Skip to content

Commit 12d95f1

Browse files
rnitzanADubhlaoichpkozakpl
authored
feat: F5 DoS for NGINX release 4.8 (#1489)
* rnitzan dos 4.8 (#1474) * Add release notes for F5 DoS for NGINX v4.8 This document outlines the release information for F5 DoS for NGINX version 4.8, including new features and supported packages. * Update Alpine version to 3.22 in deployment guide Updated Alpine version references from 3.19 to 3.22 in the deployment guide and Dockerfile examples. * Change section headings in deployment guide Updated headings in the deployment guide for clarity. * Update AMI links for NGINX Plus installation guide * Update installation guide for NGINX Plus and WAF * Update links for NGINX Plus AMIs in deployment guide * Fix command execution for adminstall and bd_agent * Fix command syntax for bd_agent execution --------- Co-authored-by: Alan Dooley <a.dooley@f5.com> * Create best-practices document * Update best-practices.md * Revise best practices for F5 DoS configuration Updated section headings and added details for F5 DoS configuration in NGINX. * Update deployment guide and remove deprecated instructions Removed deprecated installation instructions for CentOS 7.4 and Ubuntu 20.04. Updated installation commands for App Protect DoS package versions. * Remove redundant 'F5' from description * Fix duplicate 'F5' in description and request log * Fix description in access-log.md * Fix duplicate 'F5' in description and overview * Fix description for F5 DoS operation log * Fix description for F5 DoS in security-log.md * Fix typo in troubleshooting guide description * Update SELinux link in deployment guide * Update troubleshooting guide for NGINX errors * Refactor deployment guide section headers Updated section headers for deployment instructions to improve clarity and organization. * feature: dos 4.8.3 * dos k8s * dos k8s * dos k8s * dos 4.8.3 R36 * dos 4.8.3 R36 * dos 4.8.3 R36 * dos 4.8.3 R36 * Dos k8s nitzan (#1491) * Create alpine-plus.md for Dockerfile configuration Add Dockerfile for Alpine Plus with NGINX support * add k8s to dos * add k8s * add k8s --------- Co-authored-by: Alan Dooley <a.dooley@f5.com> * remove new kubernetes page, not final yet --------- Co-authored-by: Alan Dooley <a.dooley@f5.com> Co-authored-by: pkozakpl <86775065+pkozakpl@users.noreply.github.com>
1 parent a33c7bc commit 12d95f1

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+691
-459
lines changed

‎content/includes/dos/dockerfiles/alpine-plus-dos-waf.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
---
3+
4+
```dockerfile
5+
# syntax=docker/dockerfile:1
6+
7+
# Supported OS_VER's are 3.21/3.22
8+
ARG OS_VER="3.22"
9+
10+
# Base image
11+
FROM alpine:${OS_VER}
12+
13+
# Install NGINX Plus and F5 DOS for NGINX
14+
15+
16+
```

‎content/includes/dos/dockerfiles/alpine-plus-dos.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
---
3+
4+
```dockerfile
5+
# syntax=docker/dockerfile:1
6+
7+
# Supported OS_VER's are 3.21/3.22
8+
ARG OS_VER="3.22"
9+
10+
# Base image
11+
FROM alpine:${OS_VER}
12+
13+
# Install F5 DoS for NGINX
14+
RUN --mount=type=secret,id=nginx-crt,dst=/etc/apk/cert.pem,mode=0644 \
15+
--mount=type=secret,id=nginx-key,dst=/etc/apk/cert.key,mode=0644 \
16+
--mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \
17+
wget -O /etc/apk/keys/nginx_signing.rsa.pub https://cs.nginx.com/static/keys/nginx_signing.rsa.pub \
18+
&& printf "https://pkgs.nginx.com/plus/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories \
19+
&& printf "https://pkgs.nginx.com/app-protect-dos/alpine/v`egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release`/main\n" | tee -a /etc/apk/repositories \
20+
&& apk update \
21+
&& apk add app-protect-dos \
22+
&& cat license.jwt > /etc/nginx/license.jwt \
23+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
24+
&& ln -sf /dev/stderr /var/log/nginx/error.log \
25+
&& rm -rf /var/cache/apk/*
26+
27+
# Copy configuration files:
28+
COPY nginx.conf custom_log_format.json /etc/nginx/
29+
COPY entrypoint.sh /root/
30+
RUN chmod +x /root/entrypoint.sh
31+
32+
EXPOSE 80
33+
34+
STOPSIGNAL SIGQUIT
35+
36+
CMD ["sh", "/root/entrypoint.sh"]
37+
38+
```

‎content/includes/dos/dockerfiles/amazon-plus-dos-waf.md‎

Whitespace-only changes.

‎content/includes/dos/dockerfiles/amazon-plus-dos.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
---
3+
4+
```dockerfile
5+
6+
# For AmazonLinux 2023:
7+
FROM amazonlinux:2023
8+
9+
# Install F5 DoS for NGINX
10+
RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
11+
--mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
12+
--mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \
13+
dnf -y install ca-certificates \
14+
&& curl -o /etc/yum.repos.d/plus-amazonlinux2023.repo https://cs.nginx.com/static/files/plus-amazonlinux2023.repo \
15+
&& curl -o /etc/yum.repos.d/app-protect-dos-amazonlinux2023.repo https://cs.nginx.com/static/files/app-protect-dos-amazonlinux2023.repo \
16+
&& dnf install -y app-protect-dos \
17+
&& cat license.jwt > /etc/nginx/license.jwt \
18+
&& dnf clean all \
19+
&& rm -rf /var/cache/dnf \
20+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
21+
&& ln -sf /dev/stderr /var/log/nginx/error.log
22+
23+
# Copy configuration files:
24+
COPY nginx.conf custom_log_format.json /etc/nginx/
25+
COPY entrypoint.sh /root/
26+
RUN chmod +x /root/entrypoint.sh
27+
28+
EXPOSE 80
29+
30+
STOPSIGNAL SIGQUIT
31+
32+
CMD ["sh", "/root/entrypoint.sh"]
33+
34+
```

‎content/includes/dos/dockerfiles/debian-plus-dos-waf.md‎

Whitespace-only changes.

‎content/includes/dos/dockerfiles/debian-plus-dos.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
---
3+
4+
```dockerfile
5+
6+
# Where can be bullseye/bookworm
7+
FROM debian:bullseye
8+
9+
# Install F5 DoS for NGINX
10+
RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
11+
--mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
12+
--mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \
13+
apt-get update \
14+
&& DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends apt-transport-https lsb-release ca-certificates wget gnupg2 debian-archive-keyring \
15+
&& mkdir -p /etc/ssl/nginx/ /etc/nginx/ \
16+
&& wget -qO - https://cs.nginx.com/static/keys/nginx_signing.key | gpg --dearmor | tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null \
17+
&& printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/plus/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-plus.list \
18+
&& printf "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] https://pkgs.nginx.com/app-protect-dos/debian $(lsb_release -cs) nginx-plus\n" > /etc/apt/sources.list.d/nginx-app-protect-dos.list \
19+
&& wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \
20+
&& DEBIAN_FRONTEND="noninteractive" apt-get install -y app-protect-dos \
21+
&& cat license.jwt > /etc/nginx/license.jwt \
22+
&& apt-get remove --purge --auto-remove -y \
23+
&& rm -rf /var/lib/apt/lists/* \
24+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
25+
&& ln -sf /dev/stderr /var/log/nginx/error.log
26+
27+
COPY nginx.conf /etc/nginx/
28+
COPY entrypoint.sh /root/
29+
RUN chmod +x /root/entrypoint.sh
30+
31+
EXPOSE 80
32+
33+
STOPSIGNAL SIGQUIT
34+
35+
CMD ["sh", "/root/entrypoint.sh"]
36+
37+
```

‎content/includes/dos/dockerfiles/rhel8-plus-dos-waf.md‎

Whitespace-only changes.

‎content/includes/dos/dockerfiles/rhel8-plus-dos.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
---
3+
4+
```dockerfile
5+
# For UBI 8
6+
FROM registry.access.redhat.com/ubi8
7+
8+
ARG RHEL_ORG
9+
ARG RHEL_ACTIVATION_KEY
10+
11+
# Install F5 DoS for NGINX
12+
RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
13+
--mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
14+
--mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \
15+
subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} \
16+
&& subscription-manager refresh \
17+
&& subscription-manager attach --auto || true \
18+
&& subscription-manager repos --enable=rhel-8-for-x86_64-baseos-rpms \
19+
&& subscription-manager repos --enable=rhel-8-for-x86_64-appstream-rpms \
20+
&& dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm \
21+
&& dnf -y install ca-certificates \
22+
&& curl -o /etc/yum.repos.d/plus-8.repo https://cs.nginx.com/static/files/plus-8.repo \
23+
&& curl -o /etc/yum.repos.d/app-protect-dos-8.repo https://cs.nginx.com/static/files/app-protect-dos-8.repo \
24+
&& dnf -y install app-protect-dos \
25+
&& cat license.jwt > /etc/nginx/license.jwt \
26+
&& rm /etc/yum.repos.d/plus-8.repo \
27+
&& rm /etc/yum.repos.d/app-protect-dos-8.repo \
28+
&& dnf clean all \
29+
&& rm -rf /var/cache/yum \
30+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
31+
&& ln -sf /dev/stderr /var/log/nginx/error.log
32+
33+
# Copy configuration files:
34+
COPY nginx.conf custom_log_format.json /etc/nginx/
35+
COPY entrypoint.sh /root/
36+
RUN chmod +x /root/entrypoint.sh
37+
38+
EXPOSE 80
39+
40+
STOPSIGNAL SIGQUIT
41+
42+
CMD ["sh", "/root/entrypoint.sh"]
43+
44+
```

‎content/includes/dos/dockerfiles/rhel9-plus-dos-waf.md‎

Whitespace-only changes.

‎content/includes/dos/dockerfiles/rhel9-plus-dos.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
---
3+
4+
```dockerfile
5+
# For UBI 9
6+
FROM registry.access.redhat.com/ubi9
7+
8+
ARG RHEL_ORG
9+
ARG RHEL_ACTIVATION_KEY
10+
11+
# Install F5 DoS for NGINX
12+
RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \
13+
--mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \
14+
--mount=type=secret,id=license-jwt,dst=license.jwt,mode=0644 \
15+
subscription-manager register --org=${RHEL_ORG} --activationkey=${RHEL_ACTIVATION_KEY} \
16+
&& subscription-manager refresh \
17+
&& subscription-manager attach --auto || true \
18+
&& subscription-manager repos --enable=rhel-9-for-x86_64-baseos-rpms \
19+
&& subscription-manager repos --enable=rhel-9-for-x86_64-appstream-rpms \
20+
&& dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm \
21+
&& dnf -y install ca-certificates \
22+
&& curl -o /etc/yum.repos.d/plus-9.repo https://cs.nginx.com/static/files/plus-9.repo \
23+
&& curl -o /etc/yum.repos.d/app-protect-dos-9.repo https://cs.nginx.com/static/files/app-protect-dos-9.repo \
24+
&& dnf -y install app-protect-dos \
25+
&& cat license.jwt > /etc/nginx/license.jwt \
26+
&& rm /etc/yum.repos.d/plus-9.repo \
27+
&& rm /etc/yum.repos.d/app-protect-dos-9.repo \
28+
&& dnf clean all \
29+
&& rm -rf /var/cache/yum \
30+
&& ln -sf /dev/stdout /var/log/nginx/access.log \
31+
&& ln -sf /dev/stderr /var/log/nginx/error.log
32+
33+
# Copy configuration files:
34+
COPY nginx.conf custom_log_format.json /etc/nginx/
35+
COPY entrypoint.sh /root/
36+
RUN chmod +x /root/entrypoint.sh
37+
38+
EXPOSE 80
39+
40+
STOPSIGNAL SIGQUIT
41+
42+
CMD ["sh", "/root/entrypoint.sh"]
43+
44+
```

0 commit comments

Comments
 (0)