# ModSecurity for Nginx Reverse Proxy (CRS Paranoia Level 4)

This repository now includes a prepared ModSecurity ruleset under:

- `nginx/modsecurity/main.conf`
- `nginx/modsecurity/crs-setup/custom-pl4.conf`
- `nginx/modsecurity/custom-rules.conf`

## 1) Prerequisites

Your reverse proxy Nginx must have the ModSecurity v3 connector enabled (`modsecurity-nginx`).
A stock `nginx:alpine` image does not include this module.

## 2) Mount the rules into your reverse proxy

Mount the directory into the proxy container, for example:

```yaml
volumes:
  - ./nginx/modsecurity:/etc/nginx/modsecurity:ro
```

Your proxy image should also provide:

- `/etc/nginx/modsecurity/modsecurity.conf`
- `/etc/nginx/modsecurity/owasp-crs/rules/*.conf`

## 3) Enable ModSecurity in the virtual host

Inside the `server` block (or per `location`):

```nginx
modsecurity on;
modsecurity_rules_file /etc/nginx/modsecurity/main.conf;
```

## 4) Reload and verify

```bash
nginx -t
nginx -s reload
```

Then send test payloads and confirm ModSecurity audit/error logs show rule matches.

## Notes

- PL4 is intentionally strict and can produce false positives.
- If production traffic is noisy, start with `SecRuleEngine DetectionOnly`, tune exclusions, then switch to `On`.