponsePage.aspx?id=L_093Ttq0UCb4L-DJ9gcUKLQ7uTJaE1PitM_37KR881UM0NCWkY5UlE5MUYyWU1aTUcxV0NRUllJSC4u)!* 👾
 
-# NGINX App Protect Ansible Role <img src="images/nap-logo.png" width="30">
+# NGINX App Protect WAF and DoS Ansible Role <img src="images/nap-logo.png" width="30">
 
-This role installs and configures NGINX App Protect (WAF) for NGINX Plus on your target host.
+This role installs and configures NGINX App Protect WAF or DoS for NGINX Plus on your target host.
+
+**Note:** By default, this role will install NGINX App Protect WAF. To install NGINX App Protect DoS, you need to set the `nginx_app_protect_dos_enable` variable to `true`.
 
 **Note:** This role is still in active development. There may be unidentified issues and the role variables may change as development continues.
 
@@ -56,22 +58,44 @@ Use `git clone https://github.com/nginxinc/ansible-role-nginx-app-protect.git` t
 
 ## Platforms
 
-The NGINX App Protect Ansible role supports all platforms supported by [NGINX Plus](https://www.nginx.com/products/technical-specs/) that intersect with the following list:
+### NGINX App Protect WAF
+
+The NGINX App Protect Ansible role supports all platforms supported by [NGINX Plus](https://www.nginx.com/products/technical-specs/) that intersect with the following list of distributions of App Protect WAF:
 
 ```yaml
+Alpine:
+  - 3.10
+name: Amazon Linux 2
+  - any
 CentOS:
   - 7.4+
 RHEL:
   - 7.4+
 Debian:
   - 9
+  - 10
 Ubuntu:
   - 18.04
   - 20.04
 ```
 
 **Note:** Due to a packaging limitation in NGINX App Protect on Alpine, it may be required to explicitly install NGINX Plus on the instance **before** using the NGINX App Protect role if a hotfix version of NGINX Plus has been published. It is recommended to use the [NGINX Core](https://galaxy.ansible.com/nginxinc/nginx_core) Ansible role for this purpose.
 
+
+### NGINX App Protect DoS
+
+The NGINX App Protect Ansible role supports all platforms supported by [NGINX Plus](https://www.nginx.com/products/technical-specs/) that intersect with the following list of distributions of App Protect DoS:
+
+```yaml
+CentOS:
+  - 7.4+
+Debian:
+  - 10
+Ubuntu:
+  - 18.04
+  - 20.04
+```
+
 ## Role Variables
 
 This role has multiple variables. The descriptions and defaults for all these variables can be found in the **[`defaults/`](https://github.com/nginxinc/ansible-role-nginx-app-protect/blob/main/defaults/)** folder in the following files:
@@ -100,7 +124,7 @@ A working functional playbook example can be found in the **`molecule/default/`*
 
 ## Other NGINX Ansible Collections and Roles
 
-You can find the Ansible NGINX Core collection of roles to install and configure NGINX Open Source, NGINX Plus, and NGINX App Protect [here](https://github.com/nginxinc/ansible-collection-nginx).
+You can find the Ansible NGINX Core collection of roles to install and configure NGINX Open Source, NGINX Plus, and NGINX App Protect WAF and DoS products [here](https://github.com/nginxinc/ansible-collection-nginx).
 
 You can find the Ansible NGINX role to install NGINX [here](https://github.com/nginxinc/ansible-role-nginx).
 

defaults/main.yml

@@ -1,31 +1,44 @@
 ---
-# Specify whether you want to maintain your version of NGINX App Protect, upgrade to the latest version, or remove NGINX App Protect.
-# Using 'present' will install the latest version of NGINX App Protect on a fresh install.
-# Using 'latest' will upgrade NGINX App Protect to the latest version on every playbook execution.
-# Using 'absent' will remove NGINX App Protect from your system.
+# Specify whether or not this role should install the NGINX App Protect WAF product.
+nginx_app_protect_waf_enable: true
+
+# Specify whether or not this role should install the NGINX App Protect DoS product.
+nginx_app_protect_dos_enable: false
+
+# Specify whether you want to maintain your version of NGINX App Protect WAF, upgrade to the latest version, or remove NGINX App Protect WAF.
+# Using 'present' will install the latest version of NGINX App Protect WAF on a fresh install.
+# Using 'latest' will upgrade NGINX App Protect WAF to the latest version on every playbook execution.
+# Using 'absent' will remove NGINX App Protect WAF from your system.
+# Default is present.
+nginx_app_protect_waf_state: present
+
+# Specify whether you want to maintain your version of NGINX App Protect DoS, upgrade to the latest version, or remove NGINX App Protect DoS.
+# Using 'present' will install the latest version of NGINX App Protect DoS on a fresh install.
+# Using 'latest' will upgrade NGINX App Protect DoS to the latest version on every playbook execution.
+# Using 'absent' will remove NGINX App Protect DoS from your system.
 # Default is present.
-nginx_app_protect_state: present
+nginx_app_protect_dos_state: present
 
-# If you have a RHEL subscription, NGINX App Protect's dependencies will use subscription repos.
+# If you have a RHEL subscription, NGINX App Protect WAF's dependencies will use subscription repos.
 # Otherwise, it will source packages from CentOS' repositories.
 # Default is false.
 nginx_app_protect_use_rhel_subscription_repos: false
 
-# The installation of NGINX App Protect includes a base signature set, which may be out of date.
+# The installation of NGINX App Protect WAF includes a base signature set, which may be out of date.
 # This option installs the latest NGINX App Protect signatures.
 # Default is true.
 nginx_app_protect_install_signatures: true
 
-# (Optional) Installs a specific version of the NGINX App Protect attack signatures package
+# (Optional) Installs a specific version of the NGINX App Protect WAF attack signatures package
 # Default is to install the latest release.
 # nginx_app_protect_signatures_version: "=2019.07.16-1" # <- Example value for Debian/Ubuntu
 
-# The installation of NGINX App Protect can include a page of frequently-updated, high-accuracy signatures called "threat campaigns".
-# This option installs the latest NGINX App Protect threat campaigns signatures.
+# The installation of NGINX App Protect WAF can include a page of frequently-updated, high-accuracy signatures called "threat campaigns".
+# This option installs the latest NGINX App Protect WAF threat campaigns signatures.
 # Default is true.
 nginx_app_protect_install_threat_campaigns: true
 
-# (Optional) Installs a specific version of the NGINX App Protect threat campaigns package
+# (Optional) Installs a specific version of the NGINX App Protect WAF threat campaigns package
 # Default is to install the latest release.
 # nginx_app_protect_threat_campaigns_version: "=2020.08.20-1" # <- Example value for Debian/Ubuntu
 
@@ -76,11 +89,11 @@ nginx_app_protect_start: true
 nginx_app_protect_service_modify: true
 nginx_app_protect_timeout: 180
 
-# Creates basic configuration files and enables NGINX App Protect on the target host
+# Creates basic configuration files and enables NGINX App Protect WAF on the target host
 nginx_app_protect_configure: false
 
 ## DEPRECATED -- Use nginx_app_protect_security_policy_enable and nginx_app_protect_security_policy_file_* variables instead
-# Create a basic NGINX App Protect security policy file based on a template
+# Create a basic NGINX App Protect WAF security policy file based on a template
 nginx_app_protect_security_policy_template_enable: true
 nginx_app_protect_security_policy_template:
   template_file: app-protect-security-policy.j2
@@ -90,7 +103,7 @@ nginx_app_protect_security_policy_template:
 nginx_app_protect_security_policy_enforcement_mode: transparent
 
 ## DEPRECATED -- Use nginx_app_protect_log_policy_file_enable and nginx_app_protect_log_policy_file_* variables instead
-# Create a basic NGINX App Protect log policy file based on a template
+# Create a basic NGINX App Protect WAF log policy file based on a template
 nginx_app_protect_log_policy_template_enable: true
 nginx_app_protect_log_policy_template:
   template_file: app-protect-log-policy.j2
@@ -100,7 +113,7 @@ nginx_app_protect_log_policy_template:
 nginx_app_protect_log_policy_filter_request_type: all
 
 ## DEPRECATED -- Use nginxinc.nginx_config role instead (https://github.com/nginxinc/ansible-role-nginx-config)
-# Create a basic NGINX App Protect config file
+# Create a basic NGINX App Protect WAF config file
 nginx_app_protect_conf_template_enable: false
 nginx_app_protect_conf_template:
   template_file: nginx.conf.j2
@@ -111,12 +124,12 @@ nginx_app_protect_demo_workload_host: 10.1.1.1:8080
 nginx_app_protect_log_policy_syslog_target: 127.0.0.1:514  # DEPRECATED -- use nginx_app_protect_log_policy_target instead
 nginx_app_protect_log_policy_target: "syslog:server={{ nginx_app_protect_log_policy_syslog_target }}"
 
-# Copy local NGINX App Protect security policy to host
+# Copy local NGINX App Protect WAF security policy to host
 nginx_app_protect_security_policy_file_enable: false
 nginx_app_protect_security_policy_file_src: files/config/security-policy.json
 nginx_app_protect_security_policy_file_dest: /etc/app_protect/conf/security-policy.json
 
-# Copy local NGINX App Protect log policy to host
+# Copy local NGINX App Protect WAF log policy to host
 nginx_app_protect_log_policy_file_enable: false
 nginx_app_protect_log_policy_file_src: files/config/log-policy.json
 nginx_app_protect_log_policy_file_dest: /etc/app_protect/conf/log-policy.json

meta/main.yml

@@ -1,7 +1,7 @@
 ---
 galaxy_info:
   author: Daniel Edgar
-  description: Official Ansible role for NGINX App Protect
+  description: Official Ansible role for NGINX App Protect WAF and DoS
   role_name: nginx_app_protect
   namespace: nginxinc
   company: F5 Networks, Inc.
@@ -14,6 +14,9 @@ galaxy_info:
     - name: Alpine
       versions:
         - any
+    - name: Amazon Linux 2
+      versions:
+        - any
     - name: EL
       versions:
         - 7
@@ -34,5 +37,6 @@ galaxy_info:
     - web
     - server
     - development
+    - dos
 
 dependencies: []

molecule/advanced/converge.yml

@@ -2,7 +2,7 @@
 - name: Converge
   hosts: nap
   tasks:
-    - name: Install NGINX App Protect
+    - name: Install NGINX App Protect WAF
       include_role:
         name: ansible-role-nginx-app-protect
       vars:

molecule/advanced/verify.yml

@@ -11,23 +11,23 @@
       failed_when: (install is changed) or (install is failed)
       when: ansible_os_family != "Alpine"
 
-    - name: Check if NGINX App Protect is installed
+    - name: Check if NGINX App Protect WAF is installed
       package:
         name: app-protect
         state: present
       check_mode: true
       register: install
       failed_when: (install is changed) or (install is failed)
 
-    - name: Check if NGINX App Protect signatures is installed
+    - name: Check if NGINX App Protect WAF signatures is installed
       package:
         name: app-protect-attack-signatures
         state: present
       check_mode: true
       register: install
       failed_when: (install is changed) or (install is failed)
 
-    - name: Check if NGINX App Protect threat campaigns is installed
+    - name: Check if NGINX App Protect WAF threat campaigns is installed
       package:
         name: app-protect-threat-campaigns
         state: present

molecule/default/converge.yml

@@ -2,7 +2,7 @@
 - name: Converge
   hosts: all
   tasks:
-    - name: Install NGINX App Protect
+    - name: Install NGINX App Protect WAF
       include_role:
         name: ansible-role-nginx-app-protect
       vars:

molecule/default/verify.yml

@@ -11,23 +11,23 @@
       failed_when: (install is changed) or (install is failed)
       when: ansible_os_family != "Alpine"
 
-    - name: Check if NGINX App Protect is installed
+    - name: Check if NGINX App Protect WAF is installed
       package:
         name: app-protect
         state: present
       check_mode: true
       register: install
       failed_when: (install is changed) or (install is failed)
 
-    - name: Check if NGINX App Protect signatures is installed
+    - name: Check if NGINX App Protect WAF signatures is installed
       package:
         name: app-protect-attack-signatures
         state: present
       check_mode: true
       register: install
       failed_when: (install is changed) or (install is failed)
 
-    - name: Check if NGINX App Protect threat campaigns is installed
+    - name: Check if NGINX App Protect WAF threat campaigns is installed
       package:
         name: app-protect-threat-campaigns
         state: present

molecule/dos/converge.yml

@@ -0,0 +1,14 @@
+---
+- name: Converge
+  hosts: all
+  tasks:
+    - name: Install NGINX App Protect DoS
+      include_role:
+        name: ansible-role-nginx-app-protect
+      vars:
+        nginx_app_protect_waf_enable: false
+        nginx_app_protect_dos_enable: true
+        nginx_app_protect_license:
+          certificate: license/nginx-repo.crt
+          key: license/nginx-repo.key
+        nginx_app_protect_remove_license: false