apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: nginx-ingress
data:
  main-snippets: |
    load_module modules/ngx_http_app_protect_module.so;
  server-snippets: |
    app_protect_enable on;
    app_protect_security_log_enable on;
    app_protect_security_log "/etc/nginx/log-default.json" syslog:server=10.1.1.5:514;
    app_protect_policy_file "/etc/nginx/waf/waf-policy.json";
  waf-policy.json: |
    {
    "name": "nginx-policy",
    "template": { "name": "POLICY_TEMPLATE_NGINX_BASE" },
    "applicationLanguage": "utf-8",
    "enforcementMode": "blocking",
    		"signature-sets": [
    			{
    				"name": "All Signatures",
    				"block": false,
    				"alarm": true
    			},
    			{
    				"name": "High Accuracy Signatures",
    				"block": true,
    				"alarm": true
    			}
    			],
    "blocking-settings": {
        "violations": [
            {
    					"name": "VIOL_RATING_NEED_EXAMINATION",
    					"alarm": true,
    					"block": true
    				},
            {
            "name": "VIOL_HTTP_PROTOCOL",
            "alarm": true,
            "block": true,
            "learn": true
            },
            {
            "name": "VIOL_FILETYPE",
            "alarm": true,
            "block": true,
            "learn": true
            },
            {
            "name": "VIOL_COOKIE_MALFORMED",
            "alarm": true,
            "block": false,
            "learn": false
            }
        ],
        "http-protocols": [{
            "description": "Body in GET or HEAD requests",
            "enabled": true,
            "learn": true,
            "maxHeaders": 20,
            "maxParams": 500
        }],
    		"filetypes": [
    			{
    				"name": "*",
    				"type": "wildcard",
    				"allowed": true,
    				"responseCheck": true
    			}
        ],
    		"data-guard": {
    			"enabled": true,
    			"maskData": true,
    			"creditCardNumbers": true,
    			"usSocialSecurityNumbers": true
    		},
    		"cookies": [
    			{
    				"name": "*",
    				"type": "wildcard",
    				"accessibleOnlyThroughTheHttpProtocol": true,
    				"attackSignaturesCheck": true,
    				"insertSameSiteAttribute": "strict"
    			}
    		],
        "evasions": [{
            "description": "%u decoding",
            "enabled": true,
            "learn": false,
            "maxDecodingPasses": 2
        }]}
    }
