Option domaine public : Let's Encrypt (poc_tls) et accès réservé par IP (poc_allowed_sources)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

roles/bunkerweb/templates/compose.yml.j2

@@ -66,6 +66,11 @@ services:
 {%   for k, v in (site.custom_confs | default({})).items() %}
       {{ fqdn }}_CUSTOM_CONF_{{ k }}: {{ val(v) }}
 {%   endfor %}
+{%   if name in poc_restricted_sites and poc_allowed_sources | length > 0 %}
+      # Accès réservé (poc_allowed_sources + client de test), challenge ACME toujours permis
+      {{ fqdn }}_CUSTOM_CONF_MODSEC_poc-allowlist: {{ val('SecRule REMOTE_ADDR "!@ipMatch ' ~ ((poc_allowed_sources + [client_ip]) | join(',')) ~ '" "id:10002,phase:1,deny,status:403,log,msg:\'PoC BunkerWeb : source non autorisee\',chain"
+SecRule REQUEST_URI "!@beginsWith /.well-known/acme-challenge/"') }}
+{%   endif %}
 {% endfor %}
     networks:
       - bw-universe