nonton/spoa-modsecurity repository overview

docker create --name modsec nonton/spoa-modsecurity:v2.9.7-alpine
docker cp modsec:/etc/modsecurity .
docker rm modsec

docker run -d -p 12345:12345 -v $PWD/modsecurity:/etc/modsecurity nonton/spoa-modsecurity:v2.9.7-alpine -n 1

[modsecurity]
  spoe-agent modsecurity-agent
      messages     check-request
      option       var-prefix  modsec
      timeout      hello       100ms
      timeout      idle        30s
      timeout      processing  1s
      use-backend  spoe-modsecurity
  spoe-message check-request
      args   unique-id method path query req.ver req.hdrs_bin req.body_size req.body src src_port dst_port 
      event  on-frontend-http-request

# Frontend section
filter spoe engine modsecurity config /etc/haproxy/spoe-modsecurity.conf
http-request deny if { var(txn.modsec.code) -m int gt 0 }

# Backend section
backend spoe-modsecurity
  mode tcp
  server modsec-spoa1 127.0.0.1:12345