config.example.yaml

proxy:
  host: "http://192.168.0.1:8888"  # Host for traffic proxy

geoip:
  dbCountryPath: "./GeoLite2-Country.mmdb"  # OPTIONAL Path to GeoIP Country database. Default: ./GeoIP2-Country.mmdb
  dbCityPath: "./GeoLite2-City.mmdb"        # OPTIONAL Path to GeoIP City database. Default: ./GeoIP2-City.mmdb

api:
  auth:
    enabled: true
    username: 'admin'
    password: 'admin'

metrics:
  enabled: true
  auth:
    enabled: false
    username: 'admin'
    password: 'admin'

wafMiddleware:
  #Policy Audit Mode configures waf to allow all traffic while logging all connections
  #that policies would otherwise drop. Default value: audit
  mode: normal # or audit

  bannedResponse:
    httpCode: 429 # OPTIONAL Default: 429
    json: '' # OPTIONAL Default: JSON object with error text
    html: '' # OPTIONAL
    htmlLink: '' # OPTIONAL

  # Under Attack Mode configuration
  underAttack:
    enabled: false # enable under attack mode
    challengeDurationMs: 1800000 # 30 minutes token validity

    conditions: []  # All conditions must be meat. If an array is empty - module work for all requests
    #  - field: 'hostname' # or hostname, user-agent, header-<header-name>, geo-country, geo-city
    #    check: # If any condition is met - check is considered successfully
    #      - method: 'equals'
    #        values: [ "foo-bar.com", "foo-bar.net", "foo-bar.io" ]

    # Fingerprint checks settings
    fingerprintChecks:
      enabled: true
      minScore: 70 # minimum score to pass (0-100)

    # Challenge page settings
    challengePage:
      title: "Security Check"
      # path: "/path/to/custom/challenge.html" # custom page

    # URLs that don't require verification
    skipUrls:
      - "/__under_attack_challenge"
      - "/favicon.ico"
      - "/robots.txt"
      - "/api/webhook/*" # wildcard support

    # Cookie name for token
    cookieName: "waf"

    # Header for bypassing verification (for trusted services)
    bypassHeaders:
      - name: "X-Bypass-UnderAttack"
        value: "secret-key-12345"


  whitelist:
    ips: [ '10.0.0.1', '10.0.0.2' ] # OPTIONAL
    ipSubnet: [ '192.168.0.0/22', '10.0.0.0/22' ] # OPTIONAL
    geoCountry: [ 'USA', 'CA' ] # OPTIONAL
    geoCity: [ 'Lviv' ] # OPTIONAL

  blacklist:
    ips: [ '10.0.0.1', '10.0.0.2' ] # OPTIONAL
    ipSubnet: [ '192.168.0.0/22', '10.0.0.0/22' ] # OPTIONAL
    geoCountry: [ 'USA', 'CA' ] # OPTIONAL
    geoCity: [ 'Lviv' ] # OPTIONAL

  detectClientIp:
    headers: ['fastly-client-ip', 'cf-connecting-ip', 'x-original-forwarded-for']

  detectClientCountry:
    method: header
    header: 'X-client-country'

  detectClientCity:
    method: header
    header: 'X-client-city'

  detectClientRequestId: # OPTIONAL
    header: 'X-RequestId'


jailManager:
  enabled: false # OPTIONAL
  # loadInterval: 10 # OPTIONAL seconds Default: 30
  # flushInterval: 10 # OPTIONAL seconds Default: 30
  # flushAlways: true # OPTIONAL Default false

  storage:
    driver: file # or operator or memory, if not set - default value - memory
    driverConfig: # OPTIONAL for some drivers
      filePath: data/blocked_ips.json
      locker:
        enabled: true
        config:
          retries: 3
  filterRules:
    - name: "static-rule-1"
      type: "static"
      linkUrl: "https://httpbin.org/status/200"
      updateInterval: 120 # (measurement seconds)

    - name: "composite-rule-1"
      type: "composite"
      uniqueClientKey: ["ip", "user-agent", "hostname", "url", "geo-country", "geo-city"]
      conditions: # All conditions must be meat
        - field: 'hostname' # or hostname, user-agent, header-<header-name>, geo-country, geo-city
          check: # If any condition is met - check is considered successfully
            - method: 'equals'
              values: ["foo-bar.com", "foo-bar.net", "foo-bar.io"]

            - method: 'regexp'
              values: ["/bar-baz\.(com|net|io)/i"]

        - field: 'url' # or hostname, user-agent, header-<header-name>, geo-country, geo-city
          check: # If any condition is met - check is considered successfully
            - method: 'equals'
              values: [ "/admin.php", "/phpinfo.php", "/.env" ]

            - method: 'regexp'
              values: [ "/wp-(admin|include|content)/i" ]

      period: 60             # Period in seconds for which the number of requests is considered (measurement seconds)
      limit: 5               # If during the period the number of requests exceeds the limit, ban
      duration: 180          # Blocking by 180 seconds when the limit exceeds (measurement seconds)
      escalationRate: 1.3     # OPTIONAL


    - name: "flexible-rule-1"
      type: "flexible"
      conditions: # All conditions must be meat
        - field: 'hostname' # or hostname, user-agent, header-<header-name>, geo-country, geo-city
          check: # If any condition is met - check is considered successfully
            - method: 'equals'
              values: ["foo-bar.com", "foo-bar.net", "foo-bar.io"]

            - method: 'regexp'
              values: ["/bar-baz\.(com|net|io)/i"]

        - field: 'url' # or hostname, user-agent, header-<header-name>, geo-country, geo-city
          check: # If any condition is met - check is considered successfully
            - method: 'equals'
              values: [ "/admin.php", "/phpinfo.php", "/.env" ]

            - method: 'regexp'
              values: [ "/wp-(admin|include|content)/i" ]

      period: 60            # Period in seconds for which the number of requests is considered (measurement seconds)
      limit: 5              # If during the period the number of requests exceeds the limit, ban
      duration: 180         # Blocking by 180 seconds when the limit exceeds (measurement seconds)
      escalationRate: 1.1   # OPTIONAL


sentry:
  enabled: false
  dsn: ''
  debug: true