Update ingress.yaml

another test increasing limits
ministryofjustice · Jan 2, 2025 · 5c8fae4 · 5c8fae4
1 parent 04d7d50
commit 5c8fae4
Showing 1 changed file with 25 additions and 17 deletions.
diff --git a/helm_deploy/wordpress/templates/ingress.yaml b/helm_deploy/wordpress/templates/ingress.yaml
@@ -8,23 +8,31 @@ metadata:
     external-dns.alpha.kubernetes.io/aws-weight: "100"
     nginx.ingress.kubernetes.io/enable-modsecurity: "true"
     nginx.ingress.kubernetes.io/modsecurity-snippet: |
-      # Default WAF rules
-      SecRuleEngine On
-      SecDefaultAction 
-        "phase:2,\
-        pass,\
-        log,\
-        tag:github_team=hale-platform,\
-        tag:environment=hale-platform-{{ .Values.configmap.envtype }}"
-      # Set WAF Config for Authenticated Users
-      SecRule REQUEST_HEADERS:Cookie "@contains WB_CONFIG={{ .Values.secrets.wbconfig }}"
-        "id:1004,\
-        phase:2,\
-        allow,\
-        nolog,\
-        tag:github_team=hale-platform,\
-        tag:environment=hale-platform-{{ .Values.configmap.envtype }}-auth,\
-        ctl:ruleEngine=DetectionOnly"
+      nginx.ingress.kubernetes.io/enable-modsecurity: "true"
+      nginx.ingress.kubernetes.io/modsecurity-snippet: |
+        SecAction "phase:1, ctl:requestBodyNoFilesLimit=52428800"
+      
+        # Enable ModSecurity WAF
+        SecRuleEngine On
+      
+        # Default action for all rules
+        SecDefaultAction \
+          "phase:2, \
+          pass, \
+          log, \
+          tag:github_team=hale-platform, \
+          tag:environment=hale-platform-{{ .Values.configmap.envtype }}"
+      
+        # Set WAF config for Authenticated Users
+        SecRule REQUEST_HEADERS:Cookie "@contains WB_CONFIG={{ .Values.secrets.wbconfig }}" \
+          "id:1004, \
+          phase:2, \
+          allow, \
+          nolog, \
+          tag:github_team=hale-platform, \
+          tag:environment=hale-platform-{{ .Values.configmap.envtype }}-auth, \
+          ctl:ruleEngine=DetectionOnly"
+
     nginx.ingress.kubernetes.io/server-snippet: |
       location = /.well-known/security.txt {
         auth_basic off;