feat(lab11): hardened nginx + WAF sidecar

[PollyS6]

Goal

Implement a hardened Nginx reverse proxy

Changes

• labs/lab11/reverse-proxy/nginx.conf
• labs/lab11/results/
• submissions/lab11.md

Testing

• Commands:
• seq 1 60 | xargs -n1 -P 30 -I{} curl -sk -o /dev/null -w "%{http_code}\n"
  https://localhost/rest/user/login 2>/dev/null | sort | uniq -c
• echo | openssl s_client -connect localhost:443 -tls1_3 2>&1
  | grep -E "Cipher|Server Temp Key"
• Observed output:

•  54 429
  6 500
  

• New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384

Artifacts & Screenshots

• https://github.com/PollyS6/DevSecOps-Intro/blob/feature/lab11/labs/lab11/reverse-proxy/nginx.conf
• https://github.com/PollyS6/DevSecOps-Intro/blob/feature/lab11/submissions/lab11.md

Checklist

• Title is clear (feat(labN): style)
• No secrets/large temp files committed
• Submission file at submissions/labN.md exists
• Task 1 — TLS 1.3 + 6 security headers (with proof)
• Task 2 — Rate limit + timeouts + cipher hardening + cert-rotation runbook
• Bonus — Coraza/ModSec WAF + OWASP CRS catching a payload Nginx-alone passes