Sign inSign up

berryrreb/nginxmodsec

By berryrreb

•Updated about 7 years ago

An NGINX-ModSecurity image Centos7 based.

Image
0

10K+

berryrreb/nginxmodsec repository overview

⁠How to use this image:

⁠(All this instructions must be run on the host machine, not in the container)

⁠Create base directories

mkdir -p /var/containers/shared/var/www/sites \
              /var/containers/nginx/{var/log/nginx,etc/nginx/vhosts,etc/nginx/conf.d,var/cache/nginx,var/backups,etc/nginx/keys}

Create soft link

ln -s /var/containers/nginx/var/log/nginx/ /var/log/

Setup logrotate script

mkdir -p /etc/logrotate.d/c
echo 'L3Zhci9sb2cvbmdpbngvKi5sb2cgewogICAgICAgIGRhaWx5CiAgICAgICAgbWlzc2luZ29rCiAgICAgICAgcm90YXRlIDYwCiAgICAgICAgY29tcHJlc3MKICAgICAgICBkZWxheWNvbXByZXNzCiAgICAgICAgbm90aWZlbXB0eQogICAgICAgIGNyZWF0ZSA2NDQKICAgICAgICBzaGFyZWRzY3JpcHRzCiAgICAgICAgcG9zdHJvdGF0ZQogICAgICAgICAgICBuZ2lueCAtcyByZWxvYWQKICAgICAgICBlbmRzY3JpcHQKfQovdmFyL2xvZy9uZ2lueC8qLyoubG9nIHsKICAgICAgICBkYWlseQogICAgICAgIG1pc3NpbmdvawogICAgICAgIHJvdGF0ZSA2MAogICAgICAgIGNvbXByZXNzCiAgICAgICAgZGVsYXljb21wcmVzcwogICAgICAgIG5vdGlmZW1wdHkKICAgICAgICBjcmVhdGUgNjQ0CiAgICAgICAgc2hhcmVkc2NyaXB0cwogICAgICAgIHBvc3Ryb3RhdGUKICAgICAgICAgICAgbmdpbnggLXMgcmVsb2FkCiAgICAgICAgZW5kc2NyaXB0Cn0KCg==' | base64 -w0 -d > /etc/logrotate.d/nginx

Pulling the image

docker pull berryrreb/nginxmodsec

Starting the container

docker run -td --name=nginx --privileged=false -p 80:80 -p 443:443 \
                    --volume=/var/containers/shared/var/www/sites:/var/www/sites:z \
                    --volume=/var/containers/nginx/var/log/nginx:/var/log/nginx:z \
                    --volume=/var/containers/nginx/etc/nginx/vhosts:/etc/nginx/vhosts:z \
                    --volume=/var/containers/nginx/etc/nginx/keys:/etc/nginx/keys:z \
                    --volume=/var/containers/nginx/etc/nginx/conf.d:/etc/nginx/conf.d:z \
                    --volume=/var/containers/nginx/var/cache/nginx:/var/cache/nginx:z  \
                    --volume=/var/containers/nginx/var/backups:/var/backups:z \
                    --volume=/etc/localtime:/etc/localtime:ro \
                    --hostname=nginx.service \
                    docker.io/berryrreb/nginxmodsec

⁠Setting up your nginx

This image has a basic configuration for nginx, it has some basic modules compiled, if you want to know all this modules run the following command:

docker exec -it nginx bash -c 'nginx -V'

All the virtual hosts (server) configuration files must be in the /var/containers/nginx/etc/nginx/vhosts directory. After adding some virtual host config file, you must reload the nginx configuration:

docker exec -it nginx bash -c 'nginx -s reload'

To activate ModSecurity in your Vhost just add the following directives in your server section:

ModSecurityEnabled on;
ModSecurityConfig /etc/nginx/modsec/main.conf;

⁠Virtual Host configuration file

Template using Nginx as a reverse proxy to expose some service with http:

NOTE: Eliminate the ModSecurity lines if you don't want ModSecurity enable in the vhost

server{
    listen 80;
    server_name test.example.com;
    location / {

        ModSecurityEnabled on;
        ModSecurityConfig /etc/nginx/modsec/main.conf;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://0.0.0.0:9000$request_uri;
        proxy_redirect off;
    }
}

Vhost for a simple index.html page

server {
    listen 80;
    server_name test.example.com;
    root /etc/nginx/vhosts/;

    location = / {
        index index.html;
    }
}

Tag summary

Content type

Image

Digest

Size

452.6 MB

Last updated

about 7 years ago

docker pull berryrreb/nginxmodsec