docs: add standalone (no-backend) static-serving example

README.md

@@ -403,6 +403,10 @@ docker build -t my-modsec . -f
 docker run -p 8080:8080 -e BACKEND=http://example.com my-modsec
 ```
 
+### Standalone mode (no backend)
+
+If you don't have a backend to proxy to (e.g. a quick demo, or protecting a plain static site), override `default.conf.template` to drop the `proxy_backend.conf` include and serve files directly instead. See [`examples/standalone-static`](examples/standalone-static) for a working `docker compose` setup.
+
 ## ServerName
 
 It is often convenient to set your server name (set to `localhost` by default). To do this simply use the `SERVER_NAME` environment variable.

examples/standalone-static/docker-compose.yaml

@@ -0,0 +1,20 @@
+# Runs the CRS nginx image standalone: serving static files directly, with no
+# backend to proxy to. Useful for a quick demo/CTF-style WAF, or protecting a
+# plain static site without a second container.
+#
+# By default this image is a reverse proxy and requires BACKEND to point at a
+# real web server (see README.md#proxy-configuration). This override drops
+# the `proxy_backend.conf` include from `default.conf.template` so nginx
+# serves ./html directly instead.
+#
+# Usage:
+#   docker compose up
+#   curl http://localhost:8080/
+services:
+  standalone:
+    image: owasp/modsecurity-crs:nginx-alpine
+    volumes:
+      - ./templates/conf.d/default.conf.template:/etc/nginx/templates/conf.d/default.conf.template:ro
+      - ./html:/usr/share/nginx/html:ro
+    ports:
+      - "8080:8080"

examples/standalone-static/html/index.html

@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head><title>OWASP CRS standalone demo</title></head>
+<body>
+<h1>OWASP CRS standalone demo</h1>
+<p>Served directly by the modsecurity-crs nginx image, no backend required.</p>
+<p>Try: <code>curl "http://localhost:8080/?id=1'%20OR%20'1'='1"</code> to see ModSecurity block it.</p>
+</body>
+</html>

examples/standalone-static/templates/conf.d/default.conf.template

@@ -0,0 +1,21 @@
+# Standalone override of the default template: serves static files from
+# /usr/share/nginx/html instead of proxying to BACKEND. HTTP only, for a
+# quick demo - copy the SSL server block from nginx/templates/conf.d in the
+# repo root if you need TLS too.
+
+server_tokens ${SERVER_TOKENS};
+more_set_headers 'Server: ${SERVER_HEADER}';
+
+server {
+    listen ${PORT} default_server;
+    server_name ${SERVER_NAME};
+
+    location / {
+        include includes/cors.conf;
+
+        index index.html index.htm;
+        root /usr/share/nginx/html;
+    }
+
+    include includes/location_common.conf;
+}