Additional plugins syncying between repos

After doing a review on plugins, repos and related stuff (docker images), we need to see if the documentation on plugins match for the documentation project, the docker container that will map the plugins, and the plugins repos.

• Are plugins “compatible” with older CRS versions? (I see "Preparation for older installations") in the docs, e.g. https://github.com/coreruleset/phpmyadmin-rule-exclusions-plugin
• how is the proposed flow for installing plugins? using git? getting a zip file? none of the above?
• depending on the previous, things may vary. if we use git, we can’t clone everything to the same directory, so people will need to use a subdirectory on the plugins folder for each plugin.
• we can use the https://github.com/coreruleset/plugin-registry repo to create a yaml file with the list of plugins so it can be consumed by scripts. I foresee a script that gets the plugins, for example. Just simple bash + curl, but we need to verify things probably (gpg?).
• documentation should match the efforts in the crs docker container (https://github.com/coreruleset/modsecurity-crs-docker/pull/66). People should have a way of installing plugins there (even if using volume mount).

So, we need to check that:

• plugin registry
• plugins doc
• coreruleset documentation
• crs docker documentation all matches and have the same description and usage.

Otherwise it is going to be caos.

[fzipi]

So we agree on:

• source of truth: coreruleset.org/docs..
• every plugin has a small intro on what it does, and points ☝️ for installing/configuring
• we can adapt the containers based on the documentation

[RedXanadu]

As far as I know, the latest and greatest documentation we have regarding plugins is here: https://coreruleset.org/docs/configuring/plugins/

This is based on the CRS blog post announcing plugins and how to install them, compatibility with older CRS versions, different install methods, etc.

If we want to have a “single source of truth” for plugin documentation, I propose that should be it. So, if anything is missing then let’s add it there, and if we need to copy plugin documentation to other places then let’s pull it from there as well.

I can’t comment on the Docker issues as that’s beyond the scope of what I’m looking at.