vLab-BZH/bunkerwebpoc
2
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Doc et exemples à jour : publication en *-bwpoc.vlab.bzh derrière Traefik, modèle 9100 avec agent QEMU

Browse Source 
- README : noms des sites, accès via Traefik, configuration retenue sur vLab,
  variante BunkerWeb en frontal avec Let's Encrypt, prérequis du modèle
- examples/split régénérés depuis la configuration actuelle (secrets en CHANGEME)
- schéma : libellé des sites en *-bwpoc.vlab.bzh

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
cedricandClaude Opus 5.5 committed 2026-10-27 16:40:08 +01:00
1 parent e395fae4c6
commit f0f61548d2
5 files changed
+82 -56
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

examples/split/bunkerweb.compose.yml
+42 -32
View File
@@ -1,6 +1,6 @@
# Ansible managed
# Stack BunkerWeb 1.6.17 : WAF + scheduler + UI + MariaDB + Redis
# Mode split, applis sur 192.168.200.62
# Mode split, applis sur 192.168.200.161
x-db-env: &db-env
DATABASE_URI: "mariadb+pymysql://bunkerweb:CHANGEME@bw-db:3306/db"
@@ -37,13 +37,21 @@ services:
environment:
<<: [*db-env, *api-env]
BUNKERWEB_INSTANCES: "bunkerweb"
SERVER_NAME: "www.bwpoc.internal shop.bwpoc.internal api.bwpoc.internal bwui.bwpoc.internal"
SERVER_NAME: "www-bwpoc.vlab.bzh shop-bwpoc.vlab.bzh api-bwpoc.vlab.bzh bwui-bwpoc.vlab.bzh"
# --- Réglages globaux ---
MULTISITE: "yes"
DISABLE_DEFAULT_SERVER: "yes"
SERVE_FILES: "no"
GENERATE_SELF_SIGNED_SSL: "yes"
AUTO_LETS_ENCRYPT: "no"
EMAIL_LETS_ENCRYPT: ""
LETS_ENCRYPT_CHALLENGE: "http"
USE_LETS_ENCRYPT_STAGING: "no"
AUTO_REDIRECT_HTTP_TO_HTTPS: "yes"
USE_REAL_IP: "yes"
REAL_IP_FROM: "172.16.16.21"
REAL_IP_HEADER: "X-Forwarded-For"
REAL_IP_RECURSIVE: "yes"
USE_MODSECURITY: "yes"
USE_MODSECURITY_CRS: "yes"
MODSECURITY_CRS_VERSION: "4"
@@ -59,36 +67,38 @@ services:
REDIS_HOST: "bw-redis"
REDIS_PASSWORD: "CHANGEME"
SEND_ANONYMOUS_REPORT: "no"
# --- www.bwpoc.internal ---
www.bwpoc.internal_USE_REVERSE_PROXY: "yes"
www.bwpoc.internal_REVERSE_PROXY_URL: "/"
www.bwpoc.internal_REVERSE_PROXY_HOST: "http://192.168.200.62:8081"
www.bwpoc.internal_SELF_SIGNED_SSL_SUBJ: "/CN=www.bwpoc.internal/"
www.bwpoc.internal_USE_ANTIBOT: "javascript"
www.bwpoc.internal_LIMIT_REQ_RATE: "10r/s"
# --- shop.bwpoc.internal ---
shop.bwpoc.internal_USE_REVERSE_PROXY: "yes"
shop.bwpoc.internal_REVERSE_PROXY_URL: "/"
shop.bwpoc.internal_REVERSE_PROXY_HOST: "http://192.168.200.62:8082"
shop.bwpoc.internal_SELF_SIGNED_SSL_SUBJ: "/CN=shop.bwpoc.internal/"
shop.bwpoc.internal_REVERSE_PROXY_WS: "yes"
shop.bwpoc.internal_LIMIT_REQ_RATE: "30r/s"
shop.bwpoc.internal_COOKIE_FLAGS: "* SameSite=Lax"
# --- api.bwpoc.internal ---
api.bwpoc.internal_USE_REVERSE_PROXY: "yes"
api.bwpoc.internal_REVERSE_PROXY_URL: "/"
api.bwpoc.internal_REVERSE_PROXY_HOST: "http://192.168.200.62:8083"
api.bwpoc.internal_SELF_SIGNED_SSL_SUBJ: "/CN=api.bwpoc.internal/"
api.bwpoc.internal_ALLOWED_METHODS: "GET|POST|HEAD"
api.bwpoc.internal_MAX_CLIENT_SIZE: "1m"
api.bwpoc.internal_LIMIT_REQ_RATE: "5r/s"
api.bwpoc.internal_CUSTOM_CONF_MODSEC_poc-rule: "SecRule ARGS:poc \"@streq attack\" \"id:10001,phase:2,deny,status:403,log,msg:'PoC BunkerWeb : regle maison'\""
# --- bwui.bwpoc.internal ---
bwui.bwpoc.internal_USE_REVERSE_PROXY: "yes"
bwui.bwpoc.internal_REVERSE_PROXY_URL: "/"
bwui.bwpoc.internal_REVERSE_PROXY_HOST: "http://bw-ui:7000"
bwui.bwpoc.internal_SELF_SIGNED_SSL_SUBJ: "/CN=bwui.bwpoc.internal/"
bwui.bwpoc.internal_USE_TEMPLATE: "ui"
# --- www-bwpoc.vlab.bzh ---
www-bwpoc.vlab.bzh_USE_REVERSE_PROXY: "yes"
www-bwpoc.vlab.bzh_REVERSE_PROXY_URL: "/"
www-bwpoc.vlab.bzh_REVERSE_PROXY_HOST: "http://192.168.200.161:8081"
www-bwpoc.vlab.bzh_SELF_SIGNED_SSL_SUBJ: "/CN=www-bwpoc.vlab.bzh/"
www-bwpoc.vlab.bzh_USE_ANTIBOT: "javascript"
www-bwpoc.vlab.bzh_LIMIT_REQ_RATE: "10r/s"
# --- shop-bwpoc.vlab.bzh ---
shop-bwpoc.vlab.bzh_USE_REVERSE_PROXY: "yes"
shop-bwpoc.vlab.bzh_REVERSE_PROXY_URL: "/"
shop-bwpoc.vlab.bzh_REVERSE_PROXY_HOST: "http://192.168.200.161:8082"
shop-bwpoc.vlab.bzh_SELF_SIGNED_SSL_SUBJ: "/CN=shop-bwpoc.vlab.bzh/"
shop-bwpoc.vlab.bzh_REVERSE_PROXY_WS: "yes"
shop-bwpoc.vlab.bzh_LIMIT_REQ_RATE: "30r/s"
shop-bwpoc.vlab.bzh_COOKIE_FLAGS: "* SameSite=Lax"
# --- api-bwpoc.vlab.bzh ---
api-bwpoc.vlab.bzh_USE_REVERSE_PROXY: "yes"
api-bwpoc.vlab.bzh_REVERSE_PROXY_URL: "/"
api-bwpoc.vlab.bzh_REVERSE_PROXY_HOST: "http://192.168.200.161:8083"
api-bwpoc.vlab.bzh_SELF_SIGNED_SSL_SUBJ: "/CN=api-bwpoc.vlab.bzh/"
api-bwpoc.vlab.bzh_ALLOWED_METHODS: "GET|POST|HEAD"
api-bwpoc.vlab.bzh_MAX_CLIENT_SIZE: "1m"
api-bwpoc.vlab.bzh_LIMIT_REQ_RATE: "5r/s"
api-bwpoc.vlab.bzh_CUSTOM_CONF_MODSEC_poc-rule: "SecRule ARGS:poc \"@streq attack\" \"id:10001,phase:2,deny,status:403,log,msg:'PoC BunkerWeb : regle maison'\""
# --- bwui-bwpoc.vlab.bzh ---
bwui-bwpoc.vlab.bzh_USE_REVERSE_PROXY: "yes"
bwui-bwpoc.vlab.bzh_REVERSE_PROXY_URL: "/"
bwui-bwpoc.vlab.bzh_REVERSE_PROXY_HOST: "http://bw-ui:7000"
bwui-bwpoc.vlab.bzh_SELF_SIGNED_SSL_SUBJ: "/CN=bwui-bwpoc.vlab.bzh/"
bwui-bwpoc.vlab.bzh_USE_TEMPLATE: "ui"
# Accès réservé (poc_allowed_sources + client de test), challenge ACME toujours permis
bwui-bwpoc.vlab.bzh_CUSTOM_CONF_MODSEC_poc-allowlist: "SecRule REMOTE_ADDR \"!@ipMatch 172.16.0.0/12,192.168.0.0/16,192.168.200.130\" \"id:10002,phase:1,deny,status:403,log,msg:'PoC BunkerWeb : source non autorisee',chain\"\nSecRule REQUEST_URI \"!@beginsWith /.well-known/acme-challenge/\" \"t:none\""
networks:
- bw-universe
- bw-db