Architecture

Purpose

This repository provides two separate origin offerings for authorized F5 Distributed Cloud security demos. Choose the deployment that matches the required application scope and cloud runtime.

Offering	Application scope	Runtime	Ingress	Terraform source
Azure full-origin	Nine applications across 41 containers	nginx and Docker on an Ubuntu 24.04 Azure VM	nginx on the VM	terraform/
AWS Juice Shop	OWASP Juice Shop only	Private AWS Fargate tasks	Application Load Balancer, internal by default	terraform/modules/aws-juice-shop/

The AWS offering is not a cloud-equivalent version of the Azure nine-application stack. It does not deploy nginx, DVWA, VAmPI, httpbin, whoami, CSD Demo, DVGA, RESTaurant, or crAPI.

In both designs, F5 Distributed Cloud can provide the public HTTP load balancer and configured edge security controls in front of the origin.

Azure Full-Origin Architecture

graph LR
    Client[Client Browser] --> XCHLB[F5 XC HTTP LB]
    XCHLB --> NGINX[nginx Reverse Proxy<br/>Ubuntu 24.04 · D16s_v3<br/>reuseport · 16 workers]
    NGINX --> |/| DEFAULT[Landing Page]
    NGINX --> |/juice-shop/| JS[Juice Shop ×4<br/>Ports 3001-3004<br/>hash cookie_token · cache]
    NGINX --> |/dvwa/| DVWA[DVWA-FPM ×4<br/>Ports 8101-8104<br/>hash cookie_PHPSESSID]
    NGINX --> |/vampi/| VAMPI[VAmPI ×4<br/>Ports 5101-5104<br/>ip_hash · gunicorn]
    NGINX --> |/httpbin/| HTTPBIN[httpbin ×4<br/>Ports 8201-8204<br/>gunicorn -w 4]
    NGINX --> |/whoami/| WHOAMI[whoami ×4<br/>Ports 8082-8085]
    NGINX --> |/csd-demo/| CSD[CSD Demo ×4<br/>Ports 5001-5004<br/>ip_hash · gunicorn -w 1]
    NGINX --> |/dvga/| DVGA[DVGA ×4<br/>Ports 5201-5204<br/>ip_hash · SQLite]
    NGINX --> |/restaurant/| REST[RESTaurant ×4<br/>Ports 8301-8304<br/>round-robin]
    XCHLB --> |:8888| CRAPI[crAPI ×7 microservices<br/>Port 8888<br/>web · identity · community<br/>workshop · postgres · mongo · mailhog]
    DVWA --> DB[(MariaDB 10.11<br/>dvwa-db)]
    REST --> RESTDB[(PostgreSQL 15.4<br/>restaurant-db)]

41 containers on a Standard_D16s_v3 VM (16 vCPU, 64 GiB RAM, 60 GiB disk).

The nginx reverse proxy:

• Listens on port 80 with reuseport and backlog=4096 for high-concurrency CDN traffic
• Routes by path prefix to load-balanced upstream pools (4 instances per application)
• Sticky sessions prevent state loss: hash $cookie_token for Juice Shop, hash $cookie_PHPSESSID for DVWA, ip_hash for VAmPI and CSD Demo (SQLite/in-memory state per instance)
• Proxy cache for Juice Shop static assets (10 MB zone, 100 MB max, 60 s TTL)
• Access logging disabled to prevent disk exhaustion under CDN load testing (logrotate as defense-in-depth)
• Passes client headers (X-Real-IP, X-Forwarded-For, X-Forwarded-Proto) for origin visibility
• Kernel tuning via sysctl: somaxconn=65535, tcp_tw_reuse=1, ip_local_port_range=1024-65535

Azure Application Mapping

Path	Upstream	Instances	Ports	Sticky Session	Purpose
/	nginx	—	—	—	Landing page with links to all apps
/health	nginx	—	—	—	JSON health endpoint (9 apps listed)
/juice-shop/	juice_shop	4	3001-3004	hash $cookie_token	Modern web app security (XSS, injection, CSRF)
/dvwa/	dvwa	4 + MariaDB	8101-8104	hash $cookie_PHPSESSID	Classic WAF testing with adjustable difficulty
/vampi/	vampi	4	5101-5104	ip_hash	REST API security testing (OWASP API Top 10)
/httpbin/	httpbin_up	4	8201-8204	—	HTTP request/response service for API demos
/whoami/	whoami_up	4	8082-8085	—	Request diagnostics — shows all headers, client IP
/csd-demo/	csd_demo	4	5001-5004	ip_hash	Client-Side Defense testing (Magecart attacks)
/dvga/	dvga	4	5201-5204	ip_hash	GraphQL API security testing (injection, DoS, auth bypass)
/restaurant/	restaurant	4 + PostgreSQL	8301-8304	—	REST API security (OWASP API Top 10 2023)
:8888	crapi	7 microservices	8888	—	OWASP crAPI (BOLA, BFLA, mass assignment, SSRF, JWT)

AWS Juice Shop Architecture

The AWS module deploys only OWASP Juice Shop. It creates an ECS cluster, service, task definition, security groups, an Application Load Balancer, and supporting observability and execution-role resources in caller-managed networking.

graph LR
    Client[Client Browser] -->|HTTPS| XCHLB[F5 XC HTTP LB<br/>TLS and configured edge controls]
    XCHLB -->|HTTP from approved CIDRs| ALB[Application Load Balancer<br/>internal by default]
    ALB -->|Container port<br/>security-group reference| ECS[Private Fargate task<br/>Juice Shop only]
    ECS --> LOGS[CloudWatch Logs<br/>KMS encrypted · 365+ days]
    ALB --> S3[Caller-managed S3 bucket<br/>ALB access logs]

Trust Boundary and Exposure

F5 Distributed Cloud is the public HTTPS termination and configured security-enforcement point in this design. The F5 Distributed Cloud-to-ALB hop intentionally uses HTTP and is acceptable only as a documented trusted-routing-domain exception. Restrict ALB port 80 ingress through allowed_ingress_cidrs to approved F5 Distributed Cloud egress or connected-network CIDRs. If that routing domain cannot be trusted and protected from interception, use a different origin design.

The ALB is internal by default (public_exposure = false). Internet-facing exposure requires the explicit public_exposure = true setting and approved CIDR restrictions; 0.0.0.0/0 is accepted only with that explicit mode and is not recommended.

Fargate tasks run in caller-managed private subnets with no public IP address. Their security group accepts the application port only from the ALB security group. The module creates no SSH ingress or direct public path to a task.

Security and Operational Controls

• The default Juice Shop image is pinned by immutable SHA-256 digest; upgrades require selecting and reviewing a new digest rather than using a mutable tag.
• CloudWatch container logs use a caller-managed KMS key and enforce at least 365 days of retention.
• ALB access logging is enabled to a caller-managed S3 bucket; the caller owns bucket encryption, lifecycle, public-access blocking, and the regional log-delivery policy.
• ECS Container Insights is enabled.
• The task execution role is scoped to creating log streams and writing log events for this deployment’s CloudWatch log group.
• The ECS deployment circuit breaker is enabled with automatic rollback.
• The caller owns the VPC, subnets, routes, egress, KMS key, S3 bucket, AWS provider authentication, and Terraform state.

For the pinned inputs, prerequisites, deployment contract, and verification guidance, see the AWS Juice Shop module documentation.

Modular Component Design

This is one piece of a larger lab environment. Each component is self-contained and deployed independently:

• Azure full-origin provides nginx and 41 Docker containers on an Azure VM.
• AWS Juice Shop independently provides Juice Shop on private Fargate tasks behind an ALB.
• CDN Simulator provides the CDN edge layer (nginx caching on Azure VM)
• Other components provide the F5 XC configuration, DNS, WAF policies, API security, etc.

The human operator adds components one at a time. Each component’s documentation is written so an AI assistant can read it and deploy the infrastructure autonomously.

Why the Azure Full-Origin Uses These Applications

Application	Why Selected
Juice Shop	OWASP flagship project; modern Node.js SPA with 100+ challenges covering the OWASP Top 10; actively maintained; 4 instances with proxy cache
DVWA	Industry standard for WAF testing; adjustable security levels (low/medium/high/impossible); custom php-fpm + nginx build for performance; shared MariaDB 10.11 backend
VAmPI	Purpose-built for OWASP API Security Top 10; REST API with known vulnerabilities; gunicorn with 4 workers per instance; ip_hash sticky for SQLite consistency
httpbin	Kenneth Reitz’s canonical HTTP testing service; gunicorn with 4 gevent workers; useful for API demos and request inspection
whoami	Traefik’s request echo server; shows full request details as the origin sees them — essential for verifying F5 XC header injection
CSD Demo	Custom checkout page with 5 toggleable Magecart-style attacks (card skimmer, formjacker, keylogger, cryptominer, DOM hijack); exfil endpoint + attacker dashboard; gunicorn single-worker for in-memory state persistence
DVGA	Damn Vulnerable GraphQL Application; GraphQL-specific vulnerabilities including injection, DoS, batching attacks, and authorization bypass; GraphiQL UI for interactive exploration; ip_hash sticky for SQLite per instance
RESTaurant	Damn Vulnerable RESTaurant API Game; purpose-built for OWASP API Security Top 10 2023; FastAPI with Swagger UI; shared PostgreSQL 15.4 backend; covers BOLA, BFLA, mass assignment, SSRF, and injection
crAPI	OWASP Completely Ridiculous API; 7-microservice architecture covering BOLA, BFLA, mass assignment, SSRF, JWT manipulation, and NoSQL injection; dedicated port 8888 (SPA with hardcoded API paths); MailHog for email capture