LPX-673: compulsory env WAF on the shared ALB (+ dashboard panels)#103

Merged

stevethomas merged 11 commits into

mainfrom

steve/lpx-673-env-level-waf-true-provision-a-sensible-default-waf-on-the

Jun 9, 2026

Commits on Jun 9, 2026

feat(waf): env-level `waf: true` provisions a managed WAF on the shared ALB (LPX-673)

stevethomas
and
claude
committed
test(waf): move shared WAF fixtures to Pest.php for parallel isolation

stevethomas
and
claude
committed
style(waf): pint — top-import WebAcl in Pest.php

stevethomas
and
claude
committed
refactor(waf): make the WAF a compulsory env resource, drop the `waf:` toggle

stevethomas
and
claude
committed
feat(waf): add WAF panels to the CloudWatch dashboard

stevethomas
and
claude
committed
feat(waf): add the PHP managed rule group to the baseline (Count)

stevethomas
and
claude
committed
feat(waf): match LP's DoS rate limit + seed a default country block

stevethomas
and
claude
committed
feat(waf): block SQLi + PHP outright, leave only CRS in Count

stevethomas
and
claude
committed
feat(waf): drop Bolivia from the default country block

stevethomas
and
claude
committed
feat(waf): block CRS too, carve out the 8 KB body-size cap; sanitise docs

stevethomas
and
claude
committed
test(waf): add the canonical reconciler-contract test to the IP set step

stevethomas
and
claude
committed