Policy in Git
Export the current configuration as YAML, version it, change it through pull requests and review changes like code.
GitOps
Keep ToutWAF's policy as files in Git: export, validate, compare, test, simulate, then apply and publish from CI. An Ansible role installs the nodes; the Terraform provider is not shipped yet.
Where to find it in the console : Command line: toutwafctl policy and toutwafctl test; console: Policies (versions, comparison, approval).
What it is for
Detect drift
policy diff exits with code 3 when changes are pending, like git diff --exit-code: a nightly job sees whether someone changed the console.
Test before applying
Schema and DSL validation, rule tests with JUnit output, simulation on stored real traffic.
Roll back
Policy versions can be listed, published and rolled back with one command; each version has its comparison.
A typical workflow
The same commands serve GitHub Actions, GitLab CI, Jenkins and others.
1. Export
toutwafctl policy export -o policy.yaml, as YAML or JSON, for everything or for one site.
2. Validate
toutwafctl policy validate -f policy.yaml: the schema and the DSL are checked.
3. Compare
toutwafctl policy diff -f policy.yaml: 0 for no change, 3 with changes pending, 1 if the file is invalid.
4. Test and simulate
toutwafctl test and toutwafctl simulate, with a JUnit report for CI.
5. Apply and publish
toutwafctl policy apply -f policy.yaml --publish --comment “PR 123”. Without --prune, apply only adds and changes; with --prune it deletes what is absent from the file.
6. A minimal token
The CI token carries only policy:read, policy:write, policy:publish, apps:read, rules:read (and exceptions:write if the file contains exceptions), with an expiry.
What exists
Covered by the product's tests.
- Export, validation, comparison, apply, publish and rollback on the command line.
- Four-eyes approval before a version goes live, in the console.
- An Ansible role that wraps the installer: version, group, enrolment token, policy and node configuration, with validation before writing.
- A Helm chart with the policy as a hot-reloaded ConfigMap.
What does not exist yet
Said plainly.
- The Terraform provider is a skeleton: the REST client works, but not the Terraform resource layer. Meanwhile call toutwafctl from Terraform or manage the policy file as code.
- No published GitHub Action exists: the workflow above (a few toutwafctl commands) is the supported pattern.
- The Kubernetes operator is a skeleton: the resource definitions and the translation library exist, not the controller or its image.
What is not done, or not proven
We prefer to say it plainly.
- The Ansible role, Helm chart and manifest files come with your ToutWAF distribution, not in the public repository, which holds binaries and installers only.
- A simulation replays stored events; it does not prove what will happen on future traffic.
- “apply --prune” deletes objects: read the comparison before using it in CI.
Use cases
A policy reviewed like code
Every change goes through a pull request, tests and a simulation before being published.
A fleet driven from Git
Nodes are installed by Ansible with a policy in group variables, validated before it is written.
Watch for drift
A nightly job compares the file with the console and warns if the gap is not zero.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionFree Included in every offer, including both free offers (Free and Free +)Pro and above Paid offers: visible in the console, locked without a licence. From Pro, unless Agency or Enterprise is shown
Rules, policy and rollout
- Policy as code: export, validate, diff and apply YAML or JSON from CIFree
- Versions, structured diff and one-step rollbackFree
- Four-eyes approval before a version goes liveFree
Integrations
- Policy files for Git and CI, an Ansible role, a Helm chart and an API client for TerraformFree
Going back to the default of an advanced option is always possible. What happens when a paid licence ends is described in the pricing FAQ: 48 hours of grace, 48 hours of read-only, then WAF protection is switched off until renewal.
Pricing Read the documentation
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.