# SPDX-FileCopyrightText: 2023 wargio <deroad@libero.it>
# SPDX-License-Identifier: LGPL-3.0-only

master_process off;
daemon off;

load_module @TEST_NGINX_NAXSI_MODULE_SO@;
events {
  worker_connections  1024;
  use select;
}

http {
  include            mime.types;
  default_type       application/octet-stream;
  sendfile           on;
  keepalive_timeout  65;

  @RULES_NGINX_NAXSI_CORE@
  @RULES_NGINX_NAXSI_BLOCKING@

  server {
    listen              4242;
    server_name         localhost;
    set                 $naxsi_extensive_log 1;
    location / {
      SecRulesEnabled; #enable naxsi
      LibInjectionSql; #enable libinjection support for SQLI
      LibInjectionXss; #enable libinjection support for XSS

      #the location where naxsi will redirect the request when it is blocked
      DeniedUrl "/NaxsiRequestDenied";

      #the action to take when the $SQL score is superior or equal to 8
      CheckRule "$SQL >= 8" BLOCK;
      CheckRule "$RFI >= 8" BLOCK;
      CheckRule "$TRAVERSAL >= 5" BLOCK;
      CheckRule "$UPLOAD >= 5" BLOCK;
      CheckRule "$XSS >= 8" BLOCK;
      CheckRule "$UWA >= 8" BLOCK;
      CheckRule "$EVADE >= 8" BLOCK;

      @RULES_NGINX_NAXSI_WHITELISTS@

      return 200 "200 $request_uri\n";
    }
    location /NaxsiRequestDenied {
        internal;
        return 406; # Not Acceptable
    }
  }
}
