Adding Modsecurity

[allupaku]

Adding mod security module to nginx with default owas common rule set from https://github.com/SpiderLabs/owasp-modsecurity-crs/

[csandanov]

Thank you for the PR. A few things to correct:

1. You checkout modsecurity git repo branch v3 that I assume contains all changes for 3.x tags. Since we try to freeze all dependencies for stability sake, you should instead checkout the latest stable tag (move version to env vars)
2. It's ok to have module enabled by default but I think it should be possible to disable it via something like $NGINX_DISABLE_MODSECURITY (add to README)
3. The file /etc/nginx/modsec/main.conf isn't a template and probably should be generated during the build
4. Add modsecurity module in README (mention OWASP) with the version

[csandanov]

I've just noticed you also install packages that are not deleted:

        doxygen \
        geoip \
        yajl \
        libstdc++ \
        sed \
        curl \
        libmaxminddb-dev; \

are those required runtime packages? do we really need all of them?

[allupaku]

@csandanov Hi , Sorry that should have been moved to the other modsecurity build deps, which will get removed. I tested it and also added some more configuration options.
On another note : I think default behavior of mod security being on may break many installations without fine tuning the filtering capabilities. Hence i made some changes and pushed to my repository with documentation as well. Could you please have a look when your time permits ? here

[csandanov]

Are you sure none of the packages needed in runtime? Could you please create a new PR and describe what are the cases when it breaks something and why, I know very little about mod_security configuration. Thank you