Initial commit: Cloudflare infrastructure with WAF Intelligence
- Complete Cloudflare Terraform configuration (DNS, WAF, tunnels, access) - WAF Intelligence MCP server with threat analysis and ML classification - GitOps automation with PR workflows and drift detection - Observatory monitoring stack with Prometheus/Grafana - IDE operator rules for governed development - Security playbooks and compliance frameworks - Autonomous remediation and state reconciliation
This commit is contained in:
Vault Sovereign
373
gitops/config.yml
Normal file
373
gitops/config.yml
Normal file
@@ -0,0 +1,373 @@
|
||||
# Phase 6 GitOps Configuration
|
||||
# Cloudflare Mesh Observatory - PR Workflows
|
||||
#
|
||||
# This config drives:
|
||||
# - Risk classification for Terraform changes
|
||||
# - Drift PR generation
|
||||
# - CI plan comments
|
||||
# - Alertmanager → GitLab webhook triggers
|
||||
|
||||
---
|
||||
# ==============================================================================
|
||||
# GIT PLATFORM CONFIGURATION
|
||||
# ==============================================================================
|
||||
gitlab:
|
||||
base_url: "${GITLAB_BASE_URL:-https://gitlab.com}"
|
||||
project_id: "${GITLAB_PROJECT_ID}"
|
||||
default_branch: "main"
|
||||
|
||||
# API settings
|
||||
api_version: "v4"
|
||||
timeout_seconds: 30
|
||||
|
||||
# GitHub alternative (uncomment if using GitHub)
|
||||
# github:
|
||||
# base_url: "https://api.github.com"
|
||||
# owner: "your-org"
|
||||
# repo: "cloudflare-infra"
|
||||
# default_branch: "main"
|
||||
|
||||
# ==============================================================================
|
||||
# TERRAFORM CONFIGURATION
|
||||
# ==============================================================================
|
||||
terraform:
|
||||
working_dir: "terraform"
|
||||
plan_file: "plan.tfplan"
|
||||
state_file: "terraform.tfstate"
|
||||
|
||||
# Backend configuration hints (for plan summarizer)
|
||||
backend_type: "local" # or "s3", "gcs", "azurerm", etc.
|
||||
|
||||
# Parallelism for plan operations
|
||||
parallelism: 10
|
||||
|
||||
# ==============================================================================
|
||||
# RISK CLASSIFICATION
|
||||
# ==============================================================================
|
||||
# Maps Cloudflare resource types to risk levels
|
||||
# Used by plan_summarizer.py to score changes
|
||||
|
||||
risk:
|
||||
# DNS changes - high blast radius
|
||||
dns:
|
||||
resource_types:
|
||||
- "cloudflare_record"
|
||||
- "cloudflare_zone"
|
||||
- "cloudflare_zone_settings_override"
|
||||
- "cloudflare_zone_dnssec"
|
||||
base_risk: "high"
|
||||
|
||||
# WAF/Security changes - security-critical
|
||||
waf:
|
||||
resource_types:
|
||||
- "cloudflare_waf_rule"
|
||||
- "cloudflare_waf_package"
|
||||
- "cloudflare_waf_group"
|
||||
- "cloudflare_waf_override"
|
||||
- "cloudflare_firewall_rule"
|
||||
- "cloudflare_filter"
|
||||
- "cloudflare_rate_limit"
|
||||
- "cloudflare_zone_lockdown"
|
||||
- "cloudflare_access_rule"
|
||||
- "cloudflare_user_agent_blocking_rule"
|
||||
base_risk: "high"
|
||||
|
||||
# Tunnel changes - connectivity-critical
|
||||
tunnels:
|
||||
resource_types:
|
||||
- "cloudflare_tunnel"
|
||||
- "cloudflare_tunnel_config"
|
||||
- "cloudflare_tunnel_route"
|
||||
- "cloudflare_argo_tunnel"
|
||||
base_risk: "high"
|
||||
|
||||
# Access/Zero Trust - identity-critical
|
||||
access:
|
||||
resource_types:
|
||||
- "cloudflare_access_application"
|
||||
- "cloudflare_access_policy"
|
||||
- "cloudflare_access_group"
|
||||
- "cloudflare_access_identity_provider"
|
||||
- "cloudflare_access_service_token"
|
||||
- "cloudflare_access_ca_certificate"
|
||||
- "cloudflare_access_mutual_tls_certificate"
|
||||
- "cloudflare_teams_account"
|
||||
- "cloudflare_teams_list"
|
||||
- "cloudflare_teams_rule"
|
||||
- "cloudflare_device_posture_rule"
|
||||
- "cloudflare_device_posture_integration"
|
||||
base_risk: "high"
|
||||
|
||||
# Performance/Caching - medium risk
|
||||
performance:
|
||||
resource_types:
|
||||
- "cloudflare_page_rule"
|
||||
- "cloudflare_tiered_cache"
|
||||
- "cloudflare_cache_reserve"
|
||||
- "cloudflare_regional_tiered_cache"
|
||||
- "cloudflare_argo"
|
||||
- "cloudflare_load_balancer"
|
||||
- "cloudflare_load_balancer_pool"
|
||||
- "cloudflare_load_balancer_monitor"
|
||||
base_risk: "medium"
|
||||
|
||||
# Workers - code deployment
|
||||
workers:
|
||||
resource_types:
|
||||
- "cloudflare_worker_script"
|
||||
- "cloudflare_worker_route"
|
||||
- "cloudflare_worker_cron_trigger"
|
||||
- "cloudflare_workers_kv_namespace"
|
||||
- "cloudflare_workers_kv"
|
||||
base_risk: "medium"
|
||||
|
||||
# Certificates - availability-critical
|
||||
certificates:
|
||||
resource_types:
|
||||
- "cloudflare_certificate_pack"
|
||||
- "cloudflare_origin_ca_certificate"
|
||||
- "cloudflare_authenticated_origin_pulls"
|
||||
- "cloudflare_authenticated_origin_pulls_certificate"
|
||||
base_risk: "high"
|
||||
|
||||
# Other/Low risk
|
||||
other:
|
||||
resource_types:
|
||||
- "cloudflare_api_token"
|
||||
- "cloudflare_logpush_job"
|
||||
- "cloudflare_logpull_retention"
|
||||
- "cloudflare_notification_policy"
|
||||
- "cloudflare_notification_policy_webhooks"
|
||||
base_risk: "low"
|
||||
|
||||
# Action-based risk modifiers
|
||||
actions:
|
||||
create:
|
||||
modifier: 0 # Neutral - new resources
|
||||
update:
|
||||
modifier: 1 # +1 risk level
|
||||
delete:
|
||||
modifier: 2 # +2 risk levels (always dangerous)
|
||||
replace:
|
||||
modifier: 2 # Same as delete (destroy + create)
|
||||
no-op:
|
||||
modifier: -10 # Effectively ignore
|
||||
|
||||
# Final risk level mapping
|
||||
levels:
|
||||
low: 0
|
||||
medium: 1
|
||||
high: 2
|
||||
critical: 3
|
||||
|
||||
# ==============================================================================
|
||||
# DRIFT PR CONFIGURATION
|
||||
# ==============================================================================
|
||||
drift_pr:
|
||||
# Branch naming
|
||||
branch_prefix: "drift/remediation-"
|
||||
|
||||
# MR/PR settings
|
||||
title_prefix: "Drift Remediation"
|
||||
labels:
|
||||
- "drift"
|
||||
- "terraform"
|
||||
- "auto-generated"
|
||||
|
||||
# Auto-assign reviewers based on component
|
||||
reviewer_mapping:
|
||||
dns: ["dns-team"]
|
||||
waf: ["security-team"]
|
||||
tunnels: ["infra-team"]
|
||||
access: ["security-team", "identity-team"]
|
||||
default: ["platform-team"]
|
||||
|
||||
# Approval requirements by risk level
|
||||
approvals_required:
|
||||
low: 1
|
||||
medium: 1
|
||||
high: 2
|
||||
critical: 2
|
||||
|
||||
# Auto-merge settings
|
||||
auto_merge:
|
||||
enabled: false
|
||||
allowed_risk_levels: ["low"]
|
||||
require_pipeline_success: true
|
||||
|
||||
# ==============================================================================
|
||||
# CI PLAN COMMENT CONFIGURATION
|
||||
# ==============================================================================
|
||||
ci:
|
||||
comment_header: "Terraform Plan Summary"
|
||||
|
||||
# What to include in comments
|
||||
include:
|
||||
risk_summary: true
|
||||
resource_table: true
|
||||
action_counts: true
|
||||
affected_zones: true
|
||||
compliance_flags: true
|
||||
|
||||
# Collapse large tables
|
||||
collapse_threshold: 10
|
||||
|
||||
# Link to dashboards
|
||||
dashboard_links:
|
||||
grafana: "http://localhost:3000/d/cloudflare-overview"
|
||||
prometheus: "http://localhost:9090"
|
||||
|
||||
# ==============================================================================
|
||||
# ALERTMANAGER WEBHOOK INTEGRATION
|
||||
# ==============================================================================
|
||||
webhook:
|
||||
# GitLab pipeline trigger
|
||||
gitlab_trigger:
|
||||
enabled: true
|
||||
trigger_token: "${GITLAB_TRIGGER_TOKEN}"
|
||||
ref: "main"
|
||||
|
||||
# Alerts that trigger drift remediation
|
||||
trigger_alerts:
|
||||
- "DNSDriftDetected"
|
||||
- "WAFRuleMissing"
|
||||
- "TunnelConfigChanged"
|
||||
- "InvariantViolation"
|
||||
- "FirewallRuleMissing"
|
||||
|
||||
# Alerts that only notify (no auto-PR)
|
||||
notify_only_alerts:
|
||||
- "DNSHijackDetected" # Security incident - manual only
|
||||
- "ProofchainIntegrityFailure" # Never auto-remediate
|
||||
- "WAFRuleBypass" # Needs investigation first
|
||||
|
||||
# ==============================================================================
|
||||
# SLACK NOTIFICATIONS
|
||||
# ==============================================================================
|
||||
slack:
|
||||
webhook_url: "${SLACK_WEBHOOK_URL}"
|
||||
channel: "#cloudflare-gitops"
|
||||
|
||||
# Notification settings
|
||||
notify_on:
|
||||
pr_created: true
|
||||
pr_merged: true
|
||||
pr_failed: true
|
||||
high_risk_plan: true
|
||||
|
||||
# Message templates
|
||||
templates:
|
||||
pr_created: |
|
||||
*GitOps PR Created*
|
||||
Title: {title}
|
||||
Risk Level: {risk_level}
|
||||
Changes: {change_count}
|
||||
Link: {url}
|
||||
pr_merged: |
|
||||
*GitOps PR Merged*
|
||||
Title: {title}
|
||||
Merged by: {merged_by}
|
||||
Applied changes: {change_count}
|
||||
|
||||
# ==============================================================================
|
||||
# COMPLIANCE INTEGRATION
|
||||
# ==============================================================================
|
||||
compliance:
|
||||
# Flag changes that affect compliance frameworks
|
||||
frameworks:
|
||||
- name: "SOC2"
|
||||
triggers:
|
||||
- resource_types: ["cloudflare_zone_settings_override"]
|
||||
fields: ["ssl", "always_use_https", "min_tls_version"]
|
||||
- resource_types: ["cloudflare_waf_rule"]
|
||||
actions: ["delete"]
|
||||
|
||||
- name: "PCI-DSS"
|
||||
triggers:
|
||||
- resource_types: ["cloudflare_zone_settings_override"]
|
||||
fields: ["min_tls_version"]
|
||||
- resource_types: ["cloudflare_waf_*"]
|
||||
actions: ["delete", "update"]
|
||||
|
||||
- name: "HIPAA"
|
||||
triggers:
|
||||
- resource_types: ["cloudflare_zone_settings_override"]
|
||||
fields: ["ssl", "always_use_https"]
|
||||
- resource_types: ["cloudflare_access_*"]
|
||||
actions: ["delete"]
|
||||
|
||||
# Add compliance warnings to PR descriptions
|
||||
add_warnings: true
|
||||
|
||||
# Block merge for compliance violations
|
||||
block_on_violation: false # Set true for strict mode
|
||||
|
||||
# ==============================================================================
|
||||
# PHASE 7: WAF INTELLIGENCE CONFIGURATION
|
||||
# ==============================================================================
|
||||
waf_intelligence:
|
||||
# Enable/disable Phase 7 features
|
||||
enabled: true
|
||||
|
||||
# Threat intelligence collection
|
||||
threat_intel:
|
||||
enabled: true
|
||||
log_paths:
|
||||
- "logs/cloudflare"
|
||||
- "/var/log/cloudflare"
|
||||
max_indicators: 100
|
||||
min_hit_count: 3 # Minimum hits before flagging
|
||||
|
||||
# External threat feeds (optional)
|
||||
external_feeds:
|
||||
abuseipdb:
|
||||
enabled: false
|
||||
api_key: "${ABUSEIPDB_API_KEY}"
|
||||
min_abuse_score: 80
|
||||
emerging_threats:
|
||||
enabled: false
|
||||
feed_url: "https://rules.emergingthreats.net/blockrules/compromised-ips.txt"
|
||||
|
||||
# ML classifier settings
|
||||
classifier:
|
||||
enabled: true
|
||||
min_confidence: 0.7
|
||||
sample_limit: 50
|
||||
|
||||
# Attack type detection
|
||||
detect_types:
|
||||
- sqli
|
||||
- xss
|
||||
- rce
|
||||
- path_traversal
|
||||
- scanner
|
||||
|
||||
# Rule proposal settings
|
||||
proposals:
|
||||
max_per_batch: 10
|
||||
auto_deploy_min_confidence: 0.85
|
||||
auto_deploy_severities:
|
||||
- critical
|
||||
- high
|
||||
require_review_severities:
|
||||
- medium
|
||||
- low
|
||||
|
||||
# GitOps integration for WAF rules
|
||||
gitops:
|
||||
create_mrs: true
|
||||
branch_prefix: "waf-intel/"
|
||||
labels:
|
||||
- "waf-intelligence"
|
||||
- "auto-generated"
|
||||
- "security"
|
||||
reviewers:
|
||||
- "security-team"
|
||||
|
||||
# Auto-merge high-confidence critical blocks
|
||||
auto_merge:
|
||||
enabled: false
|
||||
min_confidence: 0.95
|
||||
allowed_severities:
|
||||
- critical
|
||||
|
||||
Reference in New Issue
Block a user