feat(lab11): hardened nginx + WAF sidecar - #12

docker compose -f labs/lab11/docker-compose.yml -f labs/lab11/waf/docker-compose.override.yml ps
# Expected: juice, nginx, and waf containers Up; waf healthy

docker compose -f labs/lab11/docker-compose.yml run --rm --entrypoint "nginx -t" nginx
# Expected: nginx configuration file test is successful

curl.exe -sI http://localhost
# Expected: HTTP 308 redirect to https://localhost/

curl.exe -skI https://localhost
# Expected: HTTP 200 with HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and CSP-Report-Only headers

docker run --rm --add-host=host.docker.internal:host-gateway --entrypoint sh alpine/openssl -c "echo | openssl s_client -connect host.docker.internal:443 -tls1_3 -brief 2>&1"
# Expected: Protocol version: TLSv1.3

docker run --rm --add-host=host.docker.internal:host-gateway curlimages/curl:latest sh -c "seq 1 60 | xargs -n1 -P 30 -I{} curl -sk -o /dev/null -w '%{http_code}\n' https://host.docker.internal/rest/user/login 2>/dev/null | sort | uniq -c"
# Expected: many HTTP 429 responses from Nginx rate limiting

curl.exe -sk -o NUL -w "no-waf: HTTP %{http_code}`n" "https://localhost/rest/products/search?q='%20OR%201=1--"
# Expected: request reaches Juice Shop, no WAF block

curl.exe -sk -o NUL -w "with-waf: HTTP %{http_code}`n" "https://localhost:8443/rest/products/search?q='%20OR%201=1--"
# Expected: with-waf: HTTP 403