Security gap: no WAF at the public ingress edge

[gangster]

Surfaced by the Security Model spine doc's gap register (docs/learn/spine/the-security-model.md).

Gap (4C: Cloud/Code — OWASP edge defense). Public ingress (Gateway API + Cilium Envoy) is TLS-terminated and hostname-scoped, but nothing inspects requests for OWASP-class attack patterns (injection, XSS, path traversal, bad bots). App-layer runtime defense is the thinnest part of the model today (we have SAST in CI, but no runtime shield).

Do: evaluate AWS WAF on the ingress NLB/ALB vs. an Envoy/Cilium-level WAF (e.g. Coraza/OWASP CRS); add managed rule sets + rate limiting; decide platform-managed vs. per-Product opt-in.

[gangster]

Architecture decided — ADR-096: WAF — edge-first via Cloudflare (PR #1191). Implementation deferred (cost-gated), issue stays open.

Decision (edge-first, layered): match the layer to the threat. DDoS/volumetric + coarse OWASP rules belong at the true off-cluster edge; fine-grained app-aware rules can live in-cluster.

• Cloudflare proxies the public preprod/prod hostnames as the primary shield, in front of the existing NLB — additive, no edge re-architecture. We already own the refplat.org zone.
• NLB origin-locked to Cloudflare IPs (else bypassable); TLS Full(Strict); DNS split for public hostnames (revisits ADR-022 for those names).
• In-cluster Coraza/OWASP-CRS retained as an optional, deferred L2 — never the primary (can't do DDoS; critical-data-path risk).
• Rejected: AWS WAFv2 (can't attach to an NLB → forces a CloudFront/ALB rebuild).

Why deferred: the full OWASP Core Ruleset is Cloudflare Pro (~$20/mo) = paid → deferred per ADR-092 (same rule as GuardDuty #1178). Dev phase: no real users / prod traffic / attack surface. A $0 free-tier floor (unmetered DDoS + basic managed WAF) can flip on once the public edge serves real traffic.

Trigger to implement: prod traffic / real external users / PCI-tier workload (ADR-013) / an actual attack / a security budget.

Scope: preprod public edge (platform gateway is internal/Tailscale — no public WAF need).