Fix ModSecurity CRS includes for nginx

README.md

@@ -5,7 +5,7 @@
 
 A modern web hosting control panel for WordPress and general PHP hosting. Built with Laravel 12, Filament v5, Livewire 4, and Tailwind CSS v4.
 
-Version: 0.9-rc29 (release candidate)
+Version: 0.9-rc30 (release candidate)
 
 This is a release candidate. Expect rapid iteration and breaking changes until 1.0.
 
@@ -156,6 +156,7 @@ php artisan test --compact
 
 ## Initial Release
 
+- 0.9-rc30: Avoid IncludeOptional in ModSecurity CRS includes.
 - 0.9-rc29: Ensure ModSecurity unicode mapping is installed automatically.
 - 0.9-rc28: ModSecurity unicode mapping setup fixes.
 - 0.9-rc27: Installers now read VERSION when available.

VERSION

@@ -1 +1 @@
-VERSION=0.9-rc29
+VERSION=0.9-rc30

bin/jabali-agent

@@ -2782,6 +2782,7 @@ function ensureJabaliNginxIncludeFiles(): void
     }
 
     ensureWafUnicodeMapFile();
+    ensureWafMainConfig();
 
     $baseConfig = findWafBaseConfig();
     $shouldDisableWaf = $baseConfig === null;
@@ -2804,6 +2805,50 @@ function ensureJabaliNginxIncludeFiles(): void
     }
 }
 
+function ensureWafMainConfig(): void
+{
+    $path = '/etc/nginx/modsec/main.conf';
+    $dir = dirname($path);
+
+    if (!is_dir($dir)) {
+        @mkdir($dir, 0755, true);
+    }
+
+    $needsRewrite = !file_exists($path);
+    if (!$needsRewrite) {
+        $content = file_get_contents($path);
+        if ($content === false || stripos($content, 'IncludeOptional') !== false || stripos($content, 'owasp-crs.load') !== false) {
+            $needsRewrite = true;
+        }
+    }
+
+    if (!$needsRewrite) {
+        return;
+    }
+
+    $lines = ['Include /etc/modsecurity/modsecurity.conf'];
+
+    if (file_exists('/etc/modsecurity/crs/crs-setup.conf')) {
+        $lines[] = 'Include /etc/modsecurity/crs/crs-setup.conf';
+    } elseif (file_exists('/usr/share/modsecurity-crs/crs-setup.conf')) {
+        $lines[] = 'Include /usr/share/modsecurity-crs/crs-setup.conf';
+    }
+
+    if (file_exists('/etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf')) {
+        $lines[] = 'Include /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf';
+    }
+
+    if (is_dir('/usr/share/modsecurity-crs/rules')) {
+        $lines[] = 'Include /usr/share/modsecurity-crs/rules/*.conf';
+    }
+
+    if (file_exists('/etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf')) {
+        $lines[] = 'Include /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf';
+    }
+
+    file_put_contents($path, implode("\n", $lines) . "\n");
+}
+
 function ensureWafUnicodeMapFile(): void
 {
     $target = '/etc/modsecurity/unicode.mapping';
@@ -2910,6 +2955,10 @@ function isWafBaseConfigUsable(string $path): bool
         return false;
     }
 
+    if (stripos($content, 'IncludeOptional') !== false) {
+        return false;
+    }
+
     if (preg_match_all('/^\s*Include\s+("?)([^"\s]+)\1/m', $content, $matches)) {
         foreach ($matches[2] as $includePath) {
             if ($includePath === '/etc/modsecurity/modsecurity.conf' && !file_exists($includePath)) {

install.sh

@@ -2122,25 +2122,26 @@ EOF
                 fi
             fi
 
-            # Create main include file for nginx if missing
+            # Create main include file for nginx if missing (avoid IncludeOptional)
             mkdir -p /etc/nginx/modsec
             if [[ ! -f /etc/nginx/modsec/main.conf ]]; then
-                if [[ -f /usr/share/modsecurity-crs/owasp-crs.load ]]; then
+                {
-                    cat > /etc/nginx/modsec/main.conf <<'EOF'
+                    echo "Include /etc/modsecurity/modsecurity.conf"
-Include /etc/modsecurity/modsecurity.conf
+                    if [[ -f /etc/modsecurity/crs/crs-setup.conf ]]; then
-Include /usr/share/modsecurity-crs/owasp-crs.load
+                        echo "Include /etc/modsecurity/crs/crs-setup.conf"
-EOF
+                    elif [[ -f /usr/share/modsecurity-crs/crs-setup.conf ]]; then
-                elif [[ -f /etc/modsecurity/crs/crs-setup.conf ]]; then
+                        echo "Include /usr/share/modsecurity-crs/crs-setup.conf"
-                    cat > /etc/nginx/modsec/main.conf <<'EOF'
-Include /etc/modsecurity/modsecurity.conf
-Include /etc/modsecurity/crs/crs-setup.conf
-Include /usr/share/modsecurity-crs/rules/*.conf
-EOF
-                else
-                    cat > /etc/nginx/modsec/main.conf <<'EOF'
-Include /etc/modsecurity/modsecurity.conf
-EOF
                     fi
+                    if [[ -f /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf ]]; then
+                        echo "Include /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf"
+                    fi
+                    if [[ -d /usr/share/modsecurity-crs/rules ]]; then
+                        echo "Include /usr/share/modsecurity-crs/rules/*.conf"
+                    fi
+                    if [[ -f /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf ]]; then
+                        echo "Include /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf"
+                    fi
+                } > /etc/nginx/modsec/main.conf
             fi
         fi
     fi

install_from_gitea.sh

@@ -2122,25 +2122,26 @@ EOF
                 fi
             fi
 
-            # Create main include file for nginx if missing
+            # Create main include file for nginx if missing (avoid IncludeOptional)
             mkdir -p /etc/nginx/modsec
             if [[ ! -f /etc/nginx/modsec/main.conf ]]; then
-                if [[ -f /usr/share/modsecurity-crs/owasp-crs.load ]]; then
+                {
-                    cat > /etc/nginx/modsec/main.conf <<'EOF'
+                    echo "Include /etc/modsecurity/modsecurity.conf"
-Include /etc/modsecurity/modsecurity.conf
+                    if [[ -f /etc/modsecurity/crs/crs-setup.conf ]]; then
-Include /usr/share/modsecurity-crs/owasp-crs.load
+                        echo "Include /etc/modsecurity/crs/crs-setup.conf"
-EOF
+                    elif [[ -f /usr/share/modsecurity-crs/crs-setup.conf ]]; then
-                elif [[ -f /etc/modsecurity/crs/crs-setup.conf ]]; then
+                        echo "Include /usr/share/modsecurity-crs/crs-setup.conf"
-                    cat > /etc/nginx/modsec/main.conf <<'EOF'
-Include /etc/modsecurity/modsecurity.conf
-Include /etc/modsecurity/crs/crs-setup.conf
-Include /usr/share/modsecurity-crs/rules/*.conf
-EOF
-                else
-                    cat > /etc/nginx/modsec/main.conf <<'EOF'
-Include /etc/modsecurity/modsecurity.conf
-EOF
                     fi
+                    if [[ -f /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf ]]; then
+                        echo "Include /etc/modsecurity/crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf"
+                    fi
+                    if [[ -d /usr/share/modsecurity-crs/rules ]]; then
+                        echo "Include /usr/share/modsecurity-crs/rules/*.conf"
+                    fi
+                    if [[ -f /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf ]]; then
+                        echo "Include /etc/modsecurity/crs/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf"
+                    fi
+                } > /etc/nginx/modsec/main.conf
             fi
         fi
     fi