Skip to content

Commit d762d40

Browse files
committed
fix: remove app_protect_enforcer_address from virt config
1 parent 4d7955a commit d762d40

File tree

1 file changed

+115
-1
lines changed

1 file changed

+115
-1
lines changed

content/waf/install/virtual-environment.md

Lines changed: 115 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,121 @@ sudo apt-get install app-protect
202202

203203
## Update configuration files
204204

205-
{{< include "waf/install-update-configuration.md" >}}
205+
Once you have installed F5 WAF for NGINX, you must load it as a module in the main context of your NGINX configuration.
206+
207+
```nginx
208+
load_module modules/ngx_http_app_protect_module.so;
209+
```
210+
211+
And finally, F5 WAF for NGINX can enabled on a _http_, _server_ or _location_ context:
212+
213+
```nginx
214+
app_protect_enable on;
215+
```
216+
217+
{{< call-out "warning" >}}
218+
219+
You should only enable F5 WAF for NGINX on _proxy_pass_ and _grpc_pass_ locations.
220+
221+
{{< /call-out >}}
222+
223+
Here are two examples of how these additions could look in configuration files:
224+
225+
{{< tabs name="configuration-examples" >}}
226+
227+
{{% tab name="nginx.conf" %}}
228+
229+
The default path for this file is `/etc/nginx/nginx.conf`.
230+
231+
```nginx {hl_lines=[5, 33]}
232+
user nginx;
233+
worker_processes auto;
234+
235+
# F5 WAF for NGINX
236+
load_module modules/ngx_http_app_protect_module.so;
237+
238+
error_log /var/log/nginx/error.log notice;
239+
pid /var/run/nginx.pid;
240+
241+
242+
events {
243+
worker_connections 1024;
244+
}
245+
246+
http {
247+
include /etc/nginx/mime.types;
248+
default_type application/octet-stream;
249+
250+
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
251+
'$status $body_bytes_sent "$http_referer" '
252+
'"$http_user_agent" "$http_x_forwarded_for"';
253+
254+
access_log /var/log/nginx/access.log main;
255+
256+
sendfile on;
257+
#tcp_nopush on;
258+
259+
keepalive_timeout 65;
260+
261+
#gzip on;
262+
263+
# F5 WAF for NGINX
264+
app_protect_enforcer_address 127.0.0.1:50000;
265+
266+
include /etc/nginx/conf.d/*.conf;
267+
}
268+
```
269+
270+
{{% /tab %}}
271+
272+
{{% tab name="default.conf" %}}
273+
274+
The default path for this file is `/etc/nginx/conf.d/default.conf`.
275+
276+
```nginx {hl_lines=[10]}
277+
server {
278+
listen 80;
279+
server_name domain.com;
280+
281+
282+
location / {
283+
284+
# F5 WAF for NGINX
285+
app_protect_enable on;
286+
287+
client_max_body_size 0;
288+
default_type text/html;
289+
proxy_pass http://127.0.0.1:8080/;
290+
}
291+
}
292+
293+
server {
294+
listen 8080;
295+
server_name localhost;
296+
297+
298+
location / {
299+
root /usr/share/nginx/html;
300+
index index.html index.htm;
301+
}
302+
303+
# redirect server error pages to the static page /50x.html
304+
#
305+
error_page 500 502 503 504 /50x.html;
306+
location = /50x.html {
307+
root /usr/share/nginx/html;
308+
}
309+
}
310+
```
311+
312+
{{% /tab %}}
313+
314+
{{< /tabs >}}
315+
316+
Once you have updated your configuration files, you can reload NGINX to apply the changes. You have two options depending on your environment:
317+
318+
- `nginx -s reload`
319+
- `sudo systemctl reload nginx`
206320

207321
## Post-installation checks
208322

0 commit comments

Comments
 (0)