Docker compose: Traefik, OWASP ModSec CRS without plugin (use ForwardAuth)

compose.yml

services:
  traefik:
    image: traefik
    container_name: traefik
    ports:
      - "80:80"
      - "8080:8080"
    command:
      - "--log.level=DEBUG"
      - "--accesslog=true"
      - "--api.dashboard=true"
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--entrypoints.http.address=:80"
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.traefik.loadbalancer.server.port=8080"
      - "traefik.http.middlewares.modsec-auth.forwardauth.address=http://waf:9000/"
      - "traefik.http.middlewares.modsec-auth.forwardauth.preserveRequestMethod=true"
      - "traefik.http.middlewares.modsec-auth.forwardauth.forwardBody=true"

  waf:
    image: owasp/modsecurity-crs:4.16.0-nginx-alpine-202506301206
    container_name: waf
    expose:
      - "8080"
      - "9000"
    volumes:
      - ./default.conf.template:/etc/nginx/templates/conf.d/default.conf.template
      - ./proxy_frontend.conf.template:/etc/nginx/templates/includes/proxy_frontend.conf.template
      - ./docker-entrypoint.d/92-update-real_ip.sh:/docker-entrypoint.d/92-update-real_ip.sh
    environment:
      - MODSEC_RULE_ENGINE=On
      - PARANOIA=1
      - ANOMALY_INBOUND=10
      - ANOMALY_OUTBOUND=10
      - BACKEND=http://dummy
      - REPORTING_LEVEL=2
      - MODSEC_AUDIT_LOG_FORMAT=JSON
      - MODSEC_AUDIT_ENGINE=On
      - MODSEC_AUDIT_LOG=/dev/stdout
      - MODSEC_DEBUG_LOG=/dev/stdout
      - MODSEC_LOG_LEVEL=DEBUG
      - MODSEC_BLOCKING=On
      # Request Body Size Configuration
      - MAX_FILE_SIZE=204800
      - COMBINED_FILE_SIZES=204800
      # Real IP Configuration
      - SET_REAL_IP_FROM=172.16.0.0/12,192.168.0.0/16,10.0.0.0/8,127.0.0.1
      - REAL_IP_PROXY_HEADER=X-Real-IP
      - REAL_IP_HEADER=X-Real-IP
      - REAL_IP_RECURSIVE=on

  dummy:
    build:
      context: .
      dockerfile: dummy.Dockerfile
    command: ["/dummy_server"]
    container_name: dummy
    environment:
      - PORT=80
  
  website:
    image: traefik/whoami
    container_name: website
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=PathPrefix(`/website`)"
      - "traefik.http.routers.whoami.entrypoints=http"
      - "traefik.http.routers.whoami.middlewares=modsec-auth"
  
  app1:
    image: traefik/whoami
    container_name: app1
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app1.rule=PathPrefix(`/app1`)"
      - "traefik.http.routers.app1.entrypoints=http"
      - "traefik.http.routers.app1.middlewares=modsec-auth"