Policy in Git
Export the current configuration as YAML, version it, change it through pull requests and review changes like code.
GitOps
Keep ToutWAF's policy as files in Git: export, validate, compare, test, simulate, then apply and publish from CI. An Ansible role installs the nodes; the Terraform provider is not shipped yet.
Where to find it in the console : Command line: toutwafctl policy and toutwafctl test; console: Policies (versions, comparison, approval).
What it is for
Detect drift
policy diff exits with code 3 when changes are pending, like git diff --exit-code: a nightly job sees whether someone changed the console.
Test before applying
Schema and DSL validation, rule tests with JUnit output, simulation on stored real traffic.
Roll back
Policy versions can be listed, published and rolled back with one command; each version has its comparison.
A typical workflow
The same commands serve GitHub Actions, GitLab CI, Jenkins and others.
1. Export
toutwafctl policy export -o policy.yaml, as YAML or JSON, for everything or for one site.
2. Validate
toutwafctl policy validate -f policy.yaml: the schema and the DSL are checked.
3. Compare
toutwafctl policy diff -f policy.yaml: 0 for no change, 3 with changes pending, 1 if the file is invalid.
4. Test and simulate
toutwafctl test and toutwafctl simulate, with a JUnit report for CI.
5. Apply and publish
toutwafctl policy apply -f policy.yaml --publish --comment “PR 123”. Without --prune, apply only adds and changes; with --prune it deletes what is absent from the file.
6. A minimal token
The CI token carries only policy:read, policy:write, policy:publish, apps:read, rules:read (and exceptions:write if the file contains exceptions), with an expiry.
What exists
Covered by the product's tests.
- Export, validation, comparison, apply, publish and rollback on the command line.
- Four-eyes approval before a version goes live, in the console.
- An Ansible role that wraps the installer: version, group, enrolment token, policy and node configuration, with validation before writing.
- A Helm chart with the policy as a hot-reloaded ConfigMap.
What does not exist yet
Said plainly.
- The Terraform provider is a skeleton: the REST client works, but not the Terraform resource layer. Meanwhile call toutwafctl from Terraform or manage the policy file as code.
- No published GitHub Action exists: the workflow above (a few toutwafctl commands) is the supported pattern.
- The Kubernetes operator is a skeleton: the resource definitions and the translation library exist, not the controller or its image.
What is not done, or not proven
We prefer to say it plainly.
- The Ansible role, Helm chart and manifest files come with your ToutWAF distribution, not in the public repository, which holds binaries and installers only.
- A simulation replays stored events; it does not prove what will happen on future traffic.
- “apply --prune” deletes objects: read the comparison before using it in CI.
Use cases
A policy reviewed like code
Every change goes through a pull request, tests and a simulation before being published.
A fleet driven from Git
Nodes are installed by Ansible with a policy in group variables, validated before it is written.
Watch for drift
A nightly job compares the file with the console and warns if the gap is not zero.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
РедакцияБесплатно Входит во все предложения, включая оба бесплатных (Free и Free +)Pro и выше Платные предложения: видна в консоли, без лицензии заблокирована. Начиная с Pro, если не указано Agency или Enterprise
Правила, политика и развёртывание
- Политика как код: экспорт, проверка, сравнение и применение YAML или JSON из CIБесплатно
- Версии, структурированное сравнение и откат за один шагБесплатно
- Утверждение «четыре глаза» перед запуском версииБесплатно
Интеграции
- Файлы политики для Git и CI, роль Ansible, чарт Helm и клиент API для TerraformБесплатно
Вернуться к значению по умолчанию для расширенной опции можно всегда. Что происходит по окончании платной лицензии, описано в вопросах и ответах о тарифах: 48 часов льготного периода, 48 часов только для чтения, затем защита WAF отключается до продления.
Поставьте щит перед вашими приложениями уже сегодня
Установите его на собственный сервер или напишите нам, чтобы обсудить лицензии.