diff --git a/content/includes/waf/dockerfiles/debian-oss.md b/content/includes/waf/dockerfiles/debian-oss.md index 60a1d66f0d..13ba22e6d2 100644 --- a/content/includes/waf/dockerfiles/debian-oss.md +++ b/content/includes/waf/dockerfiles/debian-oss.md @@ -8,7 +8,7 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 -# Supported OS_CODENAME's are: bullseye/bookworm +# Supported OS_CODENAME's are: bullseye/bookworm/trixie ARG OS_CODENAME=bookworm # Base image @@ -39,7 +39,7 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 tee /etc/apt/sources.list.d/nginx-app-protect.list \ && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ && apt-get update \ - && DEBIAN_FRONTEND="noninteractive" apt-get install -y nginx=1.25.5-1~`lsb_release -cs` app-protect-module-oss \ + && DEBIAN_FRONTEND="noninteractive" apt-get install -y nginx=1.31.3-1~`lsb_release -cs` app-protect-module-oss \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log \ && apt-get clean \ diff --git a/content/includes/waf/dockerfiles/debian-plus.md b/content/includes/waf/dockerfiles/debian-plus.md index f74df0352c..65d8121786 100644 --- a/content/includes/waf/dockerfiles/debian-plus.md +++ b/content/includes/waf/dockerfiles/debian-plus.md @@ -8,7 +8,7 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 -# Supported OS_CODENAME's are: bullseye/bookworm +# Supported OS_CODENAME's are: bullseye/bookworm/trixie ARG OS_CODENAME=bookworm # Base image diff --git a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/debian-plus.md b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/debian-plus.md index 1502bcbb76..fe43e31380 100644 --- a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/debian-plus.md +++ b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/debian-plus.md @@ -7,7 +7,7 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 -# Supported OS_CODENAME's are: bullseye/bookworm +# Supported OS_CODENAME's are: bullseye/bookworm/trixie ARG OS_CODENAME=bookworm # Base image diff --git a/content/includes/waf/dockerfiles/rocky9-plus.md b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel-plus.md similarity index 80% rename from content/includes/waf/dockerfiles/rocky9-plus.md rename to content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel-plus.md index 64a3964907..a75ccd4720 100644 --- a/content/includes/waf/dockerfiles/rocky9-plus.md +++ b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel-plus.md @@ -1,5 +1,4 @@ --- -f5-product: F5 WAF for NGINX f5-files: - content/waf/install/docker.md - content/waf/install/kubernetes.md @@ -8,13 +7,24 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 +# Supported UBI_VERSION's are 8/9/10 +ARG UBI_VERSION=9 + # Base Image -FROM rockylinux:9 +FROM registry.access.redhat.com/ubi${UBI_VERSION}/ubi + +# Define the ARG again after FROM to use it in this stage +ARG UBI_VERSION # Install NGINX Plus and F5 WAF for NGINX v5 module RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - dnf -y install wget ca-certificates \ + if [ "${UBI_VERSION}" = "8" ]; then \ + NGINX_PLUS_REPO="nginx-plus-${UBI_VERSION}.repo"; \ + else \ + NGINX_PLUS_REPO="plus-${UBI_VERSION}.repo"; \ + fi \ + && dnf -y install wget ca-certificates \ && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/${NGINX_PLUS_REPO} \ && echo "[app-protect-x-plus]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ @@ -31,10 +41,6 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log -# Securely copy the JWT license: -RUN --mount=type=secret,id=license-jwt,dst=license.jwt \ - cp license.jwt /etc/nginx/license.jwt - # Expose port EXPOSE 80 diff --git a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel8-plus.md b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel8-plus.md deleted file mode 100644 index c110f07a8c..0000000000 --- a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel8-plus.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -f5-files: -- content/waf/install/docker.md -- content/waf/install/kubernetes.md ---- - -```dockerfile -# syntax=docker/dockerfile:1 - -# Supported UBI_VERSION's are 7/8/9 -ARG UBI_VERSION=8 - -# Base Image -FROM registry.access.redhat.com/ubi${UBI_VERSION}/ubi - -# Define the ARG again after FROM to use it in this stage -ARG UBI_VERSION - -# Install NGINX Plus and F5 WAF for NGINX v5 module -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - PKG_MANAGER=dnf; \ - if [ "${UBI_VERSION}" = "7" ]; then \ - PKG_MANAGER=yum; \ - NGINX_PLUS_REPO="nginx-plus-7.4.repo"; \ - elif [ "${UBI_VERSION}" = "9" ]; then \ - NGINX_PLUS_REPO="plus-${UBI_VERSION}.repo"; \ - else \ - NGINX_PLUS_REPO="nginx-plus-${UBI_VERSION}.repo"; \ - fi \ - && $PKG_MANAGER -y install wget ca-certificates \ - && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ - && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/${NGINX_PLUS_REPO} \ - && echo "[app-protect-x-plus]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/${UBI_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && $PKG_MANAGER clean all \ - && $PKG_MANAGER install -y app-protect-module-plus \ - && $PKG_MANAGER clean all \ - && rm -rf /var/cache/$PKG_MANAGER \ - && ln -sf /dev/stdout /var/log/nginx/access.log \ - && ln -sf /dev/stderr /var/log/nginx/error.log - -# Expose port -EXPOSE 80 - -# Define stop signal -STOPSIGNAL SIGQUIT - -# Set default command -CMD ["nginx", "-g", "daemon off;"] -``` diff --git a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel9-plus.md b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rocky-plus.md similarity index 58% rename from content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel9-plus.md rename to content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rocky-plus.md index 7f1fbd07a2..9b50549599 100644 --- a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel9-plus.md +++ b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rocky-plus.md @@ -7,22 +7,33 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 +# Supported ROCKY_VERSION's are 8/9/10 +ARG ROCKY_VERSION=9 + # Base Image -FROM rockylinux:9 +FROM rockylinux/rockylinux:${ROCKY_VERSION} + +# Define the ARG again after FROM to use it in this stage +ARG ROCKY_VERSION # Install NGINX Plus and F5 WAF for NGINX v5 module RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - dnf -y install wget ca-certificates \ + if [ "${ROCKY_VERSION}" = "8" ]; then \ + NGINX_PLUS_REPO="nginx-plus-${ROCKY_VERSION}.repo"; \ + else \ + NGINX_PLUS_REPO="plus-${ROCKY_VERSION}.repo"; \ + fi \ + && dnf -y install wget ca-certificates \ && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/${NGINX_PLUS_REPO} \ - && echo "[app-protect-x-plus]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/${UBI_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ + && echo "[app-protect-x-plus]" > /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/${ROCKY_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ && dnf clean all \ && dnf install -y app-protect-module-plus \ && dnf clean all \ diff --git a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rocky9-plus.md b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rocky9-plus.md deleted file mode 100644 index 7f1fbd07a2..0000000000 --- a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/rocky9-plus.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -f5-files: -- content/waf/install/docker.md -- content/waf/install/kubernetes.md ---- - -```dockerfile -# syntax=docker/dockerfile:1 - -# Base Image -FROM rockylinux:9 - -# Install NGINX Plus and F5 WAF for NGINX v5 module -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - dnf -y install wget ca-certificates \ - && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ - && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/${NGINX_PLUS_REPO} \ - && echo "[app-protect-x-plus]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/${UBI_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && dnf clean all \ - && dnf install -y app-protect-module-plus \ - && dnf clean all \ - && rm -rf /var/cache/dnf \ - && ln -sf /dev/stdout /var/log/nginx/access.log \ - && ln -sf /dev/stderr /var/log/nginx/error.log - -# Expose port -EXPOSE 80 - -# Define stop signal -STOPSIGNAL SIGQUIT - -# Set default command -CMD ["nginx", "-g", "daemon off;"] -``` diff --git a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/ubuntu-plus.md b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/ubuntu-plus.md index 5e391e9edd..3618212f73 100644 --- a/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/ubuntu-plus.md +++ b/content/includes/waf/dockerfiles/nginx-plus-without-jwt-mount/ubuntu-plus.md @@ -7,7 +7,7 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 -# Supported OS_CODENAME's are: focal/jammy +# Supported OS_CODENAME's are: jammy/noble/resolute ARG OS_CODENAME=jammy # Base image diff --git a/content/includes/waf/dockerfiles/rocky9-oss.md b/content/includes/waf/dockerfiles/rhel-oss.md similarity index 91% rename from content/includes/waf/dockerfiles/rocky9-oss.md rename to content/includes/waf/dockerfiles/rhel-oss.md index fc21d0a2b8..9be220ea20 100644 --- a/content/includes/waf/dockerfiles/rocky9-oss.md +++ b/content/includes/waf/dockerfiles/rhel-oss.md @@ -8,8 +8,14 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 +# Supported UBI_VERSION's are 8/9/10 +ARG UBI_VERSION=9 + # Base Image -FROM rockylinux:9 +FROM registry.access.redhat.com/ubi${UBI_VERSION}/ubi + +# Define the ARG again after FROM to use it in this stage +ARG UBI_VERSION # Install NGINX OSS and F5 WAF for NGINX v5 module RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ @@ -45,4 +51,4 @@ STOPSIGNAL SIGQUIT # Set default command CMD ["nginx", "-g", "daemon off;"] -``` \ No newline at end of file +``` diff --git a/content/includes/waf/dockerfiles/rhel9-plus.md b/content/includes/waf/dockerfiles/rhel-plus.md similarity index 81% rename from content/includes/waf/dockerfiles/rhel9-plus.md rename to content/includes/waf/dockerfiles/rhel-plus.md index 64a3964907..719d1e4715 100644 --- a/content/includes/waf/dockerfiles/rhel9-plus.md +++ b/content/includes/waf/dockerfiles/rhel-plus.md @@ -8,13 +8,24 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 +# Supported UBI_VERSION's are 8/9/10 +ARG UBI_VERSION=9 + # Base Image -FROM rockylinux:9 +FROM registry.access.redhat.com/ubi${UBI_VERSION}/ubi + +# Define the ARG again after FROM to use it in this stage +ARG UBI_VERSION # Install NGINX Plus and F5 WAF for NGINX v5 module RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - dnf -y install wget ca-certificates \ + if [ "${UBI_VERSION}" = "8" ]; then \ + NGINX_PLUS_REPO="nginx-plus-${UBI_VERSION}.repo"; \ + else \ + NGINX_PLUS_REPO="plus-${UBI_VERSION}.repo"; \ + fi \ + && dnf -y install wget ca-certificates \ && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/${NGINX_PLUS_REPO} \ && echo "[app-protect-x-plus]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ diff --git a/content/includes/waf/dockerfiles/rhel8-oss.md b/content/includes/waf/dockerfiles/rhel8-oss.md deleted file mode 100644 index 7783f2cab6..0000000000 --- a/content/includes/waf/dockerfiles/rhel8-oss.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -f5-product: F5 WAF for NGINX -f5-files: -- content/waf/install/docker.md -- content/waf/install/kubernetes.md ---- - -```dockerfile -# syntax=docker/dockerfile:1 - -# Supported UBI_VERSION's are 7/8/9 -ARG UBI_VERSION=8 - -# Base Image -FROM registry.access.redhat.com/ubi${UBI_VERSION}/ubi - -# Define the ARG again after FROM to use it in this stage -ARG UBI_VERSION - -# Install NGINX OSS and F5 WAF for NGINX v5 module -RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ - --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - PKG_MANAGER=dnf; \ - if [ "${UBI_VERSION}" = "7" ]; then \ - PKG_MANAGER=yum; \ - fi \ - && $PKG_MANAGER -y install wget ca-certificates yum-utils \ - && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ - && echo "[nginx-mainline]" > /etc/yum.repos.d/nginx.repo \ - && echo "name=nginx mainline repo" >> /etc/yum.repos.d/nginx.repo \ - && echo "baseurl=http://nginx.org/packages/mainline/centos/\$releasever/\$basearch/" >> /etc/yum.repos.d/nginx.repo \ - && echo "gpgcheck=1" >> /etc/yum.repos.d/nginx.repo \ - && echo "enabled=1" >> /etc/yum.repos.d/nginx.repo \ - && echo "gpgkey=https://nginx.org/keys/nginx_signing.key" >> /etc/yum.repos.d/nginx.repo \ - && echo "module_hotfixes=true" >> /etc/yum.repos.d/nginx.repo \ - && echo "[app-protect-x-oss]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "baseurl=https://pkgs.nginx.com/app-protect-x-oss/centos/${UBI_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && $PKG_MANAGER clean all \ - && $PKG_MANAGER install -y app-protect-module-oss \ - && $PKG_MANAGER clean all \ - && rm -rf /var/cache/$PKG_MANAGER \ - && ln -sf /dev/stdout /var/log/nginx/access.log \ - && ln -sf /dev/stderr /var/log/nginx/error.log - -# Expose port -EXPOSE 80 - -# Define stop signal -STOPSIGNAL SIGQUIT - -# Set default command -CMD ["nginx", "-g", "daemon off;"] -``` \ No newline at end of file diff --git a/content/includes/waf/dockerfiles/rhel9-oss.md b/content/includes/waf/dockerfiles/rocky-oss.md similarity index 64% rename from content/includes/waf/dockerfiles/rhel9-oss.md rename to content/includes/waf/dockerfiles/rocky-oss.md index 7783f2cab6..685a479e18 100644 --- a/content/includes/waf/dockerfiles/rhel9-oss.md +++ b/content/includes/waf/dockerfiles/rocky-oss.md @@ -8,23 +8,19 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 -# Supported UBI_VERSION's are 7/8/9 -ARG UBI_VERSION=8 +# Supported ROCKY_VERSION's are 8/9/10 +ARG ROCKY_VERSION=9 # Base Image -FROM registry.access.redhat.com/ubi${UBI_VERSION}/ubi +FROM rockylinux/rockylinux:${ROCKY_VERSION} # Define the ARG again after FROM to use it in this stage -ARG UBI_VERSION +ARG ROCKY_VERSION # Install NGINX OSS and F5 WAF for NGINX v5 module RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - PKG_MANAGER=dnf; \ - if [ "${UBI_VERSION}" = "7" ]; then \ - PKG_MANAGER=yum; \ - fi \ - && $PKG_MANAGER -y install wget ca-certificates yum-utils \ + dnf -y install wget ca-certificates yum-utils \ && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ && echo "[nginx-mainline]" > /etc/yum.repos.d/nginx.repo \ && echo "name=nginx mainline repo" >> /etc/yum.repos.d/nginx.repo \ @@ -33,17 +29,17 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 && echo "enabled=1" >> /etc/yum.repos.d/nginx.repo \ && echo "gpgkey=https://nginx.org/keys/nginx_signing.key" >> /etc/yum.repos.d/nginx.repo \ && echo "module_hotfixes=true" >> /etc/yum.repos.d/nginx.repo \ - && echo "[app-protect-x-oss]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "baseurl=https://pkgs.nginx.com/app-protect-x-oss/centos/${UBI_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-oss.repo \ - && $PKG_MANAGER clean all \ - && $PKG_MANAGER install -y app-protect-module-oss \ - && $PKG_MANAGER clean all \ - && rm -rf /var/cache/$PKG_MANAGER \ + && echo "[app-protect-x-oss]" > /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-oss.repo \ + && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-oss.repo \ + && echo "baseurl=https://pkgs.nginx.com/app-protect-x-oss/centos/${ROCKY_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-oss.repo \ + && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-oss.repo \ + && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-oss.repo \ + && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-oss.repo \ + && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-oss.repo \ + && dnf clean all \ + && dnf install -y app-protect-module-oss \ + && dnf clean all \ + && rm -rf /var/cache/dnf \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log @@ -55,4 +51,4 @@ STOPSIGNAL SIGQUIT # Set default command CMD ["nginx", "-g", "daemon off;"] -``` \ No newline at end of file +``` diff --git a/content/includes/waf/dockerfiles/rhel8-plus.md b/content/includes/waf/dockerfiles/rocky-plus.md similarity index 55% rename from content/includes/waf/dockerfiles/rhel8-plus.md rename to content/includes/waf/dockerfiles/rocky-plus.md index 72c120608b..015cdc007d 100644 --- a/content/includes/waf/dockerfiles/rhel8-plus.md +++ b/content/includes/waf/dockerfiles/rocky-plus.md @@ -8,41 +8,37 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 -# Supported UBI_VERSION's are 7/8/9 -ARG UBI_VERSION=8 +# Supported ROCKY_VERSION's are 8/9/10 +ARG ROCKY_VERSION=9 # Base Image -FROM registry.access.redhat.com/ubi${UBI_VERSION}/ubi +FROM rockylinux/rockylinux:${ROCKY_VERSION} # Define the ARG again after FROM to use it in this stage -ARG UBI_VERSION +ARG ROCKY_VERSION # Install NGINX Plus and F5 WAF for NGINX v5 module RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - PKG_MANAGER=dnf; \ - if [ "${UBI_VERSION}" = "7" ]; then \ - PKG_MANAGER=yum; \ - NGINX_PLUS_REPO="nginx-plus-7.4.repo"; \ - elif [ "${UBI_VERSION}" = "9" ]; then \ - NGINX_PLUS_REPO="plus-${UBI_VERSION}.repo"; \ + if [ "${ROCKY_VERSION}" = "8" ]; then \ + NGINX_PLUS_REPO="nginx-plus-${ROCKY_VERSION}.repo"; \ else \ - NGINX_PLUS_REPO="nginx-plus-${UBI_VERSION}.repo"; \ + NGINX_PLUS_REPO="plus-${ROCKY_VERSION}.repo"; \ fi \ - && $PKG_MANAGER -y install wget ca-certificates \ + && dnf -y install wget ca-certificates \ && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/${NGINX_PLUS_REPO} \ - && echo "[app-protect-x-plus]" > /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/${UBI_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${UBI_VERSION}-x-plus.repo \ - && $PKG_MANAGER clean all \ - && $PKG_MANAGER install -y app-protect-module-plus \ - && $PKG_MANAGER clean all \ - && rm -rf /var/cache/$PKG_MANAGER \ + && echo "[app-protect-x-plus]" > /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "name=nginx-app-protect repo" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/${ROCKY_VERSION}/\$basearch/" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "sslclientcert=/etc/ssl/nginx/nginx-repo.crt" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "sslclientkey=/etc/ssl/nginx/nginx-repo.key" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "gpgcheck=0" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && echo "enabled=1" >> /etc/yum.repos.d/app-protect-${ROCKY_VERSION}-x-plus.repo \ + && dnf clean all \ + && dnf install -y app-protect-module-plus \ + && dnf clean all \ + && rm -rf /var/cache/dnf \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log diff --git a/content/includes/waf/dockerfiles/ubuntu-oss.md b/content/includes/waf/dockerfiles/ubuntu-oss.md index 233c0ecc70..b64fe04e30 100644 --- a/content/includes/waf/dockerfiles/ubuntu-oss.md +++ b/content/includes/waf/dockerfiles/ubuntu-oss.md @@ -8,7 +8,7 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 -# Supported OS_CODENAME's are: focal/jammy +# Supported OS_CODENAME's are: jammy/noble/resolute ARG OS_CODENAME=jammy # Base image @@ -39,7 +39,7 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 tee /etc/apt/sources.list.d/nginx-app-protect.list \ && wget -P /etc/apt/apt.conf.d https://cs.nginx.com/static/files/90pkgs-nginx \ && apt-get update \ - && DEBIAN_FRONTEND="noninteractive" apt-get install -y nginx=1.25.5-1~`lsb_release -cs` app-protect-module-oss \ + && DEBIAN_FRONTEND="noninteractive" apt-get install -y nginx=1.31.3-1~`lsb_release -cs` app-protect-module-oss \ && ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log \ && apt-get clean \ diff --git a/content/includes/waf/dockerfiles/ubuntu-plus.md b/content/includes/waf/dockerfiles/ubuntu-plus.md index a7da4ded36..cbce8f86d3 100644 --- a/content/includes/waf/dockerfiles/ubuntu-plus.md +++ b/content/includes/waf/dockerfiles/ubuntu-plus.md @@ -8,7 +8,7 @@ f5-files: ```dockerfile # syntax=docker/dockerfile:1 -# Supported OS_CODENAME's are: focal/jammy +# Supported OS_CODENAME's are: jammy/noble/resolute ARG OS_CODENAME=jammy # Base image diff --git a/content/includes/waf/install-services-compose.md b/content/includes/waf/install-services-compose.md index 076b9a46d5..9cfce224fc 100644 --- a/content/includes/waf/install-services-compose.md +++ b/content/includes/waf/install-services-compose.md @@ -10,7 +10,7 @@ Create a _docker-compose.yml_ file with the following contents in your host envi services: waf-enforcer: container_name: waf-enforcer - image: waf-enforcer:5.2.0 + image: waf-enforcer:{{< version-waf-enforcer >}} environment: - ENFORCER_PORT=50000 ports: @@ -23,7 +23,7 @@ services: waf-config-mgr: container_name: waf-config-mgr - image: waf-config-mgr:5.2.0 + image: waf-config-mgr:{{< version-waf-config-mgr >}} volumes: - /opt/app_protect/bd_config:/opt/app_protect/bd_config - /opt/app_protect/config:/opt/app_protect/config diff --git a/content/includes/waf/install-services-images.md b/content/includes/waf/install-services-images.md index 8ebd4a93da..26ffd4daa9 100644 --- a/content/includes/waf/install-services-images.md +++ b/content/includes/waf/install-services-images.md @@ -4,11 +4,9 @@ f5-files: - content/waf/install/docker.md --- -Download the `waf-enforcer` and `waf-config-mgr` images. - -Replace `5.2.0` with the release version you are deploying. +Download the `waf-enforcer` and `waf-config-mgr` images. ```shell -docker pull private-registry.nginx.com/nap/waf-enforcer:5.2.0 -docker pull private-registry.nginx.com/nap/waf-config-mgr:5.2.0 +docker pull private-registry.nginx.com/nap/waf-enforcer:{{< version-waf-enforcer >}} +docker pull private-registry.nginx.com/nap/waf-config-mgr:{{< version-waf-config-mgr >}} ``` \ No newline at end of file diff --git a/content/waf/changelog/_index.md b/content/waf/changelog/_index.md index a04e555bec..72fdac831a 100644 --- a/content/waf/changelog/_index.md +++ b/content/waf/changelog/_index.md @@ -13,6 +13,44 @@ This changelog lists all of the information for F5 WAF for NGINX releases in 202 For older releases, check the changelogs for previous years: [2025]({{< ref "/waf/changelog/2025.md" >}}), [2024]({{< ref "/waf/changelog/2024.md" >}}), [2023]({{< ref "/waf/changelog/2023.md" >}}). +## F5 WAF for NGINX 5.14 + +Released _July 31st, 2026_. + +### New features + +- Added support for Rocky Linux 10 +- Added support for Ubuntu 26.04 (Resolute Raccoon) +- Upgraded the Go compiler to 1.26.5 + +### Resolved issues + +- 14828 - Added `SECURITY_WAF_VIOLATION_TRANSPARENT` to the `$app_protect_outcome_reason` access log variable for parity with the security log +- 14924 - Fixed an out-of-memory condition when logging to a file on a memory-backed (tmpfs) mount +- 14990 - Fixed defunct (zombie) `cp` processes and race conditions during NGINX configuration reload +- Security hardening across the BD core and parsers + +### Packages + +{{< table >}} + +| Distribution name | NGINX Open Source (5.14) | NGINX Plus (5.14) | NGINX Plus (5.14) | +| ------------------------------ | ----------------------------------------------------------------------- | -------------------------------------------------------------------- | --------------------------------------------------------- | +| Alpine 3.22 | _app-protect-module-oss-1.31.3+5.690.0-r1.apk_ | _app-protect-module-plus-37.0.5.690.0-r1.apk_ | _app-protect-37.0.5.690.0-r1.apk_ | +| Amazon Linux 2023 | _app-protect-module-oss-1.31.3+5.690.0-1.amzn2023.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.690.0-1.amzn2023.ngx.x86_64.rpm_ | _app-protect-37.0+5.690.0-1.amzn2023.ngx.x86_64.rpm_ | +| Debian 11 | _app-protect-module-oss_1.31.3+5.690.0-1\~bullseye_amd64.deb_ | _app-protect-module-plus_37.0+5.690.0-1\~bullseye_amd64.deb_ | _app-protect_37.0+5.690.0-1\~bullseye_amd64.deb_ | +| Debian 12 | _app-protect-module-oss_1.31.3+5.690.0-1\~bookworm_amd64.deb_ | _app-protect-module-plus_37.0+5.690.0-1\~bookworm_amd64.deb_ | _app-protect_37.0+5.690.0-1\~bookworm_amd64.deb_ | +| Debian 13 | _app-protect-module-oss_1.31.3+5.690.0-1\~trixie_amd64.deb_ | _app-protect-module-plus_37.0+5.690.0-1\~trixie_amd64.deb_ | _app-protect_37.0+5.690.0-1\~trixie_amd64.deb_ | +| Ubuntu 22.04 | _app-protect-module-oss_1.31.3+5.690.0-1\~jammy_amd64.deb_ | _app-protect-module-plus_37.0+5.690.0-1\~jammy_amd64.deb_ | _app-protect_37.0+5.690.0-1\~jammy_amd64.deb_ | +| Ubuntu 24.04 | _app-protect-module-oss_1.31.3+5.690.0-1\~noble_amd64.deb_ | _app-protect-module-plus_37.0+5.690.0-1\~noble_amd64.deb_ | _app-protect_37.0+5.690.0-1\~noble_amd64.deb_ | +| Ubuntu 26.04 | _app-protect-module-oss_1.31.3+5.690.0-1\~resolute_amd64.deb_ | _app-protect-module-plus_37.0+5.690.0-1\~resolute_amd64.deb_ | _app-protect_37.0+5.690.0-1\~resolute_amd64.deb_ | +| Oracle Linux 8 | _app-protect-module-oss-1.31.3+5.690.0-1.el8.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.690.0-1.el8.ngx.x86_64.rpm_ | _app-protect-37.0+5.690.0-1.el8.ngx.x86_64.rpm_ | +| RHEL 8 and Rocky Linux 8 | _app-protect-module-oss-1.31.3+5.690.0-1.el8.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.690.0-1.el8.ngx.x86_64.rpm_ | _app-protect-37.0+5.690.0-1.el8.ngx.x86_64.rpm_ | +| RHEL 9 and Rocky Linux 9 | _app-protect-module-oss-1.31.3+5.690.0-1.el9.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.690.0-1.el9.ngx.x86_64.rpm_ | _app-protect-37.0+5.690.0-1.el9.ngx.x86_64.rpm_ | +| RHEL 10 and Rocky Linux 10 | _app-protect-module-oss-1.31.3+5.690.0-1.el10.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.690.0-1.el10.ngx.x86_64.rpm_ | _app-protect-37.0+5.690.0-1.el10.ngx.x86_64.rpm_ | + +{{< /table >}} + ## F5 WAF for NGINX 5.13.4 Released _July 15st, 2026_. @@ -101,7 +139,7 @@ Released _May 14th, 2026_. | Oracle Linux 8 | _app-protect-module-oss-1.29.8+5.635.0-1.el8.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.635.0-1.el8.ngx.x86_64.rpm_ | _app-protect-37.0+5.635.0-1.el8.ngx.x86_64.rpm_ | | RHEL 8 and Rocky Linux 8 | _app-protect-module-oss-1.29.8+5.635.0-1.el8.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.635.0-1.el8.ngx.x86_64.rpm_ | _app-protect-37.0+5.635.0-1.el8.ngx.x86_64.rpm_ | | RHEL 9 and Rocky Linux 9 | _app-protect-module-oss-1.29.8+5.635.0-1.el9.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.635.0-1.el9.ngx.x86_64.rpm_ | _app-protect-37.0+5.635.0-1.el9.ngx.x86_64.rpm_ | -| RHEL 10 | _app-protect-module-oss-1.29.8+5.635.0-1.el10.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.635.0-1.el10.ngx.x86_64.rpm_ | _app-protect-37.0+5.635.0-1.el10.ngx.x86_64.rpm_ | +| RHEL 10 and Rocky Linux 10 | _app-protect-module-oss-1.29.8+5.635.0-1.el10.ngx.x86_64.rpm_ | _app-protect-module-plus-37.0+5.635.0-1.el10.ngx.x86_64.rpm_ | _app-protect-37.0+5.635.0-1.el10.ngx.x86_64.rpm_ | {{< /table >}} @@ -118,7 +156,6 @@ Released _March 31th, 2026_. - 14052 - Upgrade Go compiler to 1.26.1 - 14036 - Fix a cookie parser issue - ### Packages {{< table >}} diff --git a/content/waf/fundamentals/technical-specifications.md b/content/waf/fundamentals/technical-specifications.md index 91914d58ba..899538f155 100644 --- a/content/waf/fundamentals/technical-specifications.md +++ b/content/waf/fundamentals/technical-specifications.md @@ -24,14 +24,14 @@ You can deploy F5 WAF for NGINX in the following environments: ## Supported operating systems -| Distribution | Version | -| ------------------ | ------------ | -| Alpine Linux | 3.22 | -| Amazon Linux | 2023 | -| Debian | 11, 12 | -| Oracle Linux | 8 | -| RHEL / Rocky Linux | 8, 9, 10 | -| Ubuntu | 22.04, 24.04 | +| Distribution | Version | +| ------------------ | ------------------- | +| Alpine Linux | 3.22 | +| Amazon Linux | 2023 | +| Debian | 11, 12, 13 | +| Oracle Linux | 8 | +| RHEL / Rocky Linux | 8, 9, 10 | +| Ubuntu | 22.04, 24.04, 26.04 | For release-specific packages, view the [Changelog]({{< ref "/waf/changelog.md" >}}). diff --git a/content/waf/install/disconnected-environment.md b/content/waf/install/disconnected-environment.md index d7778c7275..aa4aa43f04 100644 --- a/content/waf/install/disconnected-environment.md +++ b/content/waf/install/disconnected-environment.md @@ -152,88 +152,16 @@ See the section for your operating system below: apt-get download $(apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances app-protect | grep "^\w" | sort -u) ``` -#### Oracle Linux / RHEL / Rocky Linux 8 +#### Oracle Linux / RHEL / Rocky Linux -1. Add the F5 WAF for NGINX repository: - - ```shell - sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-8.repo - ``` - -1. Install the `yum-utils` package if not already installed: - - ```shell - sudo dnf install yum-utils - ``` - -1. Enable codeready-builder repository through subscription manager: - - ```shell - subscription-manager repos --enable codeready-builder-for-rhel-8-x86_64-rpms - ``` - - 1. Download the `epel-release` dependency package if not already installed: - - ```shell - rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm - ``` - -1. Create a directory for packages and download app-protect: - - ```shell - mkdir -p /offline/packages - - sudo yum install --downloadonly --downloaddir=/offline/packages \ - app-protect \ - app-protect-attack-signatures \ - app-protect-bot-signatures \ - app-protect-threat-campaigns - ``` - -#### RHEL / Rocky Linux 9 - -1. Add the F5 WAF for NGINX repository: - - ```shell - sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-9.repo - ``` - -1. Install the `yum-utils` package if not already installed: - - ```shell - sudo dnf install yum-utils - ``` - -1. Enable codeready-builder repository through subscription manager: - - ```shell - subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms - ``` - -1. Download the `epel-release` dependency package if not already installed: - - ```shell - rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm - ``` - -1. Create a directory for packages and download app-protect: - - ```shell - mkdir -p /offline/packages - - sudo yum install --downloadonly --downloaddir=/offline/packages \ - app-protect \ - app-protect-attack-signatures \ - app-protect-bot-signatures \ - app-protect-threat-campaigns - ``` - -#### RHEL 10 +{{< call-out class="note" title="Note" >}} +The steps are identical for Oracle Linux, RHEL, and Rocky Linux. In the commands below, replace `` with your operating system major version: `8`, `9`, or `10`. +{{< /call-out >}} 1. Add the F5 WAF for NGINX repository: ```shell - sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-10.repo + sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-.repo ``` 1. Install the `yum-utils` package if not already installed: @@ -245,13 +173,13 @@ See the section for your operating system below: 1. Enable codeready-builder repository through subscription manager: ```shell - subscription-manager repos --enable codeready-builder-for-rhel-10-x86_64-rpms + subscription-manager repos --enable codeready-builder-for-rhel--x86_64-rpms ``` 1. Download the `epel-release` dependency package if not already installed: ```shell - rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm + rpm -ivh https://dl.fedoraproject.org/pub/epel/epel-release-latest-.noarch.rpm ``` 1. Create a directory for packages and download app-protect: @@ -320,7 +248,7 @@ In the disconnected environment, install the packages: apk add --allow-untrusted app-protect*.apk nginx-plus*.apk ``` -- For Amazon Linux 2023, RHEL 9, Rocky Linux 9 +- For Amazon Linux 2023, RHEL 9, Rocky Linux 9, RHEL 10, Rocky Linux 10 ```shell cd /offline diff --git a/content/waf/install/docker.md b/content/waf/install/docker.md index cc1ffb9ac6..e251bc4983 100644 --- a/content/waf/install/docker.md +++ b/content/waf/install/docker.md @@ -271,55 +271,49 @@ If you are not using `custom_log_format.json` or the IP intelligence feature, yo {{< /tabs >}} -#### RHEL 8 - -{{< tabs name="rhel8-instructions" >}} - -{{% tab name="NGINX Open Source" %}} - -{{< include "/waf/dockerfiles/rhel8-oss.md" >}} - -{{% /tab %}} +#### RHEL 8, 9, and 10 -{{% tab name="NGINX Plus" %}} - -{{< include "/waf/dockerfiles/rhel8-plus.md" >}} - -{{% /tab %}} +{{< call-out class="important" >}} -{{< /tabs >}} +The steps are identical for RHEL 8, 9, and 10. In the Dockerfile below, set the `UBI_VERSION` argument to your operating system major version: `8`, `9`, or `10`. -#### RHEL 9 +{{< /call-out >}} -{{< tabs name="rhel9-instructions" >}} +{{< tabs name="rhel-instructions" >}} {{% tab name="NGINX Open Source" %}} -{{< include "/waf/dockerfiles/rhel9-oss.md" >}} +{{< include "/waf/dockerfiles/rhel-oss.md" >}} {{% /tab %}} {{% tab name="NGINX Plus" %}} -{{< include "/waf/dockerfiles/rhel9-plus.md" >}} +{{< include "/waf/dockerfiles/rhel-plus.md" >}} {{% /tab %}} {{< /tabs >}} -#### Rocky Linux 9 +#### Rocky Linux 8, 9, and 10 + +{{< call-out class="important" >}} + +The steps are identical for Rocky Linux 8, 9, and 10. In the Dockerfile below, set the `ROCKY_VERSION` argument to your operating system major version: `8`, `9`, or `10`. + +{{< /call-out >}} {{< tabs name="rocky-instructions" >}} {{% tab name="NGINX Open Source" %}} -{{< include "/waf/dockerfiles/rocky9-oss.md" >}} +{{< include "/waf/dockerfiles/rocky-oss.md" >}} {{% /tab %}} {{% tab name="NGINX Plus" %}} -{{< include "/waf/dockerfiles/rocky9-plus.md" >}} +{{< include "/waf/dockerfiles/rocky-plus.md" >}} {{% /tab %}} @@ -717,15 +711,15 @@ sudo apt-get install app-protect-module-plus {{< /tabs >}} -#### Oracle Linux / RHEL / Rocky Linux 8 +#### Oracle Linux / RHEL / Rocky Linux {{< call-out class="important" >}} -The steps are identical for these platforms due to their similar architecture. +The steps are identical for Oracle Linux, RHEL, and Rocky Linux. In the following commands, replace `` with your operating system major version: `8`, `9`, or `10`. {{< /call-out >}} -{{< tabs name="oracle-hybrid-instructions" >}} +{{< tabs name="rhel-hybrid-instructions" >}} {{% tab name="NGINX Open Source" %}} @@ -736,7 +730,7 @@ Create a file for the F5 WAF for NGINX repository: ```shell [app-protect-x-oss] name=nginx-app-protect repo -baseurl=https://pkgs.nginx.com/app-protect-x-oss/centos/7/$basearch/ +baseurl=https://pkgs.nginx.com/app-protect-x-oss/centos//$basearch/ sslclientcert=/etc/ssl/nginx/nginx-repo.crt sslclientkey=/etc/ssl/nginx/nginx-repo.key gpgcheck=0 @@ -746,7 +740,7 @@ enabled=1 Install the F5 WAF for NGINX package and its dependencies: ```shell -sudo yum install app-protect-module-oss +sudo dnf install app-protect-module-oss ``` {{% /tab %}} @@ -760,7 +754,7 @@ Create a file for the F5 WAF for NGINX repository: ```shell [app-protect-x-plus] name=nginx-app-protect repo -baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/8/$basearch/ +baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos//$basearch/ sslclientcert=/etc/ssl/nginx/nginx-repo.crt sslclientkey=/etc/ssl/nginx/nginx-repo.key gpgcheck=0 @@ -821,114 +815,6 @@ sudo apt-get install app-protect-module-plus {{< /tabs >}} -#### RHEL / Rocky Linux 9 - -{{< tabs name="rhel-hybrid-instructions" >}} - -{{% tab name="NGINX Open Source" %}} - -Create a file for the F5 WAF for NGINX repository: - -`/etc/yum.repos.d/app-protect-x-oss.repo` - -```shell -[app-protect-x-oss] -name=nginx-app-protect repo -baseurl=https://pkgs.nginx.com/app-protect-x-oss/centos/9/$basearch/ -sslclientcert=/etc/ssl/nginx/nginx-repo.crt -sslclientkey=/etc/ssl/nginx/nginx-repo.key -gpgcheck=0 -enabled=1 -``` - -Install the F5 WAF for NGINX package and its dependencies: - -```shell -sudo dnf install app-protect-module-oss -``` - -{{% /tab %}} - -{{% tab name="NGINX Plus" %}} - -Create a file for the F5 WAF for NGINX repository: - -`/etc/yum.repos.d/app-protect-x-plus.repo` - -```shell -[app-protect-x-plus] -name=nginx-app-protect repo -baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/9/$basearch/ -sslclientcert=/etc/ssl/nginx/nginx-repo.crt -sslclientkey=/etc/ssl/nginx/nginx-repo.key -gpgcheck=0 -enabled=1 -``` - -Install the F5 WAF for NGINX package and its dependencies: - -```shell -sudo dnf install app-protect-module-plus -``` - -{{% /tab %}} - -{{< /tabs >}} - -#### RHEL 10 - -{{< tabs name="rhel10-hybrid-instructions" >}} - -{{% tab name="NGINX Open Source" %}} - -Create a file for the F5 WAF for NGINX repository: - -`/etc/yum.repos.d/app-protect-x-oss.repo` - -```shell -[app-protect-x-oss] -name=nginx-app-protect repo -baseurl=https://pkgs.nginx.com/app-protect-x-oss/centos/10/$basearch/ -sslclientcert=/etc/ssl/nginx/nginx-repo.crt -sslclientkey=/etc/ssl/nginx/nginx-repo.key -gpgcheck=0 -enabled=1 -``` - -Install the F5 WAF for NGINX package and its dependencies: - -```shell -sudo dnf install app-protect-module-oss -``` - -{{% /tab %}} - -{{% tab name="NGINX Plus" %}} - -Create a file for the F5 WAF for NGINX repository: - -`/etc/yum.repos.d/app-protect-x-plus.repo` - -```shell -[app-protect-x-plus] -name=nginx-app-protect repo -baseurl=https://pkgs.nginx.com/app-protect-x-plus/centos/10/$basearch/ -sslclientcert=/etc/ssl/nginx/nginx-repo.crt -sslclientkey=/etc/ssl/nginx/nginx-repo.key -gpgcheck=0 -enabled=1 -``` - -Install the F5 WAF for NGINX package and its dependencies: - -```shell -sudo dnf install app-protect-module-plus -``` - -{{% /tab %}} - -{{< /tabs >}} - ### Configure Docker {{< include "waf/install-services-docker.md" >}} @@ -1136,9 +1022,9 @@ CMD ["sh", "/root/entrypoint.sh"] ```dockerfile ARG OS_CODENAME -# Where OS_CODENAME can be: buster/bullseye/bookworm +# Where OS_CODENAME can be: bullseye/bookworm/trixie # syntax=docker/dockerfile:1 -# For Debian 11 / 12: +# For Debian 11 / 12 / 13: FROM debian:${OS_CODENAME} # Install prerequisite packages: @@ -1292,25 +1178,24 @@ CMD ["sh", "/root/entrypoint.sh"] ```dockerfile # syntax=docker/dockerfile:1 -# For Rocky Linux 9: -FROM rockylinux:9 +# For RHEL ubi9: +FROM registry.access.redhat.com/ubi9/ubi # Install prerequisite packages: -RUN dnf -y install wget ca-certificates 'dnf-command(config-manager)' +RUN dnf -y install wget ca-certificates # Add NGINX Plus repo to Yum: RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/plus-9.repo # Add NGINX App-protect & dependencies repo to Yum: RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-9.repo -RUN dnf config-manager --set-enabled crb \ - && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ +RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ && dnf clean all # Install F5 WAF for NGINX: RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ - dnf install -y app-protect \ + dnf install --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms -y app-protect \ && dnf clean all \ && rm -rf /var/cache/dnf @@ -1319,14 +1204,59 @@ RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ dnf install -y app-protect-ip-intelligence +# Securely copy the JWT license: +RUN --mount=type=secret,id=license-jwt,dst=license.jwt \ + cp license.jwt /etc/nginx/license.jwt + # Forward request logs to Docker log collector: RUN ln -sf /dev/stdout /var/log/nginx/access.log \ && ln -sf /dev/stderr /var/log/nginx/error.log +# Copy configuration files: +COPY nginx.conf custom_log_format.json /etc/nginx/ +COPY entrypoint.sh /root/ + +CMD ["sh", "/root/entrypoint.sh"] +``` + +#### RHEL 10 + +```dockerfile +# syntax=docker/dockerfile:1 +# For RHEL ubi10: +FROM registry.access.redhat.com/ubi10/ubi + +# Install prerequisite packages: +RUN dnf -y install wget ca-certificates + +# Add NGINX Plus repo to Yum: +RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/plus-10.repo + +# Add NGINX App-protect & dependencies repo to Yum: +RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-10.repo +RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ + && dnf clean all + +# Install F5 WAF for NGINX: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf install --enablerepo=codeready-builder-for-rhel-10-x86_64-rpms -y app-protect \ + && dnf clean all \ + && rm -rf /var/cache/dnf + +# Only use if you want to install and use the IP intelligence feature: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf install -y app-protect-ip-intelligence + # Securely copy the JWT license: RUN --mount=type=secret,id=license-jwt,dst=license.jwt \ cp license.jwt /etc/nginx/license.jwt +# Forward request logs to Docker log collector: +RUN ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log + # Copy configuration files: COPY nginx.conf custom_log_format.json /etc/nginx/ COPY entrypoint.sh /root/ @@ -1380,13 +1310,59 @@ COPY entrypoint.sh /root/ CMD ["sh", "/root/entrypoint.sh"] ``` +#### Rocky Linux 10 + +```dockerfile +# syntax=docker/dockerfile:1 +# For Rocky Linux 10: +FROM rockylinux/rockylinux:10 + +# Install prerequisite packages: +RUN dnf -y install wget ca-certificates 'dnf-command(config-manager)' + +# Add NGINX Plus repo to Yum: +RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/plus-10.repo + +# Add NGINX App-protect & dependencies repo to Yum: +RUN wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-10.repo +RUN dnf config-manager --set-enabled crb \ + && wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo \ + && dnf clean all + +# Install F5 WAF for NGINX: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf install -y app-protect \ + && dnf clean all \ + && rm -rf /var/cache/dnf + +# Only use if you want to install and use the IP intelligence feature: +RUN --mount=type=secret,id=nginx-crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode=0644 \ + --mount=type=secret,id=nginx-key,dst=/etc/ssl/nginx/nginx-repo.key,mode=0644 \ + dnf install -y app-protect-ip-intelligence + +# Securely copy the JWT license: +RUN --mount=type=secret,id=license-jwt,dst=license.jwt \ + cp license.jwt /etc/nginx/license.jwt + +# Forward request logs to Docker log collector: +RUN ln -sf /dev/stdout /var/log/nginx/access.log \ + && ln -sf /dev/stderr /var/log/nginx/error.log + +# Copy configuration files: +COPY nginx.conf custom_log_format.json /etc/nginx/ +COPY entrypoint.sh /root/ + +CMD ["sh", "/root/entrypoint.sh"] +``` + #### Ubuntu ```dockerfile ARG OS_CODENAME -# Where OS_CODENAME can be: focal/jammy/noble +# Where OS_CODENAME can be: jammy/noble/resolute # syntax=docker/dockerfile:1 -# For Ubuntu 20.04 / 22.04 / 24.04: +# For Ubuntu 22.04 / 24.04 / 26.04: FROM ubuntu:${OS_CODENAME} # Install prerequisite packages: diff --git a/content/waf/install/kubernetes.md b/content/waf/install/kubernetes.md index 5cf6ab5892..819b4ee8bd 100644 --- a/content/waf/install/kubernetes.md +++ b/content/waf/install/kubernetes.md @@ -139,55 +139,45 @@ If you are not using `custom_log_format.json` or the IP intelligence feature, yo {{< /tabs >}} -### RHEL 8 +### RHEL 8, 9, and 10 -{{< tabs name="rhel8-instructions" >}} - -{{% tab name="NGINX Open Source" %}} - -{{< include "/waf/dockerfiles/rhel8-oss.md" >}} - -{{% /tab %}} - -{{% tab name="NGINX Plus" %}} - -{{< include "/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel8-plus.md" >}} - -{{% /tab %}} - -{{< /tabs >}} - -### RHEL 9 +{{< call-out class="important" >}} +The steps are identical for RHEL 8, 9, and 10. In the Dockerfile, set the `UBI_VERSION` argument to your operating system major version: `8`, `9`, or `10`. +{{< /call-out >}} -{{< tabs name="rhel9-instructions" >}} +{{< tabs name="rhel-instructions" >}} {{% tab name="NGINX Open Source" %}} -{{< include "/waf/dockerfiles/rhel9-oss.md" >}} +{{< include "/waf/dockerfiles/rhel-oss.md" >}} {{% /tab %}} {{% tab name="NGINX Plus" %}} -{{< include "/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel9-plus.md" >}} +{{< include "/waf/dockerfiles/nginx-plus-without-jwt-mount/rhel-plus.md" >}} {{% /tab %}} {{< /tabs >}} -### Rocky Linux 9 +### Rocky Linux 8, 9, and 10 + +{{< call-out class="important" >}} +The steps are identical for Rocky Linux 8, 9, and 10. In the Dockerfile, set the `ROCKY_VERSION` argument to your operating system major version: `8`, `9`, or `10`. +{{< /call-out >}} {{< tabs name="rocky-instructions" >}} {{% tab name="NGINX Open Source" %}} -{{< include "/waf/dockerfiles/rocky9-oss.md" >}} +{{< include "/waf/dockerfiles/rocky-oss.md" >}} {{% /tab %}} {{% tab name="NGINX Plus" %}} -{{< include "/waf/dockerfiles/nginx-plus-without-jwt-mount/rocky9-plus.md" >}} +{{< include "/waf/dockerfiles/nginx-plus-without-jwt-mount/rocky-plus.md" >}} {{% /tab %}} @@ -464,7 +454,7 @@ spec: - name: app-protect-config mountPath: /opt/app_protect/config - name: waf-enforcer - image: private-registry.nginx.com/nap/waf-enforcer: + image: private-registry.nginx.com/nap/waf-enforcer:{{< version-waf-enforcer >}} imagePullPolicy: IfNotPresent env: - name: ENFORCER_PORT @@ -473,7 +463,7 @@ spec: - name: app-protect-bd-config mountPath: /opt/app_protect/bd_config - name: waf-config-mgr - image: private-registry.nginx.com/nap/waf-config-mgr: + image: private-registry.nginx.com/nap/waf-config-mgr:{{< version-waf-config-mgr >}} imagePullPolicy: IfNotPresent securityContext: allowPrivilegeEscalation: false diff --git a/content/waf/install/virtual-environment.md b/content/waf/install/virtual-environment.md index ecd57ef773..d0cad1d375 100644 --- a/content/waf/install/virtual-environment.md +++ b/content/waf/install/virtual-environment.md @@ -154,18 +154,18 @@ findDeps app-protect= {{< /details >}} -### Oracle Linux / RHEL / Rocky Linux 8 +### Oracle Linux / RHEL / Rocky Linux {{< call-out class="important" >}} -The steps are identical for these platforms due to their similar architecture. +The steps are identical for Oracle Linux, RHEL, and Rocky Linux. In the commands below, replace `` with your operating system major version: `8`, `9`, or `10`. {{< /call-out >}} Add the F5 WAF for NGINX repository: ```shell -sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-8.repo +sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-.repo ``` Add F5 WAF for NGINX dependencies: @@ -180,7 +180,7 @@ Enable F5 WAF for NGINX dependencies: sudo dnf config-manager --set-enabled crb ``` -Enable the _ol8_codeready_builder_ repository: +On Oracle Linux 8, also enable the `ol8_codeready_builder` repository: ```shell sudo dnf config-manager --set-enabled ol8_codeready_builder @@ -203,63 +203,6 @@ sudo dnf install app-protect-= {{< /details >}} -### RHEL / Rocky Linux 9 - -Add the F5 WAF for NGINX repository: - -```shell -sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-9.repo -``` - -Add F5 WAF for NGINX dependencies: - -```shell -sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo -``` - -Enable F5 WAF for NGINX dependencies: - -```shell -sudo dnf config-manager --set-enabled crb -``` - -Install the F5 WAF for NGINX package and its dependencies: - -```shell -sudo dnf install app-protect -``` - -### RHEL 10 - -Add the F5 WAF for NGINX repository: - -```shell -sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/app-protect-10.repo -``` - -Add F5 WAF for NGINX dependencies: - -```shell -sudo wget -P /etc/yum.repos.d https://cs.nginx.com/static/files/dependencies.repo -``` - -Install the F5 WAF for NGINX package and its dependencies: - -```shell -sudo dnf install app-protect -``` - -{{< details summary="Installing a specific version of F5 WAF for NGINX" >}} - -If you need to install a specific version of F5 WAF for NGINX, you can use `--showduplicates list` to list available versions, then append it to the package name: - -```shell -sudo dnf --showduplicates list app-protect -sudo dnf install app-protect-= -``` - -{{< /details >}} - ### Ubuntu Add the F5 WAF for NGINX signing key: diff --git a/content/waf/policies/ip-intelligence.md b/content/waf/policies/ip-intelligence.md index ab40da90d8..8453719033 100644 --- a/content/waf/policies/ip-intelligence.md +++ b/content/waf/policies/ip-intelligence.md @@ -57,7 +57,7 @@ Review the [virtual machine installation instructions]({{< ref "/waf/install/vir | Oracle Linux / RHEL / Rocky Linux 8 | _app-protect-ip-intelligence_ | | Ubuntu | _app-protect-ip-intelligence_ | | RHEL / Rocky Linux 9 | _app-protect-ip-intelligence_ | -| RHEL 10 | _app-protect-ip-intelligence_ | +| RHEL / Rocky Linux 10 | _app-protect-ip-intelligence_ | After installing the package, run the client: diff --git a/layouts/shortcodes/version-waf-compiler.html b/layouts/shortcodes/version-waf-compiler.html index cf51361190..0a70cf03ca 100644 --- a/layouts/shortcodes/version-waf-compiler.html +++ b/layouts/shortcodes/version-waf-compiler.html @@ -1 +1 @@ -5.9.0 \ No newline at end of file +5.14.0 diff --git a/layouts/shortcodes/version-waf-config-mgr.html b/layouts/shortcodes/version-waf-config-mgr.html index cf51361190..0a70cf03ca 100644 --- a/layouts/shortcodes/version-waf-config-mgr.html +++ b/layouts/shortcodes/version-waf-config-mgr.html @@ -1 +1 @@ -5.9.0 \ No newline at end of file +5.14.0 diff --git a/layouts/shortcodes/version-waf-enforcer.html b/layouts/shortcodes/version-waf-enforcer.html index 3b867ccd76..0a70cf03ca 100644 --- a/layouts/shortcodes/version-waf-enforcer.html +++ b/layouts/shortcodes/version-waf-enforcer.html @@ -1 +1 @@ -5.7.0 \ No newline at end of file +5.14.0 diff --git a/layouts/shortcodes/version-waf-ip-intelligence.html b/layouts/shortcodes/version-waf-ip-intelligence.html index cf51361190..0a70cf03ca 100644 --- a/layouts/shortcodes/version-waf-ip-intelligence.html +++ b/layouts/shortcodes/version-waf-ip-intelligence.html @@ -1 +1 @@ -5.9.0 \ No newline at end of file +5.14.0 diff --git a/layouts/shortcodes/version-waf-policy-controller.html b/layouts/shortcodes/version-waf-policy-controller.html index cf51361190..0a70cf03ca 100644 --- a/layouts/shortcodes/version-waf-policy-controller.html +++ b/layouts/shortcodes/version-waf-policy-controller.html @@ -1 +1 @@ -5.9.0 \ No newline at end of file +5.14.0 diff --git a/layouts/shortcodes/version-waf.html b/layouts/shortcodes/version-waf.html index b883184b12..0a70cf03ca 100644 --- a/layouts/shortcodes/version-waf.html +++ b/layouts/shortcodes/version-waf.html @@ -1 +1 @@ -5.9 \ No newline at end of file +5.14.0