Image: mikirisec/mikiri-waf-filter-nginx. Volume: /mikiri-waf-filter-nginx. Ports: 80, 443, 5672.
The image includes Nginx, Memcached, RabbitMQ, MLA and the API Firewall. The first start prepares the volume and the container exits. Point the Filter at API before the next start. Create the protected site in WMC after the Filter is running, as described in Configuring Filter as a reverse proxy.
mkdir -p /opt/mikiri-waf/mikiri-waf-filter-nginx
touch /opt/mikiri-waf/mikiri-waf-filter-nginx/first-launch
docker run -d --name mikiri-waf-filter-nginx --network mikiri-waf \
-p 80:80 -p 443:443 \
-v /opt/mikiri-waf/mikiri-waf-filter-nginx:/mikiri-waf-filter-nginx \
mikirisec/mikiri-waf-filter-nginx:latest
The entrypoint writes load_module lines, worker_processes auto include mikiri-waf/filter/global/waf.conf; inside the http block of nginx.conf, copies it to the volume stores the RabbitMQ credentials in rabbitmq_password. On a later start the same include is added if it is missing. Edit Filter settings in mikiri-waf/filter/global/waf.conf. The RabbitMQ user name in that file is USER. The user is created again on every start. The container then exits. Do not add a restart policy to this first start.
Port 5672 is reachable inside the Docker network as mikiri-waf-filter-nginx:5672. Publish it with -p 5672:5672 only when MLC runs outside this network.
Edit the files in /opt/mikiri-waf/mikiri-waf-filter-nginx/ on the host. Point Filter at API as described in integration with API. After this container is running, create the virtual host in WMC.
Start the container again:
docker start mikiri-waf-filter-nginx
docker update --restart unless-stopped mikiri-waf-filter-nginx
This start runs Nginx, RabbitMQ, mikiri-waf-mla and mikiri-waf-af.
Mikiri WAF logs are in log/mikiri-waf/. Nginx logs are in log/nginx/.
| In the volume | In the container | Contents |
|---|---|---|
nginx.conf |
/etc/nginx/nginx.conf |
Main Nginx configuration |
mikiri-waf/filter/global/waf.conf |
/etc/nginx/mikiri-waf/filter/global/waf.conf |
Filter configuration |
mikiri-waf/mla/mla.conf |
/etc/nginx/mikiri-waf/mla/mla.conf |
MLA configuration |
mikiri-waf/html/ |
/etc/nginx/mikiri-waf/html/ |
Anti-bot pages and the custom block page |
log/mikiri-waf/ |
/var/log/mikiri-waf/ |
Filter, MLA and API Firewall logs |
log/nginx/ |
/var/log/nginx/ |
Nginx logs |
rabbitmq_password |
file in the volume | RabbitMQ user name and password |
docker pull mikirisec/mikiri-waf-filter-nginx:latest
docker stop mikiri-waf-filter-nginx
docker rm mikiri-waf-filter-nginx
docker run -d --name mikiri-waf-filter-nginx --network mikiri-waf --restart unless-stopped \
-p 80:80 -p 443:443 \
-v /opt/mikiri-waf/mikiri-waf-filter-nginx:/mikiri-waf-filter-nginx \
mikirisec/mikiri-waf-filter-nginx:latest
Do not create first-launch again. If the package version changed, the previous volume contents are copied to old/. The working files stay in place.