fix(agent): remove ModSecurity, raise HTTP/2 and HTTP/3 upload buffers

[runleveldev]

Fixes #395

Stacked on #407 — based on cmyers_issue357 since that lands first; GitHub will retarget this to main when #407 merges.

Problem

Uploads through the agent reverse proxy crawl. ModSecurity is enabled globally on the agent and runs in DetectionOnly mode (see #221), so it buffers and scans every request body while blocking nothing — defeating proxy_request_buffering off and paying the full scan cost for log entries only. The WAF has already required repeated allowlisting to keep legitimate traffic working (#219, #220, #221).

Changes

Remove ModSecurity entirely

• agent/templates/nginx.conf.ejs: drop modsecurity on, modsecurity_rules_file, modsecurity_transaction_id, and the modsecurity off carve-out in the error-pages server
• agent/.fpm: drop the libnginx-mod-http-modsecurity and modsecurity-crs package dependencies
• images/agent/Dockerfile: remove the ModSecurity default-configuration steps and the vendored CRS config copies
• Delete images/agent/crs-setup.conf and images/agent/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
• Delete images/agent/nginx.logrotate and its COPY: the override only existed to keep modsec_audit.log out of the stock glob and copytruncate it around ModSecurity-nginx#351. The Debian default (/var/log/nginx/*.log, identical policy) covers access/error/stream logs on its own.
• error-pages/403.html: reword from "blocked by the WAF / OWASP CRS" to a generic access-denied page (403s now come from the auth layer)
• mie-opensource-landing/docs/developers/docker-images.md: drop ModSecurity mentions

Raise HTTP/2 and HTTP/3 request-body buffers (http block; defaults were 64k preread / h3 stream buffer and 256k per-worker h2 recv buffer):

http2_body_preread_size 4m;
http2_recv_buffer_size 16m;
http3_stream_buffer_size 4m;

The small defaults cap how much body a client can send before waiting on flow control, which throttles large uploads over multiplexed connections. The h2 recv buffer is shared per worker, so it is sized at several prereads (16m) to keep concurrent uploads from starving each other.

Notes

• Existing agents that already have the ModSecurity packages installed keep working: the module simply loads unused, and nothing in the rendered config references it anymore. New installs no longer pull the packages.
• Verified agent/templates/nginx.conf.ejs renders with Replace pull-config with TypeScript agent #407's config snapshot shape (empty/bootstrap and populated site) — new directives present, no modsecurity references remain in the tree.

[Copilot]

Pull request overview

This PR improves upload performance through the agent reverse proxy by removing ModSecurity (which was adding request-body buffering/scan overhead in DetectionOnly mode) and by increasing HTTP/2 + HTTP/3 request-body buffering limits to reduce flow-control throttling on large uploads.

Changes:

• Removed ModSecurity/OWASP CRS enablement from the generated nginx config and stopped shipping ModSecurity-related packages/config/log rotation in the agent image.
• Increased HTTP/2 and HTTP/3 request-body buffering limits in the nginx http {} block to improve throughput for large uploads over multiplexed connections.
• Updated the 403 error page wording and developer docs to remove WAF-specific messaging.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pull-config/.fpm	Drops ModSecurity/CRS package dependencies from the agent pull-config package.
create-a-container/views/nginx-conf.ejs	Removes modsecurity directives and adds http2_body_preread_size / http3_stream_buffer_size tuning.
images/agent/Dockerfile	Removes ModSecurity default configuration + CRS config copy steps from the agent image build.
images/agent/nginx.logrotate	Removes rotation stanza for the ModSecurity audit log.
images/agent/crs-setup.conf	Deletes vendored CRS setup configuration (no longer used).
images/agent/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf	Deletes vendored CRS exclusion configuration (no longer used).
error-pages/403.html	Rewords 403 page from “WAF blocked” to generic access-denied messaging.
mie-opensource-landing/docs/developers/docker-images.md	Removes ModSecurity mentions from the agent image documentation.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.