Implement HAProxy WAF integration with ModSecurity 3 for advanced threat protection

#!/usr/bin/env bash
set -euo pipefail

# ------------------------------------------------------------------------
# HAProxy + ModSecurity3 (SPOE/SPOA) WAF integration installer
# Supports: Ubuntu, Debian, AlmaLinux, Rocky Linux
# ------------------------------------------------------------------------

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
log()  { echo -e "${GREEN}[+] $*${NC}"; }
warn() { echo -e "${YELLOW}[!] $*${NC}"; }
err()  { echo -e "${RED}[x] $*${NC}" >&2; }

TOTAL_STEPS=12
STEP=0
step() { STEP=$((STEP+1)); echo -e "\n${GREEN}[$STEP/$TOTAL_STEPS] $*${NC}"; }

SRC_DIR="/usr/local/src"
SPOA_CFG_DIR="/etc/modsecurity-spoa"
CRS_TAG="v4.3/master"
MOD_TAG="v3/master"

usage() {
    echo "Usage: $0 [--backend-ip <IP>] [--backend-port <PORT>] [--domain <DOMAIN>]"
    echo "  --backend-ip     IP of the backend application server (default: 127.0.0.1)"
    echo "  --backend-port   Port of the backend application (default: 8080)"
    echo "  --domain         Domain name for HAProxy frontend (default: _ wildcard)"
    exit 1
}

BACKEND_IP="127.0.0.1"
BACKEND_PORT="8080"
DOMAIN="_"

while [ $# -gt 0 ]; do
    case "$1" in
        --backend-ip) BACKEND_IP="$2"; shift 2 ;;
        --backend-port) BACKEND_PORT="$2"; shift 2 ;;
        --domain) DOMAIN="$2"; shift 2 ;;
        -h|--help) usage ;;
        *) err "Unknown argument: $1"; usage ;;
    esac
done

if [ "$(id -u)" -ne 0 ]; then
    err "This script must be run as root (use sudo)."
    exit 1
fi

# --- Distro detection ---
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) PKG_MGR="apt"; PKG_INSTALL="apt install -y"; SVC_NAME="haproxy" ;;
        almalinux|rocky|centos|rhel|ol|fedora) PKG_MGR="dnf"; PKG_INSTALL="dnf install -y"; SVC_NAME="haproxy" ;;
        amzn) PKG_MGR="yum"; PKG_INSTALL="yum install -y"; SVC_NAME="haproxy" ;;
        *) err "Unsupported distro: $ID"; exit 1 ;;
    esac
else
    err "/etc/os-release not found. Cannot detect distro."
    exit 1
fi
log "Detected distro: $ID ($PKG_MGR)"

# --- Rollback on failure ---
cleanup_on_error() {
    err "Installation failed at step $STEP. Rolling back partial changes..."
    systemctl stop modsec-spoa.service 2>/dev/null || true
    rm -f /etc/systemd/system/modsec-spoa.service
    systemctl daemon-reload 2>/dev/null || true
    warn "Source directories left in $SRC_DIR for inspection. Remove manually if desired."
}
trap cleanup_on_error ERR

# --- Step 1: install build dependencies ---
step "Installing build dependencies..."
if [ "$PKG_MGR" = "apt" ]; then
    apt update
    $PKG_INSTALL build-essential git autoconf automake libtool \
        pkgconf libpcre2-dev libpcre3-dev libxml2-dev libcurl4-openssl-dev \
        libyajl-dev doxygen libgeoip-dev liblua5.3-dev libssl-dev \
        zlib1g-dev libmaxminddb-dev cmake
else
    dnf groupinstall -y "Development Tools"
    dnf install -y epel-release || true
    $PKG_INSTALL git autoconf automake libtool pkgconf pcre2-devel \
        libxml2-devel libcurl-devel yajl-devel doxygen GeoIP-devel \
        lua-devel openssl-devel zlib-devel libmaxminddb-devel cmake
fi

# --- Step 2: build & install libmodsecurity ---
step "Cloning and building libmodsecurity 3 (this takes 15-30 minutes)..."
mkdir -p "$SRC_DIR"
cd "$SRC_DIR"
if [ ! -d modsecurity ]; then
    git clone --depth 1 -b "$MOD_TAG" https://github.com/owasp-modsecurity/ModSecurity modsecurity
fi
cd modsecurity
git submodule init
git submodule update
if [ ! -f /usr/local/modsecurity/lib/libmodsecurity.so ]; then
    ./build.sh
    ./configure
    make -j"$(nproc)"
    make install
else
    warn "libmodsecurity already installed, skipping build."
fi

step "Verifying libmodsecurity shared library..."
if ! ls /usr/local/modsecurity/lib/libmodsecurity.so* >/dev/null 2>&1; then
    err "libmodsecurity build failed - shared library not found."
    exit 1
fi
log "libmodsecurity installed successfully."

# --- Step 3: build SPOA ---
step "Building the ModSecurity SPOA daemon..."
cd "$SRC_DIR"
if [ ! -d spoa-modsecurity ]; then
    git clone https://github.com/haproxytech/spoa-modsecurity
fi
cd spoa-modsecurity
make MODSECURITY_INC=/usr/local/modsecurity/include \
     MODSECURITY_LIB=/usr/local/modsecurity/lib
cp spoa /usr/local/bin/modsec-spoa
chmod 755 /usr/local/bin/modsec-spoa
mkdir -p "$SPOA_CFG_DIR"
chown root:root "$SPOA_CFG_DIR"
chmod 755 "$SPOA_CFG_DIR"

# --- Step 4: install HAProxy ---
step "Installing HAProxy..."
$PKG_INSTALL haproxy
haproxy -v || { err "HAProxy install failed."; exit 1; }

# Detect distro-specific HAProxy config path
if [ -d /etc/haproxy ]; then
    HAPROXY_CFG_DIR="/etc/haproxy"
else
    err "Could not locate /etc/haproxy config directory."
    exit 1
fi

# --- Step 5: download OWASP CRS ---
step "Downloading OWASP Core Rule Set..."
cd "$SPOA_CFG_DIR"
if [ ! -d crs ]; then
    git clone -b "$CRS_TAG" https://github.com/coreruleset/coreruleset crs
fi
cp -n crs/crs-setup.conf.example crs/crs-setup.conf
chown -R root:root crs
chmod -R 755 crs

# --- Step 6: create log directories ---
step "Creating ModSecurity log directories..."
mkdir -p /var/log/modsecurity
chown root:root /var/log/modsecurity
chmod 750 /var/log/modsecurity

# --- Step 7: write modsecurity engine config (detection-only by default) ---
step "Writing ModSecurity engine configuration (DetectionOnly mode)..."
cat > "$SPOA_CFG_DIR/modsecurity.conf" <<EOF
SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecResponseBodyAccess Off
SecRequestBodyLimit 13107200
SecRequestBodyNoFilesLimit 131072
SecPcreMatchLimit 250000
SecPcreMatchLimitRecursion 250000
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecAuditLog /var/log/modsecurity/audit.log
SecDebugLog /var/log/modsecurity/debug.log
SecDebugLogLevel 3

Include ${SPOA_CFG_DIR}/crs/crs-setup.conf
Include ${SPOA_CFG_DIR}/crs/rules/*.conf
EOF
chown root:root "$SPOA_CFG_DIR/modsecurity.conf"
chmod 644 "$SPOA_CFG_DIR/modsecurity.conf"
warn "SecRuleEngine is set to DetectionOnly. Review logs before enabling blocking mode."

# --- Step 8: create systemd service for SPOA ---
step "Creating systemd service for modsec-spoa..."
cat > /etc/systemd/system/modsec-spoa.service <<EOF
[Unit]
Description=HAProxy ModSecurity SPOA
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/modsec-spoa -f ${SPOA_CFG_DIR}/modsecurity.conf -p 12345
Restart=on-failure
User=root

[Install]
WantedBy=multi-user.target
EOF
chmod 644 /etc/systemd/system/modsec-spoa.service
systemctl daemon-reload
systemctl enable --now modsec-spoa.service

# --- Step 9: configure SPOE file for HAProxy ---
step "Writing SPOE configuration file..."
cat > "${HAPROXY_CFG_DIR}/modsecurity-spoe.conf" <<EOF
[modsecurity]
spoe-agent modsecurity-agent
    messages check-request
    option var-prefix modsec
    timeout hello 2s
    timeout idle 2m
    timeout processing 2s
    use-backend spoe-modsecurity

spoe-message check-request
    args unique-id method path query req.ver req.hdrs_bin req.body_size req.body
    event on-frontend-http-request

backend spoe-modsecurity
    mode tcp
    server modsec-spoa1 127.0.0.1:12345
EOF
chown root:root "${HAPROXY_CFG_DIR}/modsecurity-spoe.conf"
chmod 644 "${HAPROXY_CFG_DIR}/modsecurity-spoe.conf"

# --- Step 10: patch haproxy.cfg with frontend/backend and filter ---
step "Configuring HAProxy frontend/backend for WAF filtering..."
HAPROXY_MAIN_CFG="${HAPROXY_CFG_DIR}/haproxy.cfg"
cp "$HAPROXY_MAIN_CFG" "${HAPROXY_MAIN_CFG}.bak.$(date +%s)"

if ! grep -q "filter spoe" "$HAPROXY_MAIN_CFG"; then
cat >> "$HAPROXY_MAIN_CFG" <<EOF

frontend fe_waf