diff --git a/import_traefik_waf.py b/import_traefik_waf.py new file mode 100644 index 0000000..5142edc --- /dev/null +++ b/import_traefik_waf.py @@ -0,0 +1,61 @@ +import os +import subprocess +import logging + +logging.basicConfig(level=logging.INFO, format="%(asctime)s - %(levelname)s - %(message)s") + +WAF_DIR = "waf_patterns/traefik" +TRAEFIK_WAF_DIR = "/etc/traefik/waf/" +TRAEFIK_DYNAMIC_CONF = "/etc/traefik/dynamic_conf.toml" +INCLUDE_STATEMENT = '[[http.routers]]\n rule = "PathPrefix(`/`)' + +def copy_waf_files(): + logging.info("Copying Traefik WAF patterns...") + + # Ensure the target directory exists + os.makedirs(TRAEFIK_WAF_DIR, exist_ok=True) + + # Copy middleware and bot files + for file in ["middleware.toml", "bots.toml"]: + src_path = os.path.join(WAF_DIR, file) + dst_path = os.path.join(TRAEFIK_WAF_DIR, file) + + if os.path.exists(src_path): + subprocess.run(["cp", src_path, dst_path], check=True) + logging.info(f"[+] {file} copied to {TRAEFIK_WAF_DIR}") + else: + logging.warning(f"[!] {file} not found in {WAF_DIR}") + +def update_traefik_conf(): + logging.info("Ensuring WAF patterns are referenced in dynamic_conf.toml...") + + # Create dynamic_conf.toml if it doesn't exist + if not os.path.exists(TRAEFIK_DYNAMIC_CONF): + with open(TRAEFIK_DYNAMIC_CONF, "w") as f: + f.write("[http.middlewares]\n") + + # Append middleware reference if not present + with open(TRAEFIK_DYNAMIC_CONF, "r") as f: + config = f.read() + + if INCLUDE_STATEMENT not in config: + logging.info("Adding WAF middleware to dynamic_conf.toml...") + with open(TRAEFIK_DYNAMIC_CONF, "a") as f: + f.write( + f'\n[[http.routers]]\n' + f' rule = "PathPrefix(`/`)"\n' + f' service = "traefik"\n' + f' middlewares = ["bad_bot_block"]\n' + ) + else: + logging.info("WAF middleware already referenced in dynamic_conf.toml.") + +def reload_traefik(): + logging.info("Reloading Traefik to apply new WAF rules...") + subprocess.run(["systemctl", "reload", "traefik"], check=True) + +if __name__ == "__main__": + copy_waf_files() + update_traefik_conf() + reload_traefik() + logging.info("[✔] Traefik configured with latest WAF rules.")