Web Application Firewall
Coraza with the OWASP Core Rule Set v4. Detect or block, with your own rules in a guarded SecLang editor.
CrowdSec bans
Community IP reputation through the local-API bouncer, with an auto-classify loop for repeat offenders.
Country blocking
A GeoIP gate per route on MaxMind GeoLite2, kept current automatically.
Rate limiting
Token-bucket limits per route and per client to absorb floods and brute force.
SSO & forward auth
OIDC with local users, RBAC and service accounts, in front of any app.
TCP / UDP (L4)
Route mail, databases and game servers too, not only HTTP.
Automatic HTTPS
Let's Encrypt and DNS-01 certificates issued and renewed for you — no cron, no manual rotation.
Real-time alerting
Fire webhook, email or Discord notifications the moment a security event or a route goes bad.
Audit log
Every configuration change recorded with who, what and when — a tamper-evident trail by default.