From 884c52a8f3e1427cb0bf0c417f5b1328c756dfcf Mon Sep 17 00:00:00 2001
From: Debian <linux@myhorse.netcell-it.de>
Date: Tue, 2 Jun 2026 22:30:17 +0200
Subject: [PATCH] =?UTF-8?q?fix(waf):=20continue-on-error=20+=20timeout=201?=
 =?UTF-8?q?s=20+=20alle=20CRS-Dateien=20=E2=80=94=20v1.2.73?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- SPOE-Config: option continue-on-error — HAProxy blockt nie wegen
  SPOE-Timeout (z.B. CRS-Engine-Load beim ersten Request). Ohne dieses
  Flag waren alle Requests geblockt wenn der WAF-Agent kurz nicht
  antwortete, auch für Domains ohne WAF-Konfiguration.
- SPOE-Config: timeout processing 50ms → 1s — CRS-Load braucht >50ms
- postinst: *.conf → * beim CRS-Copy — .data-Dateien wurden nicht
  mitkopiert, SecRule @pmFromFile scanners-user-agents.data fehlte

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 VERSION                                       |  2 +-
 internal/haproxy/haproxy.go                   | 29 ++++++++++++-------
 .../debian/edgeguard-api/DEBIAN/postinst      |  2 +-
 3 files changed, 20 insertions(+), 13 deletions(-)

diff --git a/VERSION b/VERSION
index 258bf89..03fcdbc 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.2.72
+1.2.73
diff --git a/internal/haproxy/haproxy.go b/internal/haproxy/haproxy.go
index da92551..b5acba1 100644
--- a/internal/haproxy/haproxy.go
+++ b/internal/haproxy/haproxy.go
@@ -142,19 +142,26 @@ func (g *Generator) Render(ctx context.Context) error {
 }
 
 // spoeCfg is the static SPOE configuration for edgeguard-waf.
-// It tells HAProxy which variables to forward and where the agent listens.
+// HAProxy 3.x format: [<engine-name>] section + spoe-agent / spoe-message
+// (no square brackets around spoe-agent/spoe-message keywords).
+// spoeCfg uses `option continue-on-error` so that HAProxy never blocks
+// a request when the SPOE agent is slow or unavailable. Without this,
+// a timeout during CRS engine initialization would block all traffic,
+// including domains without WAF configured.
 const spoeCfg = `# Generated by edgeguard-api. DO NOT EDIT.
-[spoe-agent edgeguard-waf-agent]
-messages    edgeguard-waf-req
-option      var-prefix waf
-timeout     hello      100ms
-timeout     idle       30s
-timeout     processing 50ms
-use-backend spoe-edgeguard-waf
+[edgeguard-waf]
+spoe-agent edgeguard-waf-agent
+    messages        edgeguard-waf-req
+    option          var-prefix waf
+    option          continue-on-error
+    timeout         hello      100ms
+    timeout         idle       30s
+    timeout         processing 1s
+    use-backend     spoe-edgeguard-waf
 
-[spoe-message edgeguard-waf-req]
-args src=src method=method uri=url ver=req.ver headers=req.hdrs host=req.hdr(host)
-event on-frontend-http-request
+spoe-message edgeguard-waf-req
+    args src=src method=method uri=url ver=req.ver headers=req.hdrs host=req.hdr(host)
+    event on-frontend-http-request
 `
 
 // View is what the template consumes. Routes per domain are pre-
diff --git a/packaging/debian/edgeguard-api/DEBIAN/postinst b/packaging/debian/edgeguard-api/DEBIAN/postinst
index 78a72c4..89320be 100755
--- a/packaging/debian/edgeguard-api/DEBIAN/postinst
+++ b/packaging/debian/edgeguard-api/DEBIAN/postinst
@@ -812,7 +812,7 @@ EOSQL
                 CRS_SRC="${CRS_TMP}/coreruleset-${CRS_VERSION}"
                 if [ -f "${CRS_SRC}/crs-setup.conf.example" ]; then
                     install -m 0644 "${CRS_SRC}/crs-setup.conf.example" "${WAF_CRS_DIR}/crs-setup.conf"
-                    install -m 0644 "${CRS_SRC}/rules/"*.conf "${WAF_CRS_DIR}/rules/" 2>/dev/null || true
+                    install -m 0644 "${CRS_SRC}/rules/"* "${WAF_CRS_DIR}/rules/" 2>/dev/null || true
                     chown -R "$EG_USER":"$EG_USER" "$WAF_CRS_DIR"
                     echo "postinst: OWASP CRS v${CRS_VERSION} installed to ${WAF_CRS_DIR}"
                 else