Skip to content

Deployment of the Wallarm node Docker image to Azure

This quick guide provides the steps to deploy the Docker image of the NGINX-based Wallarm node to the Microsoft Azure cloud platform using the Azure Container Instances service.

The instructions limitations

These instructions do not cover the configuration of load balancing and node autoscaling. If setting up these components yourself, we recommend that you read the documentation on Azure Application Gateway.

Requirements

  • Active Azure subscription

  • Azure CLI installed

  • Access to the account with the Administrator or Deploy role and two‑factor authentication disabled in the Wallarm Console for the EU Cloud or US Cloud

Options for the Wallarm node Docker container configuration

The filtering node configuration parameters should be passed to the deployed Docker container in one of the following ways:

  • In the environment variables. This option allows for the configuration of only basic filtering node parameters. Most directives cannot be configured through environment variables.

  • In the mounted configuration file. This option allows full filtering node configuration via any directives. With this configuration method, environment variables with the filtering node and Wallarm Cloud connection settings are also passed to the container.

Deploying the Wallarm node Docker container configured through environment variables

To deploy the containerized Wallarm filtering node configured only through environment variables, you can use the following tools:

In these instructions, the container is deployed using the Azure CLI as follows:

  1. Sign in to the Azure CLI by using the az login command:

    az login
    
  2. Create a resource group by using the az group create command. For example, create the group myResourceGroup in the East US region with the following command:

    az group create --name myResourceGroup --location eastus
    
  3. Set local environment variables with email and password used for authentication in the Wallarm Cloud:

    export DEPLOY_USER='<DEPLOY_USER>'
    export DEPLOY_PASSWORD='<DEPLOY_PASSWORD>'
    
    • <DEPLOY_USER>: email to the Deploy or Administrator user account in the Wallarm Console.
    • <DEPLOY_PASSWORD>: password to the Deploy or Administrator user account in the Wallarm Console.
  4. Create an Azure resource from the Wallarm node Docker container by using the az container create command:

    az container create \
       --resource-group myResourceGroup \
       --name waf-node \
       --dns-name-label wallarm-waf \
       --ports 80 \
       --image registry-1.docker.io/wallarm/node:3.2.1-1 \
       --environment-variables DEPLOY_USER=${DEPLOY_USER} DEPLOY_PASSWORD=${DEPLOY_PASSWORD} NGINX_BACKEND='example.com'
    
    az container create \
       --resource-group myResourceGroup \
       --name waf-node \
       --dns-name-label wallarm-waf \
       --ports 80 \
       --image registry-1.docker.io/wallarm/node:3.2.1-1 \
       --environment-variables DEPLOY_USER=${DEPLOY_USER} DEPLOY_PASSWORD=${DEPLOY_PASSWORD} NGINX_BACKEND='example.com' WALLARM_API_HOST='us1.api.wallarm.com'
    
    • --resource-group: name of the resource group created in the second step.
    • --name: name of the container.
    • --dns-name-label: DNS name label for the container.
    • --ports: port on which the filtering node listens.
    • --image: name of the Wallarm node Docker image.
    • --environment-variables: environment variables with the filtering node configuration (available variables are listed in the table below). Please note that it is not recommended to pass the values of DEPLOY_USER and DEPLOY_PASSWORD explicitly.

      Environment variable Description Required
      DEPLOY_USER Email to the Deploy or Administrator user account in the Wallarm Console. Yes
      DEPLOY_PASSWORD Password to the Deploy or Administrator user account in the Wallarm Console. Yes
      NGINX_BACKEND Domain or IP address of the resource to protect with Wallarm API Security. Yes
      WALLARM_API_HOST Wallarm API server:
      • api.wallarm.com for the EU Cloud
      • us1.api.wallarm.com for the US Cloud
      By default: api.wallarm.com.
      No
      WALLARM_MODE Node mode:
      • block to block malicious requests
      • safe_blocking to block only those malicious requests originated from greylisted IP addresses
      • monitoring to analyze but not block requests
      • off to disable traffic analyzing and processing
      By default: monitoring.
      Detailed description of filtration modes →
      No
      TARANTOOL_MEMORY_GB Amount of memory allocated to Tarantool. The value can be an integer or a float (a dot . is a decimal separator). By default: 0.2 gygabytes. No
      DEPLOY_FORCE Replaces an existing Wallarm node with a new one if an existing Wallarm node name matches the identifier of the container you are running. The following values can be assigned to a variable:
      • true to replace the filtering node
      • false to disable the replacement of the filtering node
      Default value (if the variable is not passed to the container) is false.
      The Wallarm node name always matches the identifier of the container you are running. Filtering node replacement is helpful if the Docker container identifiers in your environment are static and you are trying to run another Docker container with the filtering node (for example, a container with a new version of the image). If in this case the variable value is false, the filtering node creation process will fail.
      No
  5. Open the Azure portal and ensure the created resource is displayed in the list of resources.

  6. Test the filtering node operation.

Deploying the Wallarm node Docker container configured through the mounted file

To deploy the containerized Wallarm filtering node configured through environment variables and mounted file, only Azure CLI can be used.

To deploy the container with environment variables and mounted configuration file:

  1. Sign in to the Azure CLI by using the az login command:

    az login
    
  2. Create a resource group by using the az group create command. For example, create the group myResourceGroup in the East US region with the following command:

    az group create --name myResourceGroup --location eastus
    
  3. Create a configuration file with the filtering node settings locally. A example of the file with minimal settings:

    server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;
        #listen 443 ssl;
    
        server_name localhost;
    
        #ssl_certificate cert.pem;
        #ssl_certificate_key cert.key;
    
        root /usr/share/nginx/html;
    
        index index.html index.htm;
    
        wallarm_mode monitoring;
        # wallarm_instance 1;
    
        location / {
                proxy_pass http://example.com;
                include proxy_params;
        }
    }
    

    Set of filtering node directives that can be specified in the configuration file →

  4. Locate the configuration file in one of the ways suitable for mounting data volumes in Azure. All methods are described in the Mount data volumes section of the Azure documentation.

    In these instructions, the configuration file is mounted from the Git repository.

  5. Set local environment variables with email and password used for authentication in the Wallarm Cloud:

    export DEPLOY_USER='<DEPLOY_USER>'
    export DEPLOY_PASSWORD='<DEPLOY_PASSWORD>'
    
    • <DEPLOY_USER>: email to the Deploy or Administrator user account in the Wallarm Console.
    • <DEPLOY_PASSWORD>: password to the Deploy or Administrator user account in the Wallarm Console.
  6. Create an Azure resource from the Wallarm node Docker container by using the az container create command:

    az container create \
       --resource-group myResourceGroup \
       --name waf-node \
       --dns-name-label wallarm-waf \
       --ports 80 \
       --image registry-1.docker.io/wallarm/node:3.2.1-1 \
       --gitrepo-url <URL_OF_GITREPO> \
       --gitrepo-mount-path /etc/nginx/sites-enabled \
       --environment-variables DEPLOY_USER=${DEPLOY_USER} DEPLOY_PASSWORD=${DEPLOY_PASSWORD}
    
    az container create \
       --resource-group myResourceGroup \
       --name waf-node \
       --dns-name-label wallarm-waf \
       --ports 80 \
       --image registry-1.docker.io/wallarm/node:3.2.1-1 \
       --gitrepo-url <URL_OF_GITREPO> \
       --gitrepo-mount-path /etc/nginx/sites-enabled \
       --environment-variables DEPLOY_USER=${DEPLOY_USER} DEPLOY_PASSWORD=${DEPLOY_PASSWORD} WALLARM_API_HOST='us1.api.wallarm.com'
    
    • --resource-group: name of the resource group created in the 2nd step.
    • --name: name of the container.
    • --dns-name-label: DNS name label for the container.
    • --ports: port on which the filtering node listens.
    • --image: name of the Wallarm node Docker image.
    • --gitrepo-url: URL of the Git repository containing the configuration file. If the file is located in the repository root, you need to pass only this parameter. If the file is located in a separate Git repository directory, please also pass the path to the directory in the --gitrepo-dir parameter (for example,
      --gitrepo-dir ./dir1).
    • --gitrepo-mount-path: directory of the container to mount the configuration file to. Configuration files can be mounted to the following container directories used by NGINX:

      • /etc/nginx/conf.d — common settings
      • /etc/nginx/sites-enabled — virtual host settings
      • /var/www/html — static files

      The filtering node directives should be described in the /etc/nginx/sites-enabled/default file.

    • --environment-variables: environment variables containing settings for the filtering node and Wallarm Cloud connection (available variables are listed in the table below). Please note that it is not recommended to explicitly pass the values of DEPLOY_USER and DEPLOY_PASSWORD.

      Environment variable Description Required
      DEPLOY_USER Email to the Deploy or Administrator user account in the Wallarm Console. Yes
      DEPLOY_PASSWORD Password to the Deploy or Administrator user account in the Wallarm Console. Yes
      WALLARM_API_HOST Wallarm API server:
      • api.wallarm.com for the EU Cloud
      • us1.api.wallarm.com for the US Cloud
      By default: api.wallarm.com.
      No
      DEPLOY_FORCE Replaces an existing Wallarm node with a new one if an existing Wallarm node name matches the identifier of the container you are running. The following values can be assigned to a variable:
      • true to replace the filtering node
      • false to disable the replacement of the filtering node
      Default value (if the variable is not passed to the container) is false.
      The Wallarm node name always matches the identifier of the container you are running. Filtering node replacement is helpful if the Docker container identifiers in your environment are static and you are trying to run another Docker container with the filtering node (for example, a container with a new version of the image). If in this case the variable value is false, the filtering node creation process will fail.
      No
  7. Open the Azure portal and ensure the created resource is displayed in the list of resources.

  8. Test the filtering node operation.

Testing the filtering node operation

  1. Open the created resource on the Azure portal and copy the FQDN value.

    Settig up container instance

    If the FQDN field is empty, please ensure the container is in the Running status.

  2. Send the request with test SQLI and XSS attacks to the copied domain:

    curl http://<COPIED_DOMAIN>/?id='or+1=1--a-<script>prompt(1)</script>'
    
  3. Open the Wallarm Console → Events section in the EU Cloud or US Cloud and ensure attacks are displayed in the list.

    Attacks in UI

Details on errors occurred during the container deployment are displayed on the ContainersLogs tab of the resource details on the Azure portal. If the resource is unavailable, please ensure required filtering node parameters with correct values are passed to the container.