mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 13:59:40 +00:00
aba60ae356
Phase 1 — 5 high-impact core packages migrated to the canonical /data storage convention (charter §Storage). Each package's debian/postinst gains an idempotent migration block that moves legacy /srv/<dir> → /data/<dir> on upgrade and leaves a symlink behind for back-compat. * secubox-mitmproxy v1.0.2: migrates /srv/mitmproxy*, /srv/mitmproxy-waf, /srv/mitmproxy-in. 8 files in source updated. * secubox-waf v1.1.1: same dirs (shared with mitmproxy). 5 files updated. * secubox-mail v2.3.1: migrates /srv/mail. 2 files updated. * secubox-mail-lxc v2.2.1: migrates /srv/mail. 1 file updated. * secubox-gitea v1.4.2: migrates /srv/gitea. 4 files updated. Total: 20 files, 58 substitutions in source. Postinst auto-migration is service-aware (stop → mv → ln -s → start). Boards previously on /srv/<pkg> are seamlessly moved; new installs land directly on /data. Phase 2 (~12 packages) and Phase 3 (3 cosmetic) tracked in #319. Co-authored-by: CyberMind-FR <gandalf@Gk2.net>
64 lines
992 B
TOML
64 lines
992 B
TOML
# SecuBox Mitmproxy WAF Configuration
|
|
|
|
[container]
|
|
name = "mitmproxy-waf"
|
|
memory_limit = "256M"
|
|
autostart = true
|
|
|
|
[proxy]
|
|
listen_port = 8890
|
|
web_port = 8091
|
|
web_host = "127.0.0.1"
|
|
data_path = "/srv/mitmproxy-waf"
|
|
|
|
[haproxy]
|
|
enabled = false
|
|
config_path = "/etc/haproxy/haproxy.cfg"
|
|
backend_name = "mitmproxy_waf"
|
|
|
|
[crowdsec]
|
|
enabled = true
|
|
threats_log = "/data/mitmproxy-waf/data/threats.log"
|
|
|
|
[autoban]
|
|
enabled = true
|
|
sensitivity = "moderate"
|
|
ban_duration = "4h"
|
|
min_severity = "high"
|
|
|
|
[autoban.categories]
|
|
sqli = true
|
|
xss = true
|
|
cmdi = true
|
|
traversal = true
|
|
ssrf = true
|
|
log4shell = true
|
|
cve_exploits = true
|
|
scanners = false
|
|
path_scan = false
|
|
|
|
[autoban.thresholds]
|
|
moderate_count = 3
|
|
moderate_window = 300
|
|
permissive_count = 5
|
|
permissive_window = 3600
|
|
|
|
[whitelist]
|
|
ips = ["127.0.0.1"]
|
|
|
|
[waf_rules]
|
|
sqli = true
|
|
xss = true
|
|
cmdi = true
|
|
traversal = true
|
|
ssrf = true
|
|
xxe = true
|
|
ldap = true
|
|
log4shell = true
|
|
scanners = true
|
|
path_scan = true
|
|
cve_exploits = true
|
|
rce = true
|
|
voip = false
|
|
xmpp = false
|