rails_template_18f 0.1.0

data/templates/terraform/destroy_space_deployer.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [[ $# -ne 2 ]]; then
+  echo "$0 <<SPACE_NAME>> <<ACCOUNT_NAME>>"
+  exit 1;
+fi
+
+space=$1
+service=$2
+
+cf target -s $space
+
+# destroy service key
+cf delete-service-key $service space-deployer-key -f
+
+# destroy service
+cf delete-service $service -f

data/templates/terraform/production/main.tf.tt

@@ -0,0 +1,50 @@
+locals {
+  cf_org_name      = "<%= @cloud_gov_organization %>"
+  cf_space_name    = "<%= @cloud_gov_production_space %>"
+  env              = "production"
+  recursive_delete = false
+}
+
+module "database" {
+  source = "../shared/database"
+
+  cf_user          = var.cf_user
+  cf_password      = var.cf_password
+  cf_org_name      = local.cf_org_name
+  cf_space_name    = local.cf_space_name
+  env              = local.env
+  recursive_delete = local.recursive_delete
+  rds_plan_name    = "TKTK-production-rds-plan"
+}
+
+<% if !skip_active_storage? %>
+module "s3" {
+  source = "../shared/s3"
+
+  cf_user         = var.cf_user
+  cf_password     = var.cf_password
+  cf_org_name     = local.cf_org_name
+  cf_space_name   = local.cf_space_name
+  s3_service_name = "<%= app_name %>-s3-${local.env}"
+}
+<% end %>
+
+###########################################################################
+# The following lines need to be commented out for the initial `terraform apply`
+# It can be re-enabled after:
+# 1) the app has first been deployed
+# 2) the route has been manually created by an OrgManager:
+#     `cf create-domain <%= @cloud_gov_organization %> TKTK-production-domain-name`
+###########################################################################
+# module "domain" {
+#   source = "../shared/domain"
+#
+#   cf_user          = var.cf_user
+#   cf_password      = var.cf_password
+#   cf_org_name      = local.cf_org_name
+#   cf_space_name    = local.cf_space_name
+#   env              = local.env
+#   recursive_delete = local.recursive_delete
+#   cdn_plan_name    = "domain"
+#   domain_name      = "TKTK-production-domain-name"
+# }

data/templates/terraform/production/providers.tf.tt

@@ -0,0 +1,17 @@
+terraform {
+  required_version = "~> 1.0"
+  required_providers {
+    cloudfoundry = {
+      source  = "cloudfoundry-community/cloudfoundry"
+      version = "0.15.0"
+    }
+  }
+
+  backend "s3" {
+    bucket  = "TKTK-s3-bucket"
+    key     = "terraform.tfstate.prod"
+    encrypt = "true"
+    region  = "us-gov-west-1"
+    profile = "<%= app_name %>-terraform-backend"
+  }
+}

data/templates/terraform/production/variables.tf

@@ -0,0 +1,2 @@
+variable "cf_password" {}
+variable "cf_user" {}

data/templates/terraform/shared/database/main.tf.tt

@@ -0,0 +1,23 @@
+###
+# Target space/org
+###
+
+data "cloudfoundry_space" "space" {
+  org_name = var.cf_org_name
+  name     = var.cf_space_name
+}
+
+###
+# RDS instance
+###
+
+data "cloudfoundry_service" "rds" {
+  name = "aws-rds"
+}
+
+resource "cloudfoundry_service_instance" "rds" {
+  name             = "<%= app_name %>-rds-${var.env}"
+  space            = data.cloudfoundry_space.space.id
+  service_plan     = data.cloudfoundry_service.rds.service_plans[var.rds_plan_name]
+  recursive_delete = var.recursive_delete
+}

data/templates/terraform/shared/database/providers.tf

@@ -0,0 +1,16 @@
+terraform {
+  required_version = "~> 1.0"
+  required_providers {
+    cloudfoundry = {
+      source  = "cloudfoundry-community/cloudfoundry"
+      version = "0.15.0"
+    }
+  }
+}
+
+provider "cloudfoundry" {
+  api_url      = var.cf_api_url
+  user         = var.cf_user
+  password     = var.cf_password
+  app_logs_max = 30
+}

data/templates/terraform/shared/database/variables.tf

@@ -0,0 +1,42 @@
+variable "cf_api_url" {
+  type        = string
+  description = "cloud.gov api url"
+  default     = "https://api.fr.cloud.gov"
+}
+
+variable "cf_user" {
+  type        = string
+  description = "cloud.gov deployer account user"
+}
+
+variable "cf_password" {
+  type        = string
+  description = "secret; cloud.gov deployer account password"
+  sensitive   = true
+}
+
+variable "cf_org_name" {
+  type        = string
+  description = "cloud.gov organization name"
+}
+
+variable "cf_space_name" {
+  type        = string
+  description = "cloud.gov space name (staging or prod)"
+}
+
+variable "env" {
+  type        = string
+  description = "deployment environment (staging, production)"
+}
+
+variable "recursive_delete" {
+  type        = bool
+  description = "when true, deletes service bindings attached to the resource (not recommended for production)"
+  default     = false
+}
+
+variable "rds_plan_name" {
+  type        = string
+  description = "name of the service plan name to create"
+}

data/templates/terraform/shared/domain/main.tf.tt

@@ -0,0 +1,46 @@
+###
+# Target space/org
+###
+
+data "cloudfoundry_space" "space" {
+  org_name = var.cf_org_name
+  name     = var.cf_space_name
+}
+
+###
+# Route mapping and CDN instance
+###
+
+data "cloudfoundry_app" "app" {
+  name_or_id = "<%= app_name %>-${var.env}"
+  space      = data.cloudfoundry_space.space.id
+}
+
+###########################################################################
+# Route must be manually created by an OrgManager before terraform is run:
+#
+# cf create-domain <%= @cloud_gov_organization %> TKTK-production-domain-name
+###########################################################################
+data "cloudfoundry_domain" "origin_url" {
+  name = var.domain_name
+}
+
+resource "cloudfoundry_route" "origin_route" {
+  domain = data.cloudfoundry_domain.origin_url.id
+  space  = data.cloudfoundry_space.space.id
+  target {
+    app = data.cloudfoundry_app.app.id
+  }
+}
+
+data "cloudfoundry_service" "external_domain" {
+  name = "external-domain"
+}
+
+resource "cloudfoundry_service_instance" "external_domain_instance" {
+  name             = "<%= app_name %>-domain-${var.env}"
+  space            = data.cloudfoundry_space.space.id
+  service_plan     = data.cloudfoundry_service.external_domain.service_plans[var.cdn_plan_name]
+  recursive_delete = var.recursive_delete
+  json_params      = "{\"domains\": \"${var.domain_name}\"}"
+}

data/templates/terraform/shared/domain/providers.tf

@@ -0,0 +1,16 @@
+terraform {
+  required_version = "~> 1.0"
+  required_providers {
+    cloudfoundry = {
+      source  = "cloudfoundry-community/cloudfoundry"
+      version = "0.15.0"
+    }
+  }
+}
+
+provider "cloudfoundry" {
+  api_url      = var.cf_api_url
+  user         = var.cf_user
+  password     = var.cf_password
+  app_logs_max = 30
+}

data/templates/terraform/shared/domain/variables.tf

@@ -0,0 +1,47 @@
+variable "cf_api_url" {
+  type        = string
+  description = "cloud.gov api url"
+  default     = "https://api.fr.cloud.gov"
+}
+
+variable "cf_user" {
+  type        = string
+  description = "cloud.gov deployer account user"
+}
+
+variable "cf_password" {
+  type        = string
+  description = "secret; cloud.gov deployer account password"
+  sensitive   = true
+}
+
+variable "cf_org_name" {
+  type        = string
+  description = "cloud.gov organization name"
+}
+
+variable "cf_space_name" {
+  type        = string
+  description = "cloud.gov space name (staging or prod)"
+}
+
+variable "env" {
+  type        = string
+  description = "deployment environment (staging, production)"
+}
+
+variable "recursive_delete" {
+  type        = bool
+  description = "when true, deletes service bindings attached to the resource (not recommended for production)"
+  default     = false
+}
+
+variable "cdn_plan_name" {
+  type        = string
+  description = "name of the service plan name to create"
+}
+
+variable "domain_name" {
+  type        = string
+  description = "DNS name users will be accessing site"
+}

data/templates/terraform/shared/s3/main.tf

@@ -0,0 +1,27 @@
+###
+# Target space/org
+###
+
+data "cloudfoundry_space" "space" {
+  org_name = var.cf_org_name
+  name     = var.cf_space_name
+}
+
+###
+# S3 instance
+###
+
+data "cloudfoundry_service" "s3" {
+  name = "s3"
+}
+
+resource "cloudfoundry_service_instance" "bucket" {
+  name             = var.s3_service_name
+  space            = data.cloudfoundry_space.space.id
+  service_plan     = data.cloudfoundry_service.s3.service_plans[var.s3_plan_name]
+  recursive_delete = var.recursive_delete
+}
+
+output "bucket_id" {
+  value = cloudfoundry_service_instance.bucket.id
+}

data/templates/terraform/shared/s3/providers.tf

@@ -0,0 +1,16 @@
+terraform {
+  required_version = "~> 1.0"
+  required_providers {
+    cloudfoundry = {
+      source  = "cloudfoundry-community/cloudfoundry"
+      version = "0.15.0"
+    }
+  }
+}
+
+provider "cloudfoundry" {
+  api_url      = var.cf_api_url
+  user         = var.cf_user
+  password     = var.cf_password
+  app_logs_max = 30
+}

data/templates/terraform/shared/s3/variables.tf

@@ -0,0 +1,43 @@
+variable "cf_api_url" {
+  type        = string
+  description = "cloud.gov api url"
+  default     = "https://api.fr.cloud.gov"
+}
+
+variable "cf_user" {
+  type        = string
+  description = "cloud.gov deployer account user"
+}
+
+variable "cf_password" {
+  type        = string
+  description = "secret; cloud.gov deployer account password"
+  sensitive   = true
+}
+
+variable "cf_org_name" {
+  type        = string
+  description = "cloud.gov organization name"
+}
+
+variable "cf_space_name" {
+  type        = string
+  description = "cloud.gov space name (staging or prod)"
+}
+
+variable "recursive_delete" {
+  type        = bool
+  description = "when true, deletes service bindings attached to the resource (not recommended for production)"
+  default     = false
+}
+
+variable "s3_service_name" {
+  type        = string
+  description = "name for the cloud.gov managed service"
+}
+
+variable "s3_plan_name" {
+  type        = string
+  description = "name of the service plan to create"
+  default     = "basic"
+}

data/templates/terraform/staging/main.tf.tt

@@ -0,0 +1,30 @@
+locals {
+  cf_org_name      = "<%= @cloud_gov_organization %>"
+  cf_space_name    = "<%= @cloud_gov_staging_space %>"
+  env              = "staging"
+  recursive_delete = true
+}
+
+module "database" {
+  source = "../shared/database"
+
+  cf_user          = var.cf_user
+  cf_password      = var.cf_password
+  cf_org_name      = local.cf_org_name
+  cf_space_name    = local.cf_space_name
+  env              = local.env
+  recursive_delete = local.recursive_delete
+  rds_plan_name    = "micro-psql"
+}
+
+<% if !skip_active_storage? %>
+module "s3" {
+  source = "../shared/s3"
+
+  cf_user         = var.cf_user
+  cf_password     = var.cf_password
+  cf_org_name     = local.cf_org_name
+  cf_space_name   = local.cf_space_name
+  s3_service_name = "<%= app_name %>-s3-${local.env}"
+}
+<% end %>

data/templates/terraform/staging/providers.tf.tt

@@ -0,0 +1,17 @@
+terraform {
+  required_version = "~> 1.0"
+  required_providers {
+    cloudfoundry = {
+      source  = "cloudfoundry-community/cloudfoundry"
+      version = "0.15.0"
+    }
+  }
+
+  backend "s3" {
+    bucket  = "TKTK-s3-bucket"
+    key     = "terraform.tfstate.stage"
+    encrypt = "true"
+    region  = "us-gov-west-1"
+    profile = "<%= app_name %>-terraform-backend"
+  }
+}

data/templates/terraform/staging/variables.tf

@@ -0,0 +1,2 @@
+variable "cf_password" {}
+variable "cf_user" {}

data/templates/zap.conf

@@ -0,0 +1,121 @@
+# zap-full-scan rule configuration file
+# Change WARN to IGNORE to ignore rule or FAIL to fail if rule matches
+# Active scan rules set to IGNORE will not be run which will speed up the scan
+# Only the rule identifiers are used - the names are just for info
+# You can add your own messages to each rule by appending them after a tab on each line.
+0	WARN	(Directory Browsing - Active/release)
+10003	WARN	(Vulnerable JS Library - Passive/release)
+10010	FAIL	(Cookie No HttpOnly Flag - Passive/release)
+10011	FAIL	(Cookie Without Secure Flag - Passive/release)
+10015	WARN	(Incomplete or No Cache-control Header Set - Passive/release)
+10016	FAIL	(Web Browser XSS Protection Not Enabled)
+10017	WARN	(Cross-Domain JavaScript Source File Inclusion - Passive/release)
+10019	WARN	(Content-Type Header Missing - Passive/release)
+10020	FAIL	(X-Frame-Options Header - Passive/release)
+10021	WARN	(X-Content-Type-Options Header Missing - Passive/release)
+10023	WARN	(Information Disclosure - Debug Error Messages - Passive/release)
+10024	FAIL	(Information Disclosure - Sensitive Information in URL - Passive/release)
+10025	FAIL	(Information Disclosure - Sensitive Information in HTTP Referrer Header - Passive/release)
+10026	WARN	(HTTP Parameter Override - Passive/beta)
+10027	WARN	(Information Disclosure - Suspicious Comments - Passive/release)
+10028	FAIL	(Open Redirect - Passive/beta)
+10029	WARN	(Cookie Poisoning - Passive/beta)
+10030	WARN	(User Controllable Charset - Passive/beta)
+10031	WARN	(User Controllable HTML Element Attribute (Potential XSS) - Passive/beta)
+10032	WARN	(Viewstate - Passive/release)
+10033	WARN	(Directory Browsing - Passive/beta)
+10034	WARN	(Heartbleed OpenSSL Vulnerability (Indicative) - Passive/beta)
+10035	FAIL	(Strict-Transport-Security Header - Passive/beta)
+10036	WARN	(HTTP Server Response Header - Passive/beta)
+10037	WARN	(Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) - Passive/release)
+10038	FAIL	(Content Security Policy (CSP) Header Not Set - Passive/beta)
+10039	WARN	(X-Backend-Server Header Information Leak - Passive/beta)
+10040	FAIL	(Secure Pages Include Mixed Content - Passive/release)
+10041	WARN	(HTTP to HTTPS Insecure Transition in Form Post - Passive/beta)
+10042	WARN	(HTTPS to HTTP Insecure Transition in Form Post - Passive/beta)
+10043	FAIL	(User Controllable JavaScript Event (XSS) - Passive/beta)
+10044	WARN	(Big Redirect Detected (Potential Sensitive Information Leak) - Passive/beta)
+10045	WARN	(Source Code Disclosure - /WEB-INF folder - Active/release)
+10047	WARN	(HTTPS Content Available via HTTP - Active/beta)
+10048	FAIL	(Remote Code Execution - Shell Shock - Active/beta)
+10050	WARN	(Retrieved from Cache - Passive/beta)
+10051	WARN	(Relative Path Confusion - Active/beta)
+10052	WARN	(X-ChromeLogger-Data (XCOLD) Header Information Leak - Passive/beta)
+10053	WARN	(Apache Range Header DoS (CVE-2011-3192) - Active/beta)
+10054	WARN	(Cookie without SameSite Attribute - Passive/release)
+10055	WARN	(CSP - Passive/release)
+10056	WARN	(X-Debug-Token Information Leak - Passive/release)
+10057	WARN	(Username Hash Found - Passive/release)
+10058	FAIL	(GET for POST - Active/beta)
+10061	WARN	(X-AspNet-Version Response Header - Passive/release)
+10062	FAIL	(PII Disclosure - Passive/beta)
+10095	IGNORE	(Backup File Disclosure - Active/beta)
+10096	WARN	(Timestamp Disclosure - Passive/release)
+10097	WARN	(Hash Disclosure - Passive/beta)
+10098	WARN	(Cross-Domain Misconfiguration - Passive/release)
+10104	WARN	(User Agent Fuzzer - Active/beta)
+10105	WARN	(Weak Authentication Method - Passive/release)
+10106	IGNORE	(HTTP Only Site - Active/beta)
+10107	WARN	(Httpoxy - Proxy Header Misuse - Active/beta)
+10108	WARN	(Reverse Tabnabbing - Passive/beta)
+10109	WARN	(Modern Web Application - Passive/beta)
+10202	FAIL	(Absence of Anti-CSRF Tokens - Passive/release)
+2	WARN	(Private IP Disclosure - Passive/release)
+20012	FAIL	(Anti-CSRF Tokens Check - Active/beta)
+20014	WARN	(HTTP Parameter Pollution - Active/beta)
+20015	WARN	(Heartbleed OpenSSL Vulnerability - Active/beta)
+20016	WARN	(Cross-Domain Misconfiguration - Active/beta)
+20017	FAIL	(Source Code Disclosure - CVE-2012-1823 - Active/beta)
+20018	FAIL	(Remote Code Execution - CVE-2012-1823 - Active/beta)
+20019	WARN	(External Redirect - Active/release)
+3	WARN	(Session ID in URL Rewrite - Passive/release)
+30001	WARN	(Buffer Overflow - Active/release)
+30002	WARN	(Format String Error - Active/release)
+30003	WARN	(Integer Overflow Error - Active/beta)
+40003	WARN	(CRLF Injection - Active/release)
+40008	WARN	(Parameter Tampering - Active/release)
+40009	WARN	(Server Side Include - Active/release)
+40012	FAIL	(Cross Site Scripting (Reflected) - Active/release)
+40013	FAIL	(Session Fixation - Active/beta)
+40014	FAIL	(Cross Site Scripting (Persistent) - Active/release)
+40016	FAIL	(Cross Site Scripting (Persistent) - Prime - Active/release)
+40017	FAIL	(Cross Site Scripting (Persistent) - Spider - Active/release)
+40018	FAIL	(SQL Injection - Active/release)
+40019	FAIL	(SQL Injection - MySQL - Active/beta)
+40020	FAIL	(SQL Injection - Hypersonic SQL - Active/beta)
+40021	FAIL	(SQL Injection - Oracle - Active/beta)
+40022	FAIL	(SQL Injection - PostgreSQL - Active/beta)
+40023	FAIL	(Possible Username Enumeration - Active/beta)
+40024	FAIL	(SQL Injection - SQLite - Active/beta)
+40025	FAIL	(Proxy Disclosure - Active/beta)
+40026	FAIL	(Cross Site Scripting (DOM Based) - Active/beta)
+40027	FAIL	(SQL Injection - MsSQL - Active/beta)
+40028	WARN	(ELMAH Information Leak - Active/release)
+40029	WARN	(Trace.axd Information Leak - Active/beta)
+40032	FAIL	(.htaccess Information Leak - Active/release)
+40034	FAIL	(.env Information Leak - Active/beta)
+40035	FAIL	(Hidden File Finder - Active/beta)
+41	FAIL	(Source Code Disclosure - Git  - Active/beta)
+42	WARN	(Source Code Disclosure - SVN - Active/beta)
+43	WARN	(Source Code Disclosure - File Inclusion - Active/beta)
+50000	WARN	(Script Active Scan Rules - Active/release)
+50001	WARN	(Script Passive Scan Rules - Passive/release)
+6	WARN	(Path Traversal - Active/release)
+7	WARN	(Remote File Inclusion - Active/release)
+90001	WARN	(Insecure JSF ViewState - Passive/release)
+90011	WARN	(Charset Mismatch - Passive/release)
+90017	WARN	(XSLT Injection - Active/beta)
+90019	WARN	(Server Side Code Injection - Active/release)
+90020	FAIL	(Remote OS Command Injection - Active/release)
+90021	WARN	(XPath Injection - Active/beta)
+90022	WARN	(Application Error Disclosure - Passive/release)
+90023	WARN	(XML External Entity Attack - Active/beta)
+90024	WARN	(Generic Padding Oracle - Active/beta)
+90025	WARN	(Expression Language Injection - Active/beta)
+90026	WARN	(SOAP Action Spoofing - Active/alpha)
+90027	IGNORE	(Cookie Slack Detector - Active/beta)
+90028	WARN	(Insecure HTTP Method - Active/beta)
+90029	WARN	(SOAP XML Injection - Active/alpha)
+90030	WARN	(WSDL File Detection - Passive/alpha)
+90033	WARN	(Loosely Scoped Cookie - Passive/release)
+90034	WARN	(Cloud Metadata Potentially Exposed - Active/beta)