Reverse Proxy, WAF, & CrowdSec options for 2024 reddit / selfhosted ---------------------------------------------------------------------- lukerwry · 2023-10-05 00:08 I've been playing around with a few reverse proxy & security stacks, and was wondering what the community thinks about current options and also if any will become a standout in the next year or so. The options I have personally started prototyping are: \- nginx, modsecurity, & crowdsec \- caddy & coraza \- bunkerweb Some other options I have considered, but not tried yet are: \- traefik, modsecurity, & crowdsec \- nginx proxy manager (NPM) & modsecurity I have seen past discussions about some of these, but they seem to have become outdated pretty quickly due to all the changes this year: modsecurity went through a major version change then is going FOSS, coraza was in a sort of beta stage earlier this year, NPM seems to have lost a little support at the beginning of this year and seems to picking back up now (?), bunkerweb went through a major version release. For all the options I've looked at there seems to be both pros and cons, and I personally don't have a clear "winner" at this point. Hoping for any insight or opinions. Also, if anyone wants any of the guides that I have found helpful so far, just shoot me a message/comment. ---------------------------------------------------------------------- NikStalwart · 2023-10-05 01:32 > For all the options I've looked at there seems to be both pros and cons, and I personally don't have a clear "winner" at this point. And that's the thing with software: there seldom is a clear winner. Just look at the Vim vs Emacs holy wars. Everything has its place. I personally don't fret too much about security extensions, because the majority of my public-facing sites are static. Being static, fail2ban/crowdsec is useless because there aren't any 'failure patterns' to act on. Everything I really care about goes behind VPN or behind cloudflare CDN. If it's behind a VPN, I don't need security extensions because I don't even have open firewall ports. If it's behind cloudflare, I let cloudflare handle attack mitigation at the edge. Problem solved. I don't like NPM because I am allergic to web UIs. I don't use caddy because I grew up with nginx, I know it well, and I don't need to choose a different web server. ---------------------------------------------------------------------- Oolupnka · 2023-10-05 07:56 Caddy is so easy to configure and rock stable. Using anything else is painful. ---------------------------------------------------------------------- selfh-sted · 2023-10-05 12:34 I think this is a neat exercise and will be interested in hearing where you land, but would also encourage you to explore using a firewall (OPNsense, pfSense) as the first line of security in your network and the benefits that would come along with it. It's a bit more complex than the options you've listed, but what's self-hosting without a bit of tinkering? :) ---------------------------------------------------------------------- lukerwry · 2023-10-05 15:22 Been using opnsense for a few years now and think it's great. I also have been using nginx via Synology's reverse proxy feature, but want to migrate away from that and also add some additional security. ---------------------------------------------------------------------- Fluffer_Wuffer · 2023-10-06 09:30 A couple more: Haltdos, not tried but been on my list for about 6 months. OpenAppSec, this is an odd one, the Dev has posted a few times, but it never got much attention, though it turns out it's sponsored/supported by CheckPoint... Then there are the usual, suck as Kemp and Zen. My goto at present for VPS, is Crowdsec, just because.they engaged well, and seem to follow a similar model to Tailscale - I.e. engage the community, we help improve the product, and return get a meaningful service from it. Whilst the enhancements feed into business desirability.. I just hope they don't do the usual and sell out, the minute PA, Cisco, Fortinet or even Akamai chew them up, this will all disappear. ---------------------------------------------------------------------- lukerwry · 2023-10-06 21:25 Never heard of either of those, but they look interesting, thanks for the tips! And I agree with the point about crowdsec, it seems like one of the current best options for security and it's well maintained as of now. ---------------------------------------------------------------------- lukerwry · 2023-10-06 21:28 I ended up going with Caddy & coraza, and then crowdsec running on opnsense. Although I had a hard time finding documentation for caddy's modules, the config is just so straightforward. And since this is for self- hosting and I don't have anyone to "peer-review" my work, that's a priority for me. One thing to note is it seems like coraza doesn't work with websockets and I host Home Assistant, which uses websockets in its front end. I ended up not being able to get coraza working for Home Assistant.