# Dockerfile - Nginx + ModSecurity WAF

FROM ubuntu:22.04 AS builder

ENV DEBIAN_FRONTEND=noninteractive

# 安装编译依赖
RUN apt-get update && apt-get install -y \
    build-essential \
    ca-certificates \
    git \
    libcurl4-openssl-dev \
    libgeoip-dev \
    liblmdb-dev \
    libpcre2-dev \
    libssl-dev \
    libtool \
    libxml2-dev \
    libyajl-dev \
    pkgconf \
    wget \
    zlib1g-dev \
    && rm -rf /var/lib/apt/lists/*

# 编译 ModSecurity v3
RUN git clone --depth 1 -b v3/master --recurse-submodules \
    https://github.com/owasp-modsecurity/ModSecurity.git /opt/ModSecurity && \
    cd /opt/ModSecurity && \
    git submodule init && git submodule update && \
    ./build.sh && \
    ./configure --with-pcre2 && \
    make -j$(nproc) && make install

# 编译 ModSecurity-nginx 连接器
RUN git clone --depth 1 \
    https://github.com/owasp-modsecurity/ModSecurity-nginx.git /opt/ModSecurity-nginx

# 编译 Nginx
ENV NGINX_VERSION=1.26.2
RUN wget https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz && \
    tar xzf nginx-${NGINX_VERSION}.tar.gz && \
    cd nginx-${NGINX_VERSION} && \
    ./configure \
        --prefix=/etc/nginx \
        --sbin-path=/usr/sbin/nginx \
        --modules-path=/usr/lib64/nginx/modules \
        --conf-path=/etc/nginx/nginx.conf \
        --error-log-path=/var/log/nginx/error.log \
        --http-log-path=/var/log/nginx/access.log \
        --with-http_ssl_module \
        --with-http_v2_module \
        --with-http_realip_module \
        --with-http_gzip_static_module \
        --with-stream \
        --add-dynamic-module=/opt/ModSecurity-nginx && \
    make -j$(nproc) && make install

# ===== 最终镜像 =====
FROM ubuntu:22.04

RUN apt-get update && apt-get install -y \
    ca-certificates \
    libcurl4 \
    libgeoip1 \
    liblmdb0 \
    libxml2 \
    libyajl2 \
    && rm -rf /var/lib/apt/lists/*

# 复制编译产物
COPY --from=builder /usr/sbin/nginx /usr/sbin/nginx
COPY --from=builder /etc/nginx /etc/nginx
COPY --from=builder /usr/lib64/nginx/modules /usr/lib64/nginx/modules
COPY --from=builder /usr/local/modsecurity /usr/local/modsecurity

# 复制配置文件
COPY nginx.conf /etc/nginx/nginx.conf
COPY modsecurity.conf /etc/nginx/modsecurity/modsecurity.conf
COPY crs/ /etc/nginx/modsecurity/crs/

# 创建必要目录
RUN mkdir -p /var/log/nginx /var/log/modsecurity /tmp/modsecurity

EXPOSE 80 443

STOPSIGNAL SIGQUIT

CMD ["nginx", "-g", "daemon off;"]

# docker-compose.yml

version: '3.8'

services:
  waf:
    build:
      context: ./waf
      dockerfile: Dockerfile
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./waf/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./waf/modsecurity.conf:/etc/nginx/modsecurity/modsecurity.conf:ro
      - ./waf/crs:/etc/nginx/modsecurity/crs:ro
      - ./waf/certs:/etc/ssl/certs:ro
      - ./waf/keys:/etc/ssl/private:ro
      - waf_logs:/var/log/nginx
      - modsec_logs:/var/log/modsecurity
    networks:
      - frontend
      - backend
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 10s
      timeout: 5s
      retries: 3

  app1:
    image: myapp:latest
    environment:
      - NODE_ENV=production
    networks:
      - backend
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G

  app2:
    image: myapp:latest
    environment:
      - NODE_ENV=production
    networks:
      - backend
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    networks:
      - backend
    restart: unless-stopped
    volumes:
      - redis_data:/data
    command: redis-server --requirepass ${REDIS_PASSWORD}

  # 日志收集
  filebeat:
    image: docker.elastic.co/beats/filebeat:8.12.0
    user: root
    volumes:
      - ./filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - waf_logs:/var/log/nginx:ro
      - modsec_logs:/var/log/modsecurity:ro
    networks:
      - frontend
    restart: unless-stopped

volumes:
  waf_logs:
  modsec_logs:
  redis_data:

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge
    internal: true  # 内部网络，不对外暴露

# docker-compose.yml - Traefik + CrowdSec

version: '3.8'

services:
  traefik:
    image: traefik:v3.0
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=admin@example.com"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--experimental.plugins.crowdsec.modulename=github.com/maxlerebourg/crowdsec-traefik-plugin"
      - "--experimental.plugins.crowdsec.version=v1.3.5"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt
    networks:
      - proxy
    restart: unless-stopped

  crowdsec:
    image: crowdsecurity/crowdsec:latest
    environment:
      - COLLECTIONS=crowdsecurity/traefik crowdsecurity/base-http-scenarios
      - GID=1000
    volumes:
      - crowdsec_config:/etc/crowdsec
      - crowdsec_data:/var/lib/crowdsec/data
      - /var/log/traefik:/var/log/traefik:ro
    networks:
      - proxy
    restart: unless-stopped

  app:
    image: myapp:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`example.com`)"
      - "traefik.http.routers.app.entrypoints=websecure"
      - "traefik.http.routers.app.tls.certresolver=letsencrypt"
      - "traefik.http.routers.app.middlewares=crowdsec@docker"
      - "traefik.http.middlewares.crowdsec.plugin.crowdsec.crowdseclapikey=YOUR_API_KEY"
    networks:
      - proxy
    restart: unless-stopped

volumes:
  letsencrypt:
  crowdsec_config:
  crowdsec_data:

networks:
  proxy:
    driver: bridge

# 安全 Dockerfile 最佳实践

FROM ubuntu:22.04 AS builder
# ... 编译阶段 ...

FROM nginx:1.26-alpine AS production

# 1. 安全更新
RUN apk update && apk upgrade --no-cache

# 2. 创建非 root 用户
RUN addgroup -g 1001 -S waf && \
    adduser -u 1001 -S waf -G waf

# 3. 设置文件权限
COPY --chown=waf:waf nginx.conf /etc/nginx/nginx.conf
COPY --chown=waf:waf modsecurity.conf /etc/nginx/modsecurity/
COPY --chown=waf:waf crs/ /etc/nginx/modsecurity/crs/

# 4. 创建必要目录并设置权限
RUN mkdir -p /var/cache/nginx /var/log/nginx /tmp/modsecurity && \
    chown -R waf:waf /var/cache/nginx /var/log/nginx /tmp/modsecurity && \
    chmod -R 755 /var/cache/nginx /var/log/nginx

# 5. 删除默认配置
RUN rm -f /etc/nginx/conf.d/default.conf

# 6. 使用非 root 用户
USER waf

EXPOSE 80 443

# 7. 健康检查
HEALTHCHECK --interval=10s --timeout=5s --retries=3 \
    CMD wget -qO- http://localhost/health || exit 1

CMD ["nginx", "-g", "daemon off;"]

# 使用 Trivy 扫描镜像漏洞
docker build -t waf:latest ./waf/
trivy image waf:latest --severity HIGH,CRITICAL

# 扫描结果示例
# waf:latest (ubuntu 22.04)
# ========================
# Total: 3 (HIGH: 2, CRITICAL: 1)
#
# ┌──────────────┬───────────────┬──────────┬───────────────────────┐
# │   Library    │ Vulnerability │ Severity │    Installed Version  │
# ├──────────────┼───────────────┼──────────┼───────────────────────┤
# │ libssl3      │ CVE-2024-XXX  │ CRITICAL │ 3.0.2-0ubuntu1.15     │
# │ libcurl4     │ CVE-2024-XXX  │ HIGH     │ 7.81.0-1ubuntu1.16    │
# └──────────────┴───────────────┴──────────┴───────────────────────┘

# k8s/waf-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: waf
  namespace: security
spec:
  replicas: 3
  selector:
    matchLabels:
      app: waf
  template:
    metadata:
      labels:
        app: waf
    spec:
      # 安全上下文
      securityContext:
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001

      containers:
        - name: waf
          image: waf:1.0.0
          ports:
            - containerPort: 443
            - containerPort: 80

          # 资源限制
          resources:
            requests:
              cpu: 500m
              memory: 512Mi
            limits:
              cpu: 2000m
              memory: 2Gi

          # 安全上下文
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL

          # 存储卷
          volumeMounts:
            - name: waf-config
              mountPath: /etc/nginx/modsecurity
              readOnly: true
            - name: tls-certs
              mountPath: /etc/ssl/certs/waf
              readOnly: true
            - name: tmp
              mountPath: /tmp/modsecurity
            - name: nginx-cache
              mountPath: /var/cache/nginx

          # 健康检查
          livenessProbe:
            httpGet:
              path: /health
              port: 80
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /health
              port: 80
            initialDelaySeconds: 5
            periodSeconds: 5

      volumes:
        - name: waf-config
          configMap:
            name: waf-config
        - name: tls-certs
          secret:
            secretName: waf-tls
        - name: tmp
          emptyDir: {}
        - name: nginx-cache
          emptyDir:
            sizeLimit: 1Gi

---
apiVersion: v1
kind: Service
metadata:
  name: waf-service
  namespace: security
spec:
  selector:
    app: waf
  ports:
    - name: https
      port: 443
      targetPort: 443
    - name: http
      port: 80
      targetPort: 80
  type: ClusterIP