You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "xx-zhang (via GitHub)" <gi...@apache.org> on 2024/12/10 02:49:33 UTC
[I] help request: APISIX_STAND_ALONE how to set plugin metadata in config.yaml [apisix]
xx-zhang opened a new issue, #11817:
URL: https://github.com/apache/apisix/issues/11817
### Description
How to set plugin_meta to config.yaml
- this is etcd api set, but i use stand_alone, so i want to make a static config in `config.yaml`.
```conf
curl http://127.0.0.1:9180/apisix/admin/plugin_metadata/coraza-waf \
-H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
{
"nodes":[
{
"host": "127.0.0.1",
"port": 7717
}
]
}'
```
- but i have tried like this in config.yaml or apisix.yaml , all no use .
```
coraza-waf:
_meta:
nodes:
- host: "127.0.0.1"
port: 65533
```
-
```
coraza-waf:
nodes:
- host: "127.0.0.1"
port: 65533
```
-
```
plugin_metadata:
coraza-waf:
nodes:
- host: "127.0.0.1"
port: 65533
```
### Environment
- APISIX version (run `apisix version`):
- Operating system (run `uname -a`):
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
- etcd version, if relevant (run `curl http://127.0.0.1:9090/v1/server_info`):
- APISIX Dashboard version, if relevant:
- Plugin runner version, for issues related to plugin runners:
- LuaRocks version, for installation issues (run `luarocks --version`):
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: APISIX_STAND_ALONE how to set plugin metadata in config.yaml 【独立版怎么配置plugin_metadata】 [apisix]
Posted by "xx-zhang (via GitHub)" <gi...@apache.org>.
xx-zhang closed issue #11817: help request: APISIX_STAND_ALONE how to set plugin metadata in config.yaml 【独立版怎么配置plugin_metadata】
URL: https://github.com/apache/apisix/issues/11817
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: APISIX_STAND_ALONE how to set plugin metadata in config.yaml 【独立版怎么配置plugin_metadata】 [apisix]
Posted by "xx-zhang (via GitHub)" <gi...@apache.org>.
xx-zhang commented on issue #11817:
URL: https://github.com/apache/apisix/issues/11817#issuecomment-2530185660
also in apisix.conf like the conf before, not effect
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: APISIX_STAND_ALONE how to set plugin metadata in config.yaml 【独立版怎么配置plugin_metadata】 [apisix]
Posted by "xx-zhang (via GitHub)" <gi...@apache.org>.
xx-zhang commented on issue #11817:
URL: https://github.com/apache/apisix/issues/11817#issuecomment-2531270360
result::
this is ok.
```yaml
plugin_metadata:
- id: coraza-waf
nodes:
- host: "127.0.0.1"
port: 65533
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] help request: APISIX_STAND_ALONE how to set plugin metadata in config.yaml 【独立版怎么配置plugin_metadata】 [apisix]
Posted by "mikyll (via GitHub)" <gi...@apache.org>.
mikyll commented on issue #11817:
URL: https://github.com/apache/apisix/issues/11817#issuecomment-2531271250
I'm not sure what you're trying to achieve with this snippet:
```yaml
coraza-waf:
nodes:
- host: "127.0.0.1"
port: 65533
```
However, I searched the Coraza documentation ([Reference Manual v3.x](https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-%28v3.x%29) and [OWASP Coraza Docs](https://coraza.io/docs/tutorials/introduction/)) and I didn't find anything about `nodes`.
Moreover, you're using the top level `coraza-waf.`, while to set Coraza plugin configuration, you should use `coraza-waf.conf.`.
From your description it seems you're also confusing `config.yaml` and `apisix.yaml`.
- `config.yaml` is used to configure intrinsics and behavioural properties of APISIX, such as the router type, the configuration provider, logging level, and the **list of available plugins**.
- `apisix.yaml` is used to define the resources, like routes, services and upstreams.
If you're trying to enable and use Coraza WASM plugin, you can refer to this wonderful tutorial made by the guys from API7: [API7 | Integrate with Coraza](https://docs.api7.ai/apisix/how-to-guide/security/waf/integrate-with-coraza).
## Example
I tried it on APISIX with standalone on a Docker setup and it seems to work fine, I'll report here the main steps:
1. Download and extract `coraza-proxy-wasm`:
```bash
wget https://github.com/corazawaf/coraza-proxy-wasm/releases/download/0.5.0/coraza-proxy-wasm-0.5.0.zip -O coraza-proxy-wasm-0.5.0.zip
unzip coraza-proxy-wasm-0.5.0.zip
```
2. Write `conf/config.yaml` file:
```yaml
apisix:
enable_admin: false
config_center: yaml
deployment:
role: data_plane
role_data_plane:
config_provider: yaml
wasm:
plugins:
- name: coraza-waf
priority: 7999
file: /usr/local/bin/coraza-proxy-wasm.wasm
```
3. Then create an example `conf/apisix.yaml`:
```yaml
upstreams:
- id: httpbin
nodes:
"httpbin.org:80": 1
services:
- id: httpbin-service
upstream_id: httpbin
desc: "This service is used as a test endpoint, returning information about the sender or the request."
routes:
- uris:
- /test-coraza/*
service_id: httpbin-service
name: getting-started-waf
plugins:
proxy-rewrite:
regex_uri:
- "^/test-coraza/(.*)"
- "/$1"
coraza-waf:
conf:
directives_map:
default:
- SecDebugLogLevel 9
- SecRuleEngine On
- SecRule REQUEST_URI "@beginsWith /test-coraza/anything/archive" "id:101,phase:1,t:lowercase,deny"
default_directives: default
#END
```
4. Run `apache/apisix` Docker container:
```bash
docker run --name apache-apisix-coraza --rm \
-p 9080:9080 \
-e APISIX_STAND_ALONE=true \
apache/apisix
```
5. Copy config files and `coraza-proxy-wasm` to APISIX docker container:
```bash
docker cp coraza-proxy-wasm.wasm apache-apisix-coraza:/usr/local/bin/
docker cp conf/config.yaml apache-apisix-coraza:/usr/local/apisix/conf/config.yaml
docker cp conf/apisix.yaml apache-apisix-coraza:/usr/local/apisix/conf/apisix.yaml
```
6. Reload APISIX to make it pick up the new `config.yaml`:
```bash
docker exec apache-apisix-coraza apisix reload
```
### Test
- Request to `/test-coraza/anything`:
```bash
curl -s -i localhost:9080/test-coraza/anything
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 387
Connection: keep-alive
Date: Tue, 10 Dec 2024 11:10:00 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Server: APISIX/3.11.0
{
"args": {},
"data": "",
"files": {},
"form": {},
"headers": {
"Accept": "*/*",
"Host": "localhost",
"User-Agent": "curl/8.2.1",
"X-Amzn-Trace-Id": "Root=1-67582188-2cc926c653b036b35797f643",
"X-Forwarded-Host": "localhost"
},
"json": null,
"method": "GET",
"origin": "172.17.0.1, 89.XX.XXX.XXX",
"url": "http://localhost/anything"
}
```
- Request to `/test-coraza/anything/archive`:
```bash
curl -s -i localhost:9080/test-coraza/anything/archive
HTTP/1.1 403 Forbidden
Date: Tue, 10 Dec 2024 11:10:55 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 225
Connection: keep-alive
Server: APISIX/3.11.0
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>openresty</center>
<p><em>Powered by <a href="https://apisix.apache.org/">APISIX</a>.</em></p></body>
</html>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org