Policy in Git
Export the current configuration as YAML, version it, change it through pull requests and review changes like code.
GitOps
Keep ToutWAF's policy as files in Git: export, validate, compare, test, simulate, then apply and publish from CI. An Ansible role installs the nodes; the Terraform provider is not shipped yet.
Where to find it in the console : Command line: toutwafctl policy and toutwafctl test; console: Policies (versions, comparison, approval).
What it is for
Detect drift
policy diff exits with code 3 when changes are pending, like git diff --exit-code: a nightly job sees whether someone changed the console.
Test before applying
Schema and DSL validation, rule tests with JUnit output, simulation on stored real traffic.
Roll back
Policy versions can be listed, published and rolled back with one command; each version has its comparison.
A typical workflow
The same commands serve GitHub Actions, GitLab CI, Jenkins and others.
1. Export
toutwafctl policy export -o policy.yaml, as YAML or JSON, for everything or for one site.
2. Validate
toutwafctl policy validate -f policy.yaml: the schema and the DSL are checked.
3. Compare
toutwafctl policy diff -f policy.yaml: 0 for no change, 3 with changes pending, 1 if the file is invalid.
4. Test and simulate
toutwafctl test and toutwafctl simulate, with a JUnit report for CI.
5. Apply and publish
toutwafctl policy apply -f policy.yaml --publish --comment “PR 123”. Without --prune, apply only adds and changes; with --prune it deletes what is absent from the file.
6. A minimal token
The CI token carries only policy:read, policy:write, policy:publish, apps:read, rules:read (and exceptions:write if the file contains exceptions), with an expiry.
What exists
Covered by the product's tests.
- Export, validation, comparison, apply, publish and rollback on the command line.
- Four-eyes approval before a version goes live, in the console.
- An Ansible role that wraps the installer: version, group, enrolment token, policy and node configuration, with validation before writing.
- A Helm chart with the policy as a hot-reloaded ConfigMap.
What does not exist yet
Said plainly.
- The Terraform provider is a skeleton: the REST client works, but not the Terraform resource layer. Meanwhile call toutwafctl from Terraform or manage the policy file as code.
- No published GitHub Action exists: the workflow above (a few toutwafctl commands) is the supported pattern.
- The Kubernetes operator is a skeleton: the resource definitions and the translation library exist, not the controller or its image.
What is not done, or not proven
We prefer to say it plainly.
- The Ansible role, Helm chart and manifest files come with your ToutWAF distribution, not in the public repository, which holds binaries and installers only.
- A simulation replays stored events; it does not prove what will happen on future traffic.
- “apply --prune” deletes objects: read the comparison before using it in CI.
Use cases
A policy reviewed like code
Every change goes through a pull request, tests and a simulation before being published.
A fleet driven from Git
Nodes are installed by Ansible with a policy in group variables, validated before it is written.
Watch for drift
A nightly job compares the file with the console and warns if the gap is not zero.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdizioneGratuito Incluso in tutte le offerte, comprese le due gratuite (Free e Free +)Pro e superiori Offerte a pagamento: visibile nella console, bloccata senza licenza. Da Pro, salvo indicazione Agency o Enterprise
Regole, policy e rollout
- Policy come codice: esportare, convalidare, confrontare e applicare YAML o JSON dalla CIGratuito
- Versioni, differenza strutturata e rollback in un passaggioGratuito
- Approvazione a quattro occhi prima della messa in produzione di una versioneGratuito
Integrazioni
- File di policy per Git e CI, un ruolo Ansible, un chart Helm e un client API per TerraformGratuito
Tornare al valore predefinito di un'opzione avanzata è sempre possibile. Che cosa accade alla fine di una licenza a pagamento è descritto nelle domande frequenti sui prezzi: 48 ore di tolleranza, 48 ore di sola lettura, poi la protezione WAF viene disattivata fino al rinnovo.
Metti oggi stesso uno scudo davanti alle tue applicazioni
Installalo sul tuo server, oppure scrivici per parlare di licenze.