Yet another Caddy WAF released :) - Plugins - Caddy Community = 40rem)" rel="stylesheet" data-target="chat_desktop" /> = 40rem)" rel="stylesheet" data-target="discourse-reactions_desktop" /> = 40rem)" rel="stylesheet" data-target="poll_desktop" /> = 40rem)" rel="stylesheet" data-target="desktop_theme" data-theme-id="1" data-theme-name="caddy custom"/> Yet another Caddy WAF released :) Plugins Fab23 (Fab23) January 4, 2025, 8:47am 1 Helo Caddy users, I just released a simple Caddy WAF (OWASP rule-based filtering, IP and DNS filtering, rate limiting, GeoIP). Features: Rule-based request filtering with regex patterns. IP and DNS blacklisting to block malicious traffic. Country-based blocking using MaxMind GeoIP2. Rate limiting per IP address to prevent abuse. Anomaly scoring system for detecting suspicious behavior. Request inspection (URL, args, body, headers, cookies, user-agent). Protection against common attacks (SQL injection, XSS, RCE, Log4j, etc.). Detailed logging and monitoring for security analysis. Dynamic rule reloading without server restart. Severity-based actions (block, log) for fine-grained control. Example reverse proxy with WAF # Global options { # Enable the global error log log { output file /var/log/caddy/errors.log level ERROR } # Automatic HTTPS settings email [email protected] } # Reverse proxy for example.com example.com { # Enable WAF waf { # Rate limiting: 100 requests per 5 seconds rate_limit 100 5s # Rules and blacklists rule_file /path/to/rules.json ip_blacklist_file /path/to/ip_blacklist.txt dns_blacklist_file /path/to/dns_blacklist.txt # Country blocking (requires MaxMind GeoIP2 database) block_countries /path/to/GeoLite2-Country.mmdb RU CN KP # Enable detailed logging log_all # Define actions based on severity severity critical block severity high block severity medium log severity low log } # Log access to a file log { output file /var/log/caddy/access.log format single_field common_log } # Reverse proxy to the origin server reverse_proxy http://origin-server:8080 { # Optional: Add headers to forward to the backend header_up X-Real-IP {remote_host} header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Proto {scheme} } } Enjoy and contribute: Fab23 (Fab23) January 19, 2025, 10:14am 2 Few updates: Features per path rate limiting added usable baseline of ruleset included test script with 300+ different attacks to evaluate your ruleset multiple rules files supported JSON metrics anomaly score improved data redaction dynamic reloading Performance async logging precomp regex at startup cached regex processing More to fix/improve until the 0.1.0 release, enjoy and contribute matt (Matt Holt) January 19, 2025, 5:00pm 3 Awesome! Thanks for sharing this. More plugins strengthens the ecosystem and gives more flexibility to site owners to enhance their security! svenakela (Sven) January 23, 2025, 8:24am 4 That’s an impressive feature list! Out of curiosity, why did you make it? I am using Coraza a lot in prod environments, but some of your features are missing and they would be nice to have. Fab23 (Fab23) January 25, 2025, 7:16am 5 Just for fun, learning and so… in addition to that I am enjoying go coding to svenakela (Sven) January 27, 2025, 9:56am 6 I linked your project in the OWASP Coraza group. People found it interesting. …maybe you should join the force. Fab23 (Fab23) February 1, 2025, 11:10am 7 Really appreciated and yes, I will be honored to join the force matt (Matt Holt) February 5, 2025, 4:23pm 10 (I probably need to adjust the auto-close rules on this category. This thread probably deserves to stay open for now!) Fab23 (Fab23) April 3, 2025, 8:04am 11 can i ask some support to register the module ? maybe i am missing some logic and neurons i would also avoid to steal the handler of existing wafs… how to achieve this mission, just changing handler? maybe existing users will complain me for that then… i am in a sort of freeze grey area if someone can share some guidance for such doubts it will be really appreciated. TIA Mohammed90 (Mohammed Al Sahaf) April 3, 2025, 9:44am 12 The module ID is not unique. You should be able to just register, unless you’re seeing an error. Fab23 (Fab23) July 28, 2026, 3:34pm 13 Finally successfully registered! Here the solution I used to fix the registration issue in my code: Can’t claim package - bb551bbb-3cb6-49ac-b703-6f204073ad15 - multionlabs/caddy-rolling-deployment