modified: docs/install.example.json

Author: Code-Egg

README.md

@@ -141,6 +141,8 @@ sudo cp docs/install.example.json /etc/ols-cli/install.json
 sudo ols install
 ```
 
+`install.json` also supports `owasp_crs_version` (for example, `"owasp_crs_version": "4.21.0"`), which is used when enabling OWASP via `site create/update --enable-owasp`.
+
 Override config values with flags when needed:
 
 ```bash

docs/install.example.json

@@ -5,5 +5,6 @@
   "http_port": 80,
   "https_port": 443,
   "ssl_cert_file": "/usr/local/lsws/admin/conf/webadmin.crt",
-  "ssl_key_file": "/usr/local/lsws/admin/conf/webadmin.key"
+  "ssl_key_file": "/usr/local/lsws/admin/conf/webadmin.key",
+  "owasp_crs_version": "4.21.0"
 }

internal/service/install_config.go

@@ -24,6 +24,7 @@ type RuntimeInstallConfig struct {
 	HTTPSPort          int    `json:"https_port"`
 	SSLCertFile        string `json:"ssl_cert_file"`
 	SSLKeyFile         string `json:"ssl_key_file"`
+	OWASPCRSVersion    string `json:"owasp_crs_version"`
 }
 
 type resolvedInstallPlan struct {
@@ -36,6 +37,7 @@ type resolvedInstallPlan struct {
 	HTTPSPort          int
 	SSLCertFile        string
 	SSLKeyFile         string
+	OWASPCRSVersion    string
 }
 
 func defaultRuntimeInstallConfig(lswsRoot string) RuntimeInstallConfig {
@@ -48,6 +50,7 @@ func defaultRuntimeInstallConfig(lswsRoot string) RuntimeInstallConfig {
 		HTTPSPort:          443,
 		SSLCertFile:        filepath.Join(lswsRoot, "admin", "conf", "webadmin.crt"),
 		SSLKeyFile:         filepath.Join(lswsRoot, "admin", "conf", "webadmin.key"),
+		OWASPCRSVersion:    defaultOWASPCRSVersion,
 	}
 }
 
@@ -106,6 +109,9 @@ func mergeRuntimeInstallConfig(base, override RuntimeInstallConfig) RuntimeInsta
 	if v := strings.TrimSpace(override.SSLKeyFile); v != "" {
 		base.SSLKeyFile = v
 	}
+	if v := strings.TrimSpace(override.OWASPCRSVersion); v != "" {
+		base.OWASPCRSVersion = v
+	}
 	return base
 }
 
@@ -162,6 +168,10 @@ func resolveInstallPlan(opts InstallOptions, info platform.Info, lswsRoot string
 	if v := strings.TrimSpace(opts.SSLKeyFile); v != "" {
 		sslKeyFile = v
 	}
+	owaspCRSVersion := strings.TrimSpace(cfg.OWASPCRSVersion)
+	if owaspCRSVersion == "" {
+		owaspCRSVersion = defaultOWASPCRSVersion
+	}
 
 	if err := validatePort(httpPort, "http_port"); err != nil {
 		return resolvedInstallPlan{}, err
@@ -194,6 +204,7 @@ func resolveInstallPlan(opts InstallOptions, info platform.Info, lswsRoot string
 		HTTPSPort:          httpsPort,
 		SSLCertFile:        sslCertFile,
 		SSLKeyFile:         sslKeyFile,
+		OWASPCRSVersion:    owaspCRSVersion,
 	}, nil
 }
 

internal/service/install_config_test.go

@@ -3,6 +3,7 @@ package service
 import (
 	"bytes"
 	"context"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -35,6 +36,9 @@ func TestResolveInstallPlanDefaults(t *testing.T) {
 	if plan.HTTPPort != 80 || plan.HTTPSPort != 443 {
 		t.Fatalf("expected default ports 80/443, got %d/%d", plan.HTTPPort, plan.HTTPSPort)
 	}
+	if plan.OWASPCRSVersion != defaultOWASPCRSVersion {
+		t.Fatalf("expected default owasp crs version %s, got %s", defaultOWASPCRSVersion, plan.OWASPCRSVersion)
+	}
 }
 
 func TestResolveInstallPlanOverrides(t *testing.T) {
@@ -74,6 +78,31 @@ func TestResolveInstallPlanOverrides(t *testing.T) {
 	}
 }
 
+func TestLoadRuntimeInstallConfigIncludesOWASPCRSVersion(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "install.json")
+	content := `{
+  "php_version": "85",
+  "database": "mariadb",
+  "configure_listeners": true,
+  "http_port": 80,
+  "https_port": 443,
+  "ssl_cert_file": "/usr/local/lsws/admin/conf/webadmin.crt",
+  "ssl_key_file": "/usr/local/lsws/admin/conf/webadmin.key",
+  "owasp_crs_version": "4.22.0"
+}`
+	if err := os.WriteFile(configPath, []byte(content), 0o644); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	cfg, _, err := loadRuntimeInstallConfig(configPath, "/usr/local/lsws")
+	if err != nil {
+		t.Fatalf("unexpected load error: %v", err)
+	}
+	if cfg.OWASPCRSVersion != "4.22.0" {
+		t.Fatalf("expected owasp_crs_version 4.22.0, got %s", cfg.OWASPCRSVersion)
+	}
+}
+
 func TestResolveInstallPlanDatabaseNone(t *testing.T) {
 	plan, err := resolveInstallPlan(
 		InstallOptions{ConfigPath: filepath.Join(t.TempDir(), "install.json"), DatabaseEngine: "none"},
@@ -102,12 +131,12 @@ func TestResolveInstallPlanInvalidDatabase(t *testing.T) {
 func TestResolveInstallPlanRejectsUnsafeSSLPaths(t *testing.T) {
 	_, err := resolveInstallPlan(
 		InstallOptions{
-			ConfigPath:   filepath.Join(t.TempDir(), "install.json"),
-			SSLCertFile:  "/etc/ssl/certs/server.crt\nmalicious 1",
-			SSLKeyFile:   "/etc/ssl/private/server.key",
-			HTTPPort:     80,
-			HTTPSPort:    443,
-			PHPVersion:   "85",
+			ConfigPath:     filepath.Join(t.TempDir(), "install.json"),
+			SSLCertFile:    "/etc/ssl/certs/server.crt\nmalicious 1",
+			SSLKeyFile:     "/etc/ssl/private/server.key",
+			HTTPPort:       80,
+			HTTPSPort:      443,
+			PHPVersion:     "85",
 			DatabaseEngine: "mariadb",
 		},
 		platform.Info{PackageManager: platform.PackageManagerAPT},
@@ -134,4 +163,3 @@ func TestInstallRuntimeDryRunIncludesResolvedPlan(t *testing.T) {
 		t.Fatalf("expected no runner calls in dry-run, got %d", len(r.calls))
 	}
 }
-