NGINX App Protect WAF and DoS Ansible Role

This Ansible role helps you install and set up NGINX App Protect Web Application Firewall (WAF) or Denial of Service (DoS) protection on your target server.

Important Notes

• By default, the role installs NGINX App Protect WAF. To install the DoS version, set the variable nginx_app_protect_dos_enable to true.
• The role is under active development, so some issues may still exist and variables might change.

Requirements

NGINX App Protect License

You will need a license for NGINX App Protect WAF or DoS before using this role.

Ansible

• This role works with Ansible version 2.12 and above.
• Install the following collections for proper functionality:

collections:
  - name: ansible.posix
    version: 1.4.0
  - name: community.crypto
    version: 2.10.0
  - name: community.general
    version: 6.2.0
  - name: community.docker  # Needed only if you plan to use Molecule
    version: 3.4.0

• For installation instructions, check the Ansible website.

Jinja2

• Jinja2 is used for templates. Ensure you have Jinja2 version 3.1 or higher.
• Installation details can be found on the Jinja2 website.

Molecule (Optional)

• Used for testing the role. Recommended version is 4.x.
• Follow the instructions on the Molecule website to install it. Remember to also install the Molecule Docker driver.
• To run tests with Molecule, you'll need to put your NGINX App Protect license in the files/license folder of the role.

Installation

Using Ansible Galaxy

To install the latest version of the role:

ansible-galaxy install nginxinc.nginx_app_protect

To update an existing installation:

ansible-galaxy install -f nginxinc.nginx_app_protect

Using Git

To clone the latest code from GitHub:

git clone https://github.com/nginxinc/ansible-role-nginx-app-protect.git

Supported Platforms

For NGINX App Protect WAF

Supports all platforms that support NGINX Plus with the listed distributions for WAF:

Amazon Linux 2:
  - any
Debian:
  - buster (10)
RHEL:
  - 8.1+
Ubuntu:
  - bionic (18.04)
  - focal (20.04)

For NGINX App Protect DoS

Supports all platforms that support NGINX Plus with the listed distributions for DoS:

Debian:
  - buster (10)
  - bullseye (11)
RHEL:
  - 8.0+
Ubuntu:
  - bionic (18.04)
  - focal (20.04)

Role Variables

This role has several variables. You can check their descriptions and default values in the defaults/ folder:

For details about preset variables, see the vars/ folder:

Dependencies

If NGINX Plus is not installed, this role will install the required version of NGINX Plus based on the NGINX App Protect version you are installing.

Example Playbooks

You can find examples in the molecule/default/ folder:

Additional Resources

You can explore more roles and collections for NGINX:

• NGINX Core collection
• NGINX OOS and Plus role
• NGINX configuration role
• NGINX Unit role

License

This project is licensed under the Apache License, Version 2.0.

Authors

• Daniel Edgar
• Alessandro Fael Garcia

© F5, Inc. 2020 - 2024