name: selfhostedops/crs-route-exclusions
# ep13: schaltet die CRS-Coraza-Engine (SecLang) fuer genau die legitimen
# Anwendungs-Routen ab, auf denen CRS sonst Fehlalarme wirft. ctl:ruleEngine=Off
# betrifft nur die SecLang-Regeln (CRS + base-config), die nativen vpatch- und
# generic-Regeln von CrowdSec laufen weiter, auch auf diesen Routen.
seclang_rules:
  # Forgejo git smart-HTTP (clone/push), binaerer Pack-Body
  - |
    SecRule REQUEST_HEADERS:Host "@beginsWith git." "id:900101,phase:1,pass,nolog,chain,msg:'ep13 exclude git smart-http'"
      SecRule REQUEST_URI "@rx (git-upload-pack|git-receive-pack|/info/refs\?service=)" "ctl:ruleEngine=Off"
  # Forgejo REST-API: Issues, Datei-Inhalte (Nutzer schreiben Code/SQL/.env)
  - |
    SecRule REQUEST_HEADERS:Host "@beginsWith git." "id:900102,phase:1,pass,nolog,chain,msg:'ep13 exclude forgejo api'"
      SecRule REQUEST_URI "@beginsWith /api/v1/" "ctl:ruleEngine=Off"
  # Outline Dokument-API (Codebloecke)
  - |
    SecRule REQUEST_HEADERS:Host "@beginsWith wiki." "id:900103,phase:1,pass,nolog,chain,msg:'ep13 exclude outline api'"
      SecRule REQUEST_URI "@beginsWith /api/" "ctl:ruleEngine=Off"
  # ntfy Publish (POST /<topic>, freier Text)
  - |
    SecRule REQUEST_HEADERS:Host "@beginsWith ntfy." "id:900104,phase:1,pass,nolog,chain,msg:'ep13 exclude ntfy publish'"
      SecRule REQUEST_METHOD "@streq POST" "ctl:ruleEngine=Off"
  # n8n Webhook-Pfade (beliebiges JSON)
  - |
    SecRule REQUEST_HEADERS:Host "@beginsWith n8n." "id:900105,phase:1,pass,nolog,chain,msg:'ep13 exclude n8n webhook'"
      SecRule REQUEST_URI "@beginsWith /webhook" "ctl:ruleEngine=Off"