Policy in Git
Export the current configuration as YAML, version it, change it through pull requests and review changes like code.
GitOps
Keep ToutWAF's policy as files in Git: export, validate, compare, test, simulate, then apply and publish from CI. An Ansible role installs the nodes; the Terraform provider is not shipped yet.
Where to find it in the console : Command line: toutwafctl policy and toutwafctl test; console: Policies (versions, comparison, approval).
What it is for
Detect drift
policy diff exits with code 3 when changes are pending, like git diff --exit-code: a nightly job sees whether someone changed the console.
Test before applying
Schema and DSL validation, rule tests with JUnit output, simulation on stored real traffic.
Roll back
Policy versions can be listed, published and rolled back with one command; each version has its comparison.
A typical workflow
The same commands serve GitHub Actions, GitLab CI, Jenkins and others.
1. Export
toutwafctl policy export -o policy.yaml, as YAML or JSON, for everything or for one site.
2. Validate
toutwafctl policy validate -f policy.yaml: the schema and the DSL are checked.
3. Compare
toutwafctl policy diff -f policy.yaml: 0 for no change, 3 with changes pending, 1 if the file is invalid.
4. Test and simulate
toutwafctl test and toutwafctl simulate, with a JUnit report for CI.
5. Apply and publish
toutwafctl policy apply -f policy.yaml --publish --comment “PR 123”. Without --prune, apply only adds and changes; with --prune it deletes what is absent from the file.
6. A minimal token
The CI token carries only policy:read, policy:write, policy:publish, apps:read, rules:read (and exceptions:write if the file contains exceptions), with an expiry.
What exists
Covered by the product's tests.
- Export, validation, comparison, apply, publish and rollback on the command line.
- Four-eyes approval before a version goes live, in the console.
- An Ansible role that wraps the installer: version, group, enrolment token, policy and node configuration, with validation before writing.
- A Helm chart with the policy as a hot-reloaded ConfigMap.
What does not exist yet
Said plainly.
- The Terraform provider is a skeleton: the REST client works, but not the Terraform resource layer. Meanwhile call toutwafctl from Terraform or manage the policy file as code.
- No published GitHub Action exists: the workflow above (a few toutwafctl commands) is the supported pattern.
- The Kubernetes operator is a skeleton: the resource definitions and the translation library exist, not the controller or its image.
What is not done, or not proven
We prefer to say it plainly.
- The Ansible role, Helm chart and manifest files come with your ToutWAF distribution, not in the public repository, which holds binaries and installers only.
- A simulation replays stored events; it does not prove what will happen on future traffic.
- “apply --prune” deletes objects: read the comparison before using it in CI.
Use cases
A policy reviewed like code
Every change goes through a pull request, tests and a simulation before being published.
A fleet driven from Git
Nodes are installed by Ansible with a policy in group variables, validated before it is written.
Watch for drift
A nightly job compares the file with the console and warns if the gap is not zero.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiçãoGratuito Incluído em todas as ofertas, incluindo as duas gratuitas (Free e Free +)Pro e superiores Ofertas pagas: visível na consola, bloqueada sem licença. A partir do Pro, salvo indicação Agency ou Enterprise
Regras, política e implementação
- Política como código: exportar, validar, comparar e aplicar YAML ou JSON a partir da CIGratuito
- Versões, diferença estruturada e reversão num só passoGratuito
- Aprovação a quatro olhos antes de uma versão entrar em produçãoGratuito
Integrações
- Ficheiros de política para Git e CI, um papel Ansible, um chart Helm e um cliente de API para TerraformGratuito
Voltar ao valor predefinido de uma opção avançada é sempre possível. O que acontece no fim de uma licença paga está descrito nas perguntas frequentes de preços: 48 horas de tolerância, 48 horas só de leitura e depois a proteção WAF é desativada até à renovação.
Coloque hoje um escudo à frente das suas aplicações
Instale-o no seu próprio servidor, ou contacte-nos para falar de licenças.