{
  "id": 18419690,
  "title": "I liked Nginx Proxy Manager, but I wanted a WAF in the same place",
  "url": "https://urgent.news/2026/11/06/i-liked-nginx-proxy-manager-but-i-wanted-a-waf-in-the-same-place",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T02:06:51.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/moonjikwang/i-liked-nginx-proxy-manager-but-i-wanted-a-waf-in-the-same-place-6j0"
  },
  "original_language": "en",
  "account": "Nginx Proxy Manager (NPM) is a popular tool for self-hosting web applications. However, when it comes to handling security threats, NPM often falls short. Scanners frequently attempt to access sensitive files and databases, even if they don't pose a genuine risk. To address these concerns, the developer created Corvus, a self-hosted gateway that combines the functionality of NPM with an added security layer. Corvus is written from scratch using OpenResty, Go, and React, and is released under the Apache-2.0 license, ensuring it remains free and open source. It offers features such as proxy hosting, Let's Encrypt support with auto-renewal, redirections, and the ability to block known attack patterns including SQL injection and path traversal. Additionally, Corvus provides automatic bans for IPs that repeatedly attempt unauthorized access and an access queue that allows controlled access during periods of high traffic. Users can also customize security rules, enable a browser challenge to deter bots, and implement an \"under attack\" mode that automatically challenges visitors based on specific thresholds. Importing data from NPM is simple, and all config changes are versioned with a rollback feature. Corvus is currently in its early stages, but the developer is committed to addressing bugs and improving the system.",
  "summary": "If you self-host anything, there is a good chance it sits behind Nginx Proxy Manager (NPM). Add a domain, pick a container, click Let's Encrypt, done. I used it for exactly that reason. Then you open the logs of anything exposed to the internet and see this, every day: GET /.env GET /wp-config.php GET /../../etc/passwd GET /?id=1 UNION SELECT password FROM users You don't run WordPress and you…",
  "key_points": [
    "Corvus combines Nginx Proxy Manager with a WAF for enhanced security.",
    "Written in OpenResty, Go, and React, Corvus is released under Apache-2.0 license.",
    "Features include proxy hosting, Let's Encrypt support, and automatic IP bans."
  ],
  "editors_take": "Integrating a web application firewall directly into a proxy management tool streamlines self-hosted security by replacing fragmented setups with a single, cohesive gateway for managing traffic and threats.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}