From 56468d336638480d4119b9e141076ce0456f25d1 Mon Sep 17 00:00:00 2001
From: admin <admin@sechpoint.com>
Date: Sun, 2 Aug 2026 06:33:07 +0000
Subject: [PATCH] feat: nginx with Wallarm module in systemd, wallarm-status
 endpoint

---
 internal/native/native.go | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/internal/native/native.go b/internal/native/native.go
index fcd5176..852a320 100644
--- a/internal/native/native.go
+++ b/internal/native/native.go
@@ -182,15 +182,18 @@ After=network.target
 Type=simple
 WorkingDirectory=%s/%%i/wallarm
 EnvironmentFile=-%s/%%i/wallarm/env.list
+ExecStartPre=%s/%%i/wallarm/nginx/sbin/nginx -c %s/%%i/wallarm/nginx/conf/nginx.conf -p %s/%%i/wallarm/nginx/ 2>/dev/null || true
+ExecStartPre=/bin/sleep 2
 ExecStart=%s/%%i/wallarm/usr/bin/python3.10 %s/%%i/wallarm/usr/bin/supervisord -c %s/%%i/wallarm/etc/supervisord.conf
 ExecStop=%s/%%i/wallarm/usr/bin/python3.10 %s/%%i/wallarm/usr/bin/supervisord -c %s/%%i/wallarm/etc/supervisord.conf shutdown
+ExecStopPost=%s/%%i/wallarm/nginx/sbin/nginx -s quit -p %s/%%i/wallarm/nginx/ 2>/dev/null || true
 Restart=on-failure
 RestartSec=5
 User=root
 
 [Install]
 WantedBy=multi-user.target
-`, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir)
+`, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir, BaseDir)
 	os.WriteFile(tmpl, []byte(content), 0644)
 	exec.Command("systemctl", "daemon-reload").Run()
 	return nil
@@ -213,20 +216,39 @@ func startNginx(dir string, node state.Node, port string) {
 	confDir := filepath.Join(nginxDir, "conf")
 	os.MkdirAll(confDir, 0755)
 	confPath := filepath.Join(confDir, "nginx.conf")
+	upstream := fmt.Sprintf("%s:%d", node.UpstreamIP, node.UpstreamPort)
+	if node.UpstreamIP == "" {
+		upstream = "127.0.0.1:80"
+	}
 	os.WriteFile(confPath, []byte(fmt.Sprintf(`
+load_module %s/modules/nginx_v1.26.3_s0ff5dffff/ngx_http_wallarm_module.so;
+
 worker_processes auto;
 pid %s/nginx.pid;
 error_log %s/error.log;
 events { worker_connections 10240; }
 http {
     access_log %s/access.log;
+    wallarm_mode monitoring;
+
     server {
         listen %s;
         server_name _;
-        location /health { return 200; }
+
+        location /wallarm-status {
+            wallarm_status on;
+            allow 127.0.0.0/8;
+            deny all;
+        }
+
+        location / {
+            proxy_pass http://%s;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
     }
 }
-`, nginxDir, nginxDir, nginxDir, port)), 0644)
+`, dir, nginxDir, nginxDir, nginxDir, port, upstream)), 0644)
 
 	bin := filepath.Join(nginxDir, "sbin", "nginx")
 	cmd := exec.Command(bin, "-c", confPath, "-p", nginxDir)