nginx WAF (#696)

* boilerplate nginx
* add wip http tab to nginx view
* net/nginx: add partial model
* net/nginx get works now
* add controller code to map request to model
* net/nginx: add http server view
* net/nginx: add some options for server block
* net/nginx: add TLS options; update view
* net/nginx: fix TLS cert
* net/nginx: add some initial and incomplete templates
* net/nginx: bugfix and more features for upstream servers in model and view
* net/nginx: add conf for upstream; bugfix in location
* net/nginx: add location
* net/nginx: add upstream to view and model
* fix upstream and location blocks; move upstream to own config template
* net/nginx: add setup code and update template to support client check CA
* add missing options to http server view, remove http2 from http port, update nginx config to run even if disabled to handle webgui in the future; render templates to real location
* net/nginx: add some stuff
* net/nginx: add mail plugin and use return 403
* net/nginx: more bocked bots
* net/nginx: add reload buttons
* net/nginx: add description to location
* net/nginx: update readme
* net/nginx: add missing options
* net/nginx: config cleanup; fix missing model properties
* net/nginx: add webgui template
* net/nginx: update model to contain rule information (NOT FINAL)
* net/nginx: update README (request by @fichtner)
* net/nginx: use shield icon for nginx as its main purpose is protection like IPS in OPNsense
* copy pkg-descr from ports
* upcase first letter in menu
* net/nginx: add rules and policies; fix copy and paste issue
* net/nginx: make link https
* net/nginx: make link https
* net/nginx: mark plugin as devel
* net/nginx: add and fix rule gui and model stuff
* net/nginx: start some rule processing
* net/nginx: add basic rule to config
* net/nginx: working main and basic rules
* net/nginx: fix missing negative parameter
* net/nginx: make credentials operational
* mv nginx to www
* mv nginx to www
* www/nginx: add temporary templates until we get the final ones
* www/nginx: move log to a different location
* www/nginx: also add 500 error page
* www/nginx: add php config files, run nginx as root for webgui stuff
* www/nginx: add some variables to webgui
* version bump
* www/nginx: bugfix in upstream form - dropdown is not correctly initialized
* www/nginx: serve lets encrypt challenge files for acme plugin (for future use)
* www/nginx: make a release candidate theme for WAF blocked requests error page
* enable webgui support in the nginx plugin
* www/nginx override is not needed anymore because it can run instead of lighttpd
* www/nginx: do not allow sopping the daemon
* www/nginx: add access policy for webgui; fix error handling
* www/nginx: add config prototype for subrequest auth into webgui
* www/nginx: fix a bug that prevents nginx starting and pass uuid of server to backend script
* www/nginx: basic local auth
* www/nginx: just tell the client that we want a authentication
* www/nginx: change request parameters to match recent core changes

see: https://github.com/opnsense/core/commit/e62d1ef31bb5b75989e08f89c43220d11f943e38

* www/nginx: add mvc code for URL rewriting
* www/nginx: allow bigger uploads (fixes config restore)
* www/nginx: disable web interface and adjust menu
* www/nginx: enable brotli and gzip globally

README.md

@@ -82,6 +82,7 @@ sysutils/vmware -- VMware tools
 sysutils/xen -- Xen guest utilities
 www/c-icap -- c-icap connects the web proxy with a virus scanner
 www/cache -- Webserver cache
+www/nginx -- Nginx HTTP server and reverse proxy
 www/web-proxy-sso -- Kerberos authentication module
 www/web-proxy-useracl -- Group and user ACL for the web proxy
 ```

www/nginx/Makefile

@@ -0,0 +1,8 @@
+PLUGIN_NAME=          nginx
+PLUGIN_VERSION=       0.2
+PLUGIN_COMMENT=       Nginx HTTP server and reverse proxy
+PLUGIN_DEPENDS=       nginx
+PLUGIN_MAINTAINER=    franz.fabian.94@gmail.com
+PLUGIN_DEVEL=         yes
+
+.include "../../Mk/plugins.mk"

www/nginx/pkg-descr

@@ -0,0 +1,8 @@
+NGINX is a high performance edge web server with the lowest memory footprint
+and the key features to build modern and efficient web infrastructure.
+
+NGINX functionality includes HTTP server, HTTP and mail reverse proxy, caching,
+load balancing, compression, request throttling, connection multiplexing and
+reuse, SSL offload and HTTP media streaming.
+
+WWW: https://nginx.org/

www/nginx/src/etc/nginx/views/opnsense_error_404.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Request Denied</title>
+    <meta name="generator" content="OPNsense" />
+    <meta name="language" content="en-US" />
+    <style>
+        body {
+            background-color: black;
+        }
+        h1, p {
+            text-align: center;
+            color: white;
+        }
+    </style>
+</head>
+<body>
+<h1>Not Found</h1>
+<p>The resource you want to access is not available.</p>
+<p>Please contact the webmaster if you think this is an error.</p>
+</body>
+</html>

www/nginx/src/etc/nginx/views/opnsense_server_error.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Request Denied</title>
+    <meta name="generator" content="OPNsense" />
+    <meta name="language" content="en-US" />
+    <style>
+        body {
+            background-color: black;
+        }
+        h1, p {
+            text-align: center;
+            color: white;
+        }
+    </style>
+</head>
+<body>
+<h1>Server Error</h1>
+<p>Sorry, but something went wrong on our side.</p>
+<p>There is nothing you can do except waiting until we fix the issue.</p>
+</body>
+</html>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/Api/ServiceController.php

@@ -0,0 +1,103 @@
+<?php
+
+/*
+ * Copyright (C) 2017-2018 Franco Fichtner <franco@opnsense.org>
+ * Copyright (C) 2016 IT-assistans Sverige AB
+ * Copyright (C) 2015-2016 Deciso B.V.
+ * Copyright (C) 2018 Fabian Franz
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Nginx\Api;
+
+use OPNsense\Base\ApiMutableServiceControllerBase;
+use OPNsense\Core\Backend;
+
+class ServiceController extends ApiMutableServiceControllerBase
+{
+    static protected $internalServiceClass = '\OPNsense\Nginx\Nginx';
+    static protected $internalServiceTemplate = 'OPNsense/Nginx';
+    static protected $internalServiceEnabled = 'general.enabled';
+    static protected $internalServiceName = 'nginx';
+
+    /**
+    *  override parent method - stopping nginx is not allowed because otherwise you would loose
+    *  access to the web interface
+    */
+    public function stopAction()
+    {
+        return array('status' => 'failed');
+    }
+    
+    
+    /**
+     * reconfigure with optional stop, generate config and start / reload
+     * @return array response message
+     * @throws \Exception when configd action fails
+     * @throws \ReflectionException when model can't be instantiated
+     */
+    public function reconfigureAction()
+    {
+        if ($this->request->isPost()) {
+            $this->sessionClose();
+            $model = $this->getModel();
+            $backend = new Backend();
+            if ($this->reconfigureForceRestart()) {
+                $backend->configdRun('nginx stop');
+            }
+            $backend->configdRun('template reload OPNsense/Nginx');
+            $runStatus = $this->statusAction();
+            if ($runStatus['status'] != 'running') {
+                $backend->configdRun('nginx start');
+            } else {
+                $backend->configdRun('nginx reload');
+            }
+            return array('status' => 'ok');
+        } else {
+            return array('status' => 'failed');
+        }
+    }
+
+    /**
+     * retrieve status of service
+     * @return array response message
+     * @throws \Exception when configd action fails
+     */
+    public function statusAction()
+    {
+        $backend = new Backend();
+        $model = $this->getModel();
+        $response = $backend->configdRun('nginx status');
+
+        if (strpos($response, 'not running') > 0) {
+            $status = 'stopped';
+        } elseif (strpos($response, 'is running') > 0) {
+            $status = 'running';
+        } else {
+            $status = 'unknown';
+        }
+
+        return array('status' => $status);
+    }
+}

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/Api/SettingsController.php

@@ -0,0 +1,281 @@
+<?php
+
+/*
+ * Copyright (C) 2018 Fabian Franz
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Nginx\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class SettingsController extends ApiMutableModelControllerBase
+{
+    static protected $internalModelClass = '\OPNsense\Nginx\Nginx';
+    static protected $internalModelName = 'nginx';
+
+    // User List
+
+    public function searchuserlistAction()
+    {
+        return $this->searchBase('userlist', array('name', 'users'));
+    }
+
+    public function getuserlistAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('userlist', 'userlist', $uuid);
+    }
+
+    public function adduserlistAction()
+    {
+        return $this->addBase('userlist', 'userlist');
+    }
+
+    public function deluserlistAction($uuid)
+    {
+        return $this->delBase('userlist', $uuid);
+    }
+
+    public function setuserlistAction($uuid)
+    {
+        return $this->setBase('userlist', 'userlist', $uuid);
+    }
+
+    // Credential
+    public function searchcredentialAction()
+    {
+        return $this->searchBase('credential', array('username'));
+    }
+
+    public function getcredentialAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('credential', 'credential', $uuid);
+    }
+
+    public function addcredentialAction()
+    {
+        return $this->addBase('credential', 'credential');
+    }
+
+    public function delcredentialAction($uuid)
+    {
+        return $this->delBase('credential', $uuid);
+    }
+
+    public function setcredentialAction($uuid)
+    {
+        return $this->setBase('credential', 'credential', $uuid);
+    }
+
+    // Upstream
+    public function searchupstreamAction()
+    {
+        return $this->searchBase('upstream', array('description', 'serverentries'));
+    }
+
+    public function getupstreamAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('upstream', 'upstream', $uuid);
+    }
+
+    public function addupstreamAction()
+    {
+        return $this->addBase('upstream', 'upstream');
+    }
+
+    public function delupstreamAction($uuid)
+    {
+        return $this->delBase('upstream', $uuid);
+    }
+
+    public function setupstreamAction($uuid)
+    {
+        return $this->setBase('upstream', 'upstream', $uuid);
+    }
+
+    // Upstream Server
+    public function searchupstreamserverAction()
+    {
+        return $this->searchBase('upstream_server', array('description', 'server', 'priority'));
+    }
+
+    public function getupstreamserverAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('upstream_server', 'upstream_server', $uuid);
+    }
+
+    public function addupstreamserverAction()
+    {
+        return $this->addBase('upstream_server', 'upstream_server');
+    }
+
+    public function delupstreamserverAction($uuid)
+    {
+        return $this->delBase('upstream_server', $uuid);
+    }
+
+    public function setupstreamserverAction($uuid)
+    {
+        return $this->setBase('upstream_server', 'upstream_server', $uuid);
+    }
+
+    // Location
+    public function searchlocationAction()
+    {
+        return $this->searchBase('location', array('description','urlpattern', 'matchtype', 'enable_secrules', 'force_https'));
+    }
+
+    public function getlocationAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('location', 'location', $uuid);
+    }
+
+    public function addlocationAction()
+    {
+        return $this->addBase('location', 'location');
+    }
+
+    public function dellocationAction($uuid)
+    {
+        return $this->delBase('location', $uuid);
+    }
+
+    public function setlocationAction($uuid)
+    {
+        return $this->setBase('location', 'location', $uuid);
+    }
+
+    // Custom Policy
+    public function searchcustompolicyAction()
+    {
+        return $this->searchBase('custom_policy', array('name', 'operator', 'value', 'action'));
+    }
+
+    public function getcustompolicyAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('custompolicy', 'custom_policy', $uuid);
+    }
+
+    public function addcustompolicyAction()
+    {
+        return $this->addBase('custompolicy', 'custom_policy');
+    }
+
+    public function delcustompolicyAction($uuid)
+    {
+        return $this->delBase('custom_policy', $uuid);
+    }
+
+    public function setcustompolicyAction($uuid)
+    {
+        return $this->setBase('custompolicy', 'custom_policy', $uuid);
+    }
+    
+    // http server
+    public function searchhttpserverAction()
+    {
+        return $this->searchBase('http_server', array('servername', 'https_only', 'certificate', 'listen_http_port', 'listen_https_port'));
+    }
+
+    public function gethttpserverAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('httpserver', 'http_server', $uuid);
+    }
+
+    public function addhttpserverAction()
+    {
+        return $this->addBase('httpserver', 'http_server');
+    }
+
+    public function delhttpserverAction($uuid)
+    {
+        return $this->delBase('http_server', $uuid);
+    }
+
+    public function sethttpserverAction($uuid)
+    {
+        return $this->setBase('httpserver', 'http_server', $uuid);
+    }
+
+    // naxsi rules
+    public function searchnaxsiruleAction()
+    {
+        return $this->searchBase('naxsi_rule', array('description', 'ruletype', 'message'));
+    }
+
+    public function getnaxsiruleAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('naxsi_rule', 'naxsi_rule', $uuid);
+    }
+
+    public function addnaxsiruleAction()
+    {
+        return $this->addBase('naxsi_rule', 'naxsi_rule');
+    }
+
+    public function delnaxsiruleAction($uuid)
+    {
+        return $this->delBase('naxsi_rule', $uuid);
+    }
+
+    public function setnaxsiruleAction($uuid)
+    {
+        return $this->setBase('naxsi_rule', 'naxsi_rule', $uuid);
+    }
+    
+    // http url rewriting
+    public function searchhttprewriteAction()
+    {
+        return $this->searchBase('http_rewrite', array('description', 'source', 'destination', 'flag'));
+    }
+
+    public function gethttprewriteAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('httprewrite', 'http_rewrite', $uuid);
+    }
+
+    public function addhttprewriteAction()
+    {
+        return $this->addBase('httprewrite', 'http_rewrite');
+    }
+
+    public function delhttprewriteAction($uuid)
+    {
+        return $this->delBase('http_rewrite', $uuid);
+    }
+
+    public function sethttprewriteAction($uuid)
+    {
+        return $this->setBase('httprewrite', 'http_rewrite', $uuid);
+    }
+}

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/IndexController.php

@@ -0,0 +1,54 @@
+<?php
+/*
+
+    Copyright (C) 2018 Fabian Franz
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+
+
+*/
+
+
+namespace OPNsense\Nginx;
+
+/**
+* Class IndexController
+* @package OPNsense/Nginx
+*/
+class IndexController extends \OPNsense\Base\IndexController
+{
+    public function indexAction()
+    {
+        $this->view->settings = $this->getForm("settings");
+        $this->view->upstream_server = $this->getForm("upstream_server");
+        $this->view->upstream = $this->getForm("upstream");
+        $this->view->location = $this->getForm("location");
+        $this->view->credential = $this->getForm("credential");
+        $this->view->userlist = $this->getForm("userlist");
+        $this->view->httpserver = $this->getForm("httpserver");
+        $this->view->httprewrite = $this->getForm("httprewrite");
+        $this->view->naxsi_rule = $this->getForm("naxsi_rule");
+        $this->view->naxsi_custom_policy = $this->getForm("naxsi_custom_policy");
+        $this->view->pick('OPNsense/Nginx/index');
+    }
+}

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/credential.xml

@@ -0,0 +1,12 @@
+<form>
+  <field>
+    <id>credential.username</id>
+    <label>Username</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>credential.password</id>
+    <label>Password</label>
+    <type>text</type>
+  </field>
+</form>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httprewrite.xml

@@ -0,0 +1,27 @@
+<form>
+  <field>
+    <id>httprewrite.description</id>
+    <label>Short description (to display)</label>
+    <type>text</type>
+    <help>Enter a short description like a name for this redirect.</help>
+  </field>
+  <field>
+    <id>httprewrite.source</id>
+    <label>Original URL Pattern (Regex)</label>
+    <type>text</type>
+    <help>Enter a regular expression to match the URL</help>
+  </field>
+  <field>
+    <id>httprewrite.destination</id>
+    <label>New URL Pattern</label>
+    <type>text</type>
+    <help>You may use replacement strings like $1 for the first match group from the source here.</help>
+  </field>
+  <field>
+    <id>httprewrite.flag</id>
+    <label>Flag</label>
+    <type>dropdown</type>
+    <style>selectpicker</style>
+    <help>Stop rule processing (break) and perform (internal) redirect (last). Return a moved permanently status code (301) or a teporary redirect (302).</help>
+  </field>
+</form>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml

@@ -0,0 +1,92 @@
+<form>
+  <field>
+    <id>httpserver.listen_http_port</id>
+    <label>HTTP Listen Port</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>httpserver.listen_https_port</id>
+    <label>HTTPS Listen Port</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>httpserver.servername</id>
+    <label>Server Name</label>
+    <allownew>true</allownew>
+    <style>tokenize</style>
+    <type>select_multiple</type>
+  </field>
+  <field>
+    <id>httpserver.locations</id>
+    <label>Locations</label>
+    <style>selectpicker</style>
+    <type>select_multiple</type>
+  </field>
+  <field>
+    <id>httpserver.rewrites</id>
+    <label>URL Rewriting</label>
+    <type>select_multiple</type>
+    <style>selectpicker</style>
+    <help>Choose URL rewriting rules.</help>
+  </field>
+  <field>
+    <id>httpserver.root</id>
+    <label>File System Root</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>httpserver.certificate</id>
+    <label>TLS Certificate</label>
+    <type>dropdown</type>
+  </field>
+  <field>
+    <id>httpserver.ca</id>
+    <label>CA Certificate</label>
+    <type>dropdown</type>
+  </field>
+  <field>
+    <id>httpserver.verify_client</id>
+    <label>Verify Client Certificate</label>
+    <type>dropdown</type>
+    <help><![CDATA[<ul><li>On: the certificate is requested and validated. Use this option to protect a service with TLS authentication.</li><li>Off: The certificate is not requested. Choose this option for a normal website.</li><li>Optional: The certificate is requested and validated if existing. Choose this option for websites, with TLS login support or mixed TLS protected API and web content.</li><li>Optional, don't verify: Do accept the certificate and let the application choose what to do. Choose this option, for the same reasons as optional but in this case, the request is passed to the backend without rejecting untrusted certificates.</li></ul>]]></help>
+  </field>
+  <field>
+    <id>httpserver.access_log_format</id>
+    <label>Access Log Format</label>
+    <type>dropdown</type>
+  </field>
+  <field>
+    <id>httpserver.enable_acme_support</id>
+    <label>Enable Let's Encrypt Plugin Support</label>
+    <type>checkbox</type>
+  </field>
+  <field>
+    <id>httpserver.charset</id>
+    <label>Charset</label>
+    <type>dropdown</type>
+  </field>
+  <field>
+    <id>httpserver.https_only</id>
+    <label>HTTPS Only</label>
+    <type>checkbox</type>
+    <help>If you check this box, a TLS encrypted connection is enforced.</help>
+  </field>
+  <field>
+    <id>httpserver.block_nonpublic_data</id>
+    <label>Block Configuration Files</label>
+    <type>checkbox</type>
+    <help>Blocks files like .htaccess files or other files not intended for the public.</help>
+  </field>
+  <field>
+    <id>httpserver.naxsi_extensive_log</id>
+    <label>Extensive Naxsi Log</label>
+    <type>checkbox</type>
+    <help>Provide a more verbose WAF log for fixing false positives before going live.</help>
+  </field>
+  <field>
+    <id>httpserver.sendfile</id>
+    <label>Enable Sendfile</label>
+    <type>checkbox</type>
+    <help>Allow the daemon to use the sendfile function.</help>
+  </field>
+</form>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/location.xml

@@ -0,0 +1,106 @@
+<form>
+  <field>
+    <id>location.description</id>
+    <label>Description</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>location.urlpattern</id>
+    <label>URL Pattern</label>
+    <type>text</type>
+    <help>The URL pattern to match.</help>
+  </field>
+  <field>
+    <id>location.matchtype</id>
+    <label>Match Type</label>
+    <type>dropdown</type>
+    <help>Choose how to match on "URL Pattern".</help>
+  </field>
+  <field>
+    <id>location.rewrites</id>
+    <label>URL Rewriting</label>
+    <type>select_multiple</type>
+    <style>selectpicker</style>
+    <help>Choose URL rewriting rules.</help>
+  </field>
+  <field>
+    <id>location.enable_secrules</id>
+    <label>Enable Security Rules</label>
+    <type>checkbox</type>
+    <help>Enable WAF</help>
+  </field>
+  <field>
+    <id>location.enable_learning_mode</id>
+    <label>Learning Mode</label>
+    <type>checkbox</type>
+    <help>Enable learning mode means nothing is blocked but logged.</help>
+  </field>
+  <field>
+    <id>location.xss_block_score</id>
+    <label>Block XSS Score</label>
+    <type>text</type>
+    <help>Block XSS with a score above the specified value using generic detection.</help>
+  </field>
+  <field>
+    <id>location.sqli_block_score</id>
+    <label>Block SQL Injection Score</label>
+    <type>text</type>
+    <help>Block SQL injection with a score above the specified value using generic detection.</help>
+  </field>
+  <field>
+    <id>location.custom_policy</id>
+    <label>Custom Security Policy</label>
+    <type>select_multiple</type>
+    <style>selectpicker</style>
+    <help>Select custom security policies.</help>
+  </field>
+  <field>
+    <id>location.upstream</id>
+    <label>Upstream Servers</label>
+    <type>dropdown</type>
+    <style>selectpicker</style>
+    <help>Select an upstream to proxy to.</help>
+  </field>
+  <field>
+    <id>location.root</id>
+    <label>File System Root</label>
+    <type>text</type>
+    <help>Enter the file system root from which the files are served.</help>
+  </field>
+  <field>
+    <id>location.index</id>
+    <label>Index File</label>
+    <type>select_multiple</type>
+    <help>Enter a list of file extensions, which are served instead of a directory. It is common to use index.html or index.php here.</help>
+  </field>
+  <field>
+    <id>location.autoindex</id>
+    <label>Automatic Index</label>
+    <type>checkbox</type>
+    <help>Check this to serve a file list when a directory is requested. This is useful for serving multiple files with someone without a web application. It is recommended to use this option only with authentication.</help>
+  </field>
+  <field>
+    <id>location.authbasic</id>
+    <label>Basic Authentication</label>
+    <type>text</type>
+    <help>Enter the realm for this directory and enable authentication.</help>
+  </field>
+  <field>
+    <id>location.authbasicuserfile</id>
+    <label>Basic Credentials List</label>
+    <type>dropdown</type>
+    <help>Select a credential list to use.</help>
+  </field>
+  <field>
+    <id>location.advanced_acl</id>
+    <label>Enable Advanced ACLs</label>
+    <type>checkbox</type>
+    <help>Send an authentication request to the OPNsense backend for advanced access control.</help>
+  </field>
+  <field>
+    <id>location.force_https</id>
+    <label>Force HTTPS</label>
+    <type>checkbox</type>
+    <help>Force encrypted connections.</help>
+  </field>
+</form>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/naxsi_custom_policy.xml

@@ -0,0 +1,31 @@
+<form>
+    <field>
+        <id>custompolicy.name</id>
+        <type>text</type>
+        <label>Name</label>
+    </field>
+    <field>
+        <id>custompolicy.naxsi_rules</id>
+        <type>select_multiple</type>
+        <allownew>true</allownew>
+        <style>tokenize</style>
+        <label>Rules</label>
+    </field>
+    <field>
+        <id>custompolicy.value</id>
+        <type>text</type>
+        <label>Value</label>
+    </field>
+    <field>
+        <id>custompolicy.operator</id>
+        <type>dropdown</type>
+        <style>selectpicker</style>
+        <label>Operator</label>
+    </field>
+    <field>
+        <id>custompolicy.action</id>
+        <type>dropdown</type>
+        <style>selectpicker</style>
+        <label>Action</label>
+    </field>
+</form>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/naxsi_rule.xml

@@ -0,0 +1,110 @@
+<form>
+    <field>
+        <id>naxsi_rule.description</id>
+        <label>Description</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>naxsi_rule.message</id>
+        <label>Message</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>naxsi_rule.negate</id>
+        <label>Negate</label>
+        <type>checkbox</type>
+        <help>If this is box is checked, the score will be added if the rule does not match. Use with care.</help>
+    </field>
+    <field>
+        <id>naxsi_rule.identifier</id>
+        <label>ID</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>naxsi_rule.ruletype</id>
+        <label>Rule Type</label>
+        <type>dropdown</type>
+    </field>
+    <field>
+        <id>naxsi_rule.regex</id>
+        <label>Use Regular Expressions</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>naxsi_rule.match_value</id>
+        <label>Match Value</label>
+        <type>text</type>
+    </field>
+    <field>
+        <id>naxsi_rule.match_type</id>
+        <label>Match Type</label>
+        <type>dropdown</type>
+        <style>selectpicker</style>
+    </field>
+    <field>
+        <id>naxsi_rule.args</id>
+        <label>Arguments</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>naxsi_rule.url</id>
+        <label>URL</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>naxsi_rule.headers</id>
+        <label>Headers</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>naxsi_rule.body</id>
+        <label>Body</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>naxsi_rule.name</id>
+        <label>Name</label>
+        <type>checkbox</type>
+        <help>Check this box to match the variable name and not its content when matching any of the above checkboxes.</help>
+    </field>
+    <field>
+        <id>naxsi_rule.file_extension</id>
+        <label>File Extension</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>naxsi_rule.raw_body</id>
+        <label>Raw Body</label>
+        <type>checkbox</type>
+    </field>
+    <field>
+        <id>naxsi_rule.dollar_url</id>
+        <label>URL or URL Pattern</label>
+        <type>text</type>
+        <help>Enter the name of a parameter to match.</help>
+    </field>
+    <field>
+        <id>naxsi_rule.dollar_args_var</id>
+        <label>Named Argument</label>
+        <type>text</type>
+        <help>Enter the name of a parameter to match.</help>
+    </field>
+    <field>
+        <id>naxsi_rule.dollar_body_var</id>
+        <label>Named Body Variable</label>
+        <type>text</type>
+        <help>Enter the name of a variable in the HTTP body to match.</help>
+    </field>
+    <field>
+        <id>naxsi_rule.dollar_headers_var</id>
+        <label>Named Header</label>
+        <type>text</type>
+        <help>Enter the name of an HTTP header to match.</help>
+    </field>
+    <field>
+        <id>naxsi_rule.score</id>
+        <label>Score</label>
+        <type>text</type>
+    </field>
+
+</form>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/settings.xml

@@ -0,0 +1,61 @@
+<form>
+    <tab id="nginx-general" description="General Settings">
+        <subtab id="nginx-general-settings" description="General Settings">
+            <field>
+                <id>nginx.general.enabled</id>
+                <label>Enable nginx</label>
+                <type>checkbox</type>
+                <help>Enable or disable the nginx service.</help>
+            </field>
+        </subtab>
+        <subtab id="nginx-http-global" description="Global HTTP Settings">
+            <field>
+                <id>nginx.http.enabled</id>
+                <label>Enable sendfile</label>
+                <type>checkbox</type>
+                <help>Enable sendfile support (faster).</help>
+            </field>
+            <field>
+                <id>nginx.http.keepalive_timeout</id>
+                <label>Keepalive Timeout</label>
+                <type>text</type>
+                <help>After this idle time, the client gets disconnected.</help>
+            </field>
+            <field>
+                <id>nginx.http.default_type</id>
+                <label>Default MIME-Type</label>
+                <type>text</type>
+                <help>This content type is sent if the file extension is unknown.</help>
+            </field>
+        </subtab>
+        <subtab id="nginx-general-webgui" description="GUI Settings">
+            <field>
+                <id>nginx.webgui.limitnetworks</id>
+                <label>Limit Networks</label>
+                <type>checkbox</type>
+                <help>Limit networks to directly connected networks. Enabling this option is recommended if your nginx instance is reachable via the internet to prevent remote access to the web interface for security reasons. Please note that you can lock yourself out if you are accessing OPNsense via a router without SNAT.</help>
+            </field>
+        </subtab>
+    </tab>
+    <!--
+    <tab id="nginx-mail" description="E-Mail">
+        <subtab id="nginx-mail-pop3" description="POP3">
+            <field>
+                <id>nginx.mail.pop.enabled</id>
+                <label>Enable sendfile</label>
+                <type>checkbox</type>
+                <help>Enable sendfile support (faster).</help>
+            </field>
+        </subtab>
+        <subtab id="nginx-mail-pop3" description="IMAP">
+            <field>
+                <id>nginx.mail.imap.enabled</id>
+                <label>Enable sendfile</label>
+                <type>checkbox</type>
+                <help>Enable sendfile support (faster).</help>
+            </field>
+        </subtab>
+    </tab>
+    -->
+    <activetab>nginx-general-settings</activetab>
+</form>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/upstream.xml

@@ -0,0 +1,13 @@
+<form>
+  <field>
+    <id>upstream.description</id>
+    <label>Description</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>upstream.serverentries</id>
+    <label>Server Entries</label>
+    <style>selectpicker</style>
+    <type>select_multiple</type>
+  </field>
+</form>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/upstream_server.xml

@@ -0,0 +1,42 @@
+<form>
+  <field>
+    <id>upstream_server.description</id>
+    <label>Beschreibung</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>upstream_server.server</id>
+    <label>Server</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>upstream_server.port</id>
+    <label>Port</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>upstream_server.priority</id>
+    <label>Server Priority</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>upstream_server.max_conns</id>
+    <label>Maximum Connections</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>upstream_server.max_fails</id>
+    <label>Maximum Failures</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>upstream_server.fail_timeout</id>
+    <label>Fail Timeout</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>upstream_server.no_use</id>
+    <label>Do Not Use</label>
+    <type>dropdown</type>
+  </field>
+</form>

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/userlist.xml

@@ -0,0 +1,12 @@
+<form>
+  <field>
+    <id>userlist.name</id>
+    <label>Name</label>
+    <type>text</type>
+  </field>
+  <field>
+    <id>userlist.users</id>
+    <label>Users</label>
+    <type>select_multiple</type>
+  </field>
+</form>

www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/ACL/ACL.xml

@@ -0,0 +1,9 @@
+<acl>
+  <page-Nginx>
+    <name>nginx</name>
+    <patterns>
+      <pattern>ui/nginx/*</pattern>
+      <pattern>api/nginx/*</pattern>
+    </patterns>
+  </page-Nginx>
+</acl>