I liked Nginx Proxy Manager, but I wanted a WAF in the same place
If you self-host anything, there is a good chance it sits behind Nginx Proxy Manager (NPM). Add a domain, pick a container, click Let's Encrypt, done. I used it for exactly that reason. Then you open the logs of anything exposed to the internet and see this, every day: GET /.env GET /wp-config.php GET /../../etc/passwd GET /?id=1 UNION SELECT password FROM users You don't run WordPress and you…
Nginx Proxy Manager (NPM) is a popular tool for self-hosting web applications. However, when it comes to handling security threats, NPM often falls short. Scanners frequently attempt to access sensitive files and databases, even if they don't pose a genuine risk. To address these concerns, the developer created Corvus, a self-hosted gateway that combines the functionality of NPM with an added security layer.
Corvus is written from scratch using OpenResty, Go, and React, and is released under the Apache-2.0 license, ensuring it remains free and open source. It offers features such as proxy hosting, Let's Encrypt support with auto-renewal, redirections, and the ability to block known attack patterns including SQL injection and path traversal.
Additionally, Corvus provides automatic bans for IPs that repeatedly attempt unauthorized access and an access queue that allows controlled access during periods of high traffic. Users can also customize security rules, enable a browser challenge to deter bots, and implement an "under attack" mode that automatically challenges visitors based on specific thresholds.
Importing data from NPM is simple, and all config changes are versioned with a rollback feature. Corvus is currently in its early stages, but the developer is committed to addressing bugs and improving the system.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
