From b8546a759ed6b9065c06411c97909b5b7a8675f1 Mon Sep 17 00:00:00 2001 From: Simon Cornet Date: Tue, 6 Feb 2024 07:48:13 +0100 Subject: [PATCH] first commit --- README.md | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..0f2463f --- /dev/null +++ b/README.md @@ -0,0 +1,47 @@ +# ! Disclaimer ! +This is an example role for how I have setup OpenAppSec on multiple VMs using docker containers. +It has many things stripped out and is very custom for my needs. + +Dont copy it and think it will work at all out-of-the-box. It is just here to show how Ansible can be used to deploy the OpenAppSec containers and push the NGINX config per (sub)domain. Dehydrated is used for obtaining valid LetsEncrypt certificates but do require to be kickstarted using already existing certificates. + +# Architecture +In my setup we have 2 firewalls (active/passive ha) forwarding incoming tcp connections from a VIP. +Then we have two active/passive ha loadbalancers (based on HAproxy), forwarding only tcp/80 and tcp/443 to any available WAF node based on a simple healthcheck. + +The WAFs share a NFS mount for storing certificates. This share is also used for the LetsEncrypt http challenge. + +Since the load on the WAFs can increase we can easily add more in the furture. +Now here is some OpenAI generated ASCII art based on my architectural description... :) + + Internet + / \ + | | + +-------+ +-------+ + | | | | + | fw0 |---.---| fw1 | (Active/Passive HA) + | | VIP | | + +-------+ | +-------+ + | + | + +-------+ | +-------+ + | | | | | + | lb0 |---.---| lb1 | (Active/Passive HA) + | | VIP | | + +-------+ | +-------+ + | + / \ + +--------+ +--------+ + | | | | + | waf0 | | waf1 | ... (Active/Active HA) + | | | | + +--------+ +--------+ + \ / + +-----+ + | nfs | + +-----+ + +# Requirements +This Ansible playbook assumes the target hosts are prepared with the following: + - Docker container runtime installed + - /mnt/certs share mounted + - Ansible user has passwordless sudo