Arx on the network: remaining gaps
Imported from GitHub issue El-SaMa/lamoi-waas#26 by @El-SaMa.
Done 2026-10-14: Arx agents on waas-prod/waas-stg (OMA Admin, Arx security), Bot Control gate in nginx (fail-open), web firewall ModSecurity + CRS 3.3.7 DetectionOnly with WordPress exclusions, per-subsite OMA service (adapter waas) with Bot Control policy (standard, watch only) and WAF host mapping, lifecycle suspend/unsuspend/terminate drives the subsite. Agent 0.9.3: Shield installs on Debian 13.
Open:
- Nightly scheduled malware scan of /var/www/waas (today: manual
queue_job malware_scan {path}); results per subsite (uploads/sites/<blog_id>). - Upload watch (realtime) for the multisite layout: needs clamd on waas-prod and agent support for
/var/www/waas/wp-content/uploads/sites/<id>mapped to the subsite service. - Staff WAF exclusions (
oma.admin_arx_waf exclude) are written through Enhance only; write them to the network's/etc/modsecurity/crs/REQUEST-900-...too. - Per-site WAF block (
web_firewall) for subsites: needs a per-hostSecRuleEngine Oninclude managed from OMA. - CRS 4 parity with the fleet (Debian ships 3.3.7) and the WooCommerce exclusions once shops go live.
- Shield block mode on the network after a week of detect review (nilek-first rule).
- Customer "My site" page shows Arx status (with #9).