coraza

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

A wrapper for integrating the OWASP Coraza WAF with HAProxy's SPOE filters.

A modern web application firewall (WAF) management system built on top of HAProxy and OWASP Coraza WAF with the Coraza SPOA integration. This system provides a comprehensive backend API for managing HAProxy configurations, Coraza WAF rules, and traffic inspection.

Official plugins for BunkerWeb.

OWASP Coraza C connector

Web Application Firewall (WAF) for Kubernetes Gateways

Protect your Kubernetes workloads with ModSecurity-compatible rules and OWASP Core Rule Set (CRS) using native Kubernetes CRDs.

A single-binary Web Application Firewall + reverse proxy for Go, built on Coraza (OWASP CRS) with a built-in admin dashboard.

Production-ready Caddy HTTP middleware module for ALTCHA captcha verification. Protects web applications from automated abuse using cryptographic proof-of-work challenges.

Kubernetes-native WAF operator: one policy, every ingress and gateway. Go, OWASP Coraza + CRS, built for low latency.

Waf Coraza-spoa for HAProxy

Add TOTP 2FA to on-prem Microsoft Exchange via AD FS + Keycloak (no Azure AD). Guides, HAProxy/Coraza/Keycloak configs, setup scripts.

Full-featured, self-hostable WAF and reverse proxy in one binary, with a built-in web UI. No Docker or external database required.

Ansible playbook that publishes home services through a small VPS: Rathole tunnel, Caddy with automatic HTTPS and a hardened setup, CrowdSec with login brute force detection and AppSec, optional Coraza WAF and Cloudflare DNS.

Coraza Benchmark

Coraza Apache experimental integration

OWASP CRS plugin for Vaultwarden (Bitwarden): FP exclusions + opt-in path allowlist. JSON-API aware (no arg-name allowlist).

Hardened Caddy + Coraza WAF container with OWASP CRS. Non-root execution, automatic TLS, rate limiting, Cosign-signed images, and SLSA provenance

Self-hosted edge gateway for homelabs. Reverse proxy + WAF + load balancing + SSO in a single panel. Powered by Caddy, Coraza and CrowdSec.

Security policy as code for any API gateway. One policy per route (an OpenAPI extension), compiled by a deterministic CLI to Kong, Coraza, BunkerWeb, Cloudflare & more. Versions in git, drift fails CI. Apache-2.0.