siempie/ansible-openappsec
1
0
Fork 0
Code

first commit

Browse Source
This commit is contained in:
Simon Cornet 2024-02-06 07:48:13 +01:00
commit b8546a759e
1 changed files with 47 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
README.md Normal file
View File

@ -0,0 +1,47 @@
# ! Disclaimer !
This is an example role for how I have setup OpenAppSec on multiple VMs using docker containers.
It has many things stripped out and is very custom for my needs.
Dont copy it and think it will work at all out-of-the-box. It is just here to show how Ansible can be used to deploy the OpenAppSec containers and push the NGINX config per (sub)domain. Dehydrated is used for obtaining valid LetsEncrypt certificates but do require to be kickstarted using already existing certificates.
# Architecture
In my setup we have 2 firewalls (active/passive ha) forwarding incoming tcp connections from a VIP.
Then we have two active/passive ha loadbalancers (based on HAproxy), forwarding only tcp/80 and tcp/443 to any available WAF node based on a simple healthcheck.
The WAFs share a NFS mount for storing certificates. This share is also used for the LetsEncrypt http challenge.
Since the load on the WAFs can increase we can easily add more in the furture.
Now here is some OpenAI generated ASCII art based on my architectural description... :)
Internet
/ \
| |
+-------+ +-------+
| | | |
| fw0 |---.---| fw1 | (Active/Passive HA)
| | VIP | |
+-------+ | +-------+
|
|
+-------+ | +-------+
| | | | |
| lb0 |---.---| lb1 | (Active/Passive HA)
| | VIP | |
+-------+ | +-------+
|
/ \
+--------+ +--------+
| | | |
| waf0 | | waf1 | ... (Active/Active HA)
| | | |
+--------+ +--------+
\ /
+-----+
| nfs |
+-----+
# Requirements
This Ansible playbook assumes the target hosts are prepared with the following:
- Docker container runtime installed
- /mnt/certs share mounted
- Ansible user has passwordless sudo