Policy in Git
Export the current configuration as YAML, version it, change it through pull requests and review changes like code.
GitOps
Keep ToutWAF's policy as files in Git: export, validate, compare, test, simulate, then apply and publish from CI. An Ansible role installs the nodes; the Terraform provider is not shipped yet.
Where to find it in the console : Command line: toutwafctl policy and toutwafctl test; console: Policies (versions, comparison, approval).
What it is for
Detect drift
policy diff exits with code 3 when changes are pending, like git diff --exit-code: a nightly job sees whether someone changed the console.
Test before applying
Schema and DSL validation, rule tests with JUnit output, simulation on stored real traffic.
Roll back
Policy versions can be listed, published and rolled back with one command; each version has its comparison.
A typical workflow
The same commands serve GitHub Actions, GitLab CI, Jenkins and others.
1. Export
toutwafctl policy export -o policy.yaml, as YAML or JSON, for everything or for one site.
2. Validate
toutwafctl policy validate -f policy.yaml: the schema and the DSL are checked.
3. Compare
toutwafctl policy diff -f policy.yaml: 0 for no change, 3 with changes pending, 1 if the file is invalid.
4. Test and simulate
toutwafctl test and toutwafctl simulate, with a JUnit report for CI.
5. Apply and publish
toutwafctl policy apply -f policy.yaml --publish --comment “PR 123”. Without --prune, apply only adds and changes; with --prune it deletes what is absent from the file.
6. A minimal token
The CI token carries only policy:read, policy:write, policy:publish, apps:read, rules:read (and exceptions:write if the file contains exceptions), with an expiry.
What exists
Covered by the product's tests.
- Export, validation, comparison, apply, publish and rollback on the command line.
- Four-eyes approval before a version goes live, in the console.
- An Ansible role that wraps the installer: version, group, enrolment token, policy and node configuration, with validation before writing.
- A Helm chart with the policy as a hot-reloaded ConfigMap.
What does not exist yet
Said plainly.
- The Terraform provider is a skeleton: the REST client works, but not the Terraform resource layer. Meanwhile call toutwafctl from Terraform or manage the policy file as code.
- No published GitHub Action exists: the workflow above (a few toutwafctl commands) is the supported pattern.
- The Kubernetes operator is a skeleton: the resource definitions and the translation library exist, not the controller or its image.
What is not done, or not proven
We prefer to say it plainly.
- The Ansible role, Helm chart and manifest files come with your ToutWAF distribution, not in the public repository, which holds binaries and installers only.
- A simulation replays stored events; it does not prove what will happen on future traffic.
- “apply --prune” deletes objects: read the comparison before using it in CI.
Use cases
A policy reviewed like code
Every change goes through a pull request, tests and a simulation before being published.
A fleet driven from Git
Nodes are installed by Ansible with a policy in group variables, validated before it is written.
Watch for drift
A nightly job compares the file with the console and warns if the gap is not zero.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditieGratis Inbegrepen in alle aanbiedingen, ook in de twee gratis (Free en Free +)Pro en hoger Betaalde aanbiedingen: zichtbaar in de console, vergrendeld zonder licentie. Vanaf Pro, tenzij Agency of Enterprise staat vermeld
Regels, beleid en uitrol
- Beleid als code: YAML of JSON exporteren, valideren, vergelijken en toepassen vanuit CIGratis
- Versies, gestructureerde diff en terugdraaien in één stapGratis
- Vierogenprincipe: goedkeuring voordat een versie live gaatGratis
Integraties
- Beleidsbestanden voor Git en CI, een Ansible-rol, een Helm-chart en een API-client voor TerraformGratis
Terugkeren naar de standaardwaarde van een geavanceerde optie is altijd mogelijk. Wat er aan het einde van een betaalde licentie gebeurt, staat in de veelgestelde vragen over de prijzen: 48 uur coulance, 48 uur alleen-lezen, daarna staat de WAF-bescherming uit tot de verlenging.
Prijzen Read the documentation
Zet vandaag nog een schild voor uw applicaties
Installeer het op uw eigen server, of neem contact met ons op om over licenties te praten.