Selfhosted

41674 readers

638 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago

MODERATORS

HybridSarcasm@lemmy.world

HybridSarcasm@lemmy.hybridsarcasm.xyz

Looking for Recommendations - FOSS WAF (lemmy.world)

submitted 1 week ago by Admax@lemmy.world to c/selfhosted@lemmy.world

7 comments fedilink hide all child comments

Hey everyone !

I'm looking into spinning up a WAF as the number of services I'm hosting is slowly growing. I want to have a better understanding of the traffic and also have a relative peace of mind that if there is a flaw in one of the services I'm hosting, the WAF could help mitigate it.

I've seen two big names come up while searching :

SafeLine
BunkerWeb

They are popular and look quite good all around but I don't want to just mindlessly take the project with the most GitHub stars.

What WAF are you using / have you used ? Which ones do you recommand ?

top 7 comments

sorted by: hot top controversial new old

[–] just_another_person@lemmy.world 6 points 1 week ago (1 children)

Crowdsec

[–] Admax@lemmy.world 1 points 1 week ago

I just read a bit about it and it sounds quite interesting with the community aspect of it all. I'll give it a deeper look later, thanks !

[–] ptz@dubvee.org 3 points 1 week ago* (last edited 1 week ago)

I run a custom build of Nginx with a few extra modules compiled in:

ModSecurity
- https://github.com/SpiderLabs/ModSecurity-nginx.git
- https://github.com/SpiderLabs/ModSecurity
Nginx GeoIP2 Module (https://github.com/leev/ngx_http_geoip2_module.git)
OWASP Core Rule Set: https://github.com/coreruleset/coreruleset/tree/v4.10.0/rules

Some guidance can be found here: https://docs.nginx.com/nginx-waf/admin-guide/nginx-plus-modsecurity-waf-owasp-crs/

That guidance is for NginxPlus, but you can compile the dynamic module yourself with the community versions.

[–] BlackEco@lemmy.blackeco.com 2 points 1 week ago* (last edited 1 week ago) (2 children)

I have been using BunkerWeb for the past 4 years and have been mostly happy with it. Its default settings are sometimes a bit agressive but you can change those globally or service per service.

[–] MangoPenguin@lemmy.blahaj.zone 4 points 1 week ago (1 children)

The fact that they lock Letsencrypt DNS-01 behind the pro version is so incredibly annoying.

[–] BlackEco@lemmy.blackeco.com 1 points 1 week ago

Yeah, I use Caddy for that, as I only use DNS-01 for local-only services.

[–] Admax@lemmy.world 1 points 1 week ago

Thanks that's good to know :)