CasWAF documentation

CasWAF is an open-source reverse proxy and web application firewall (WAF) written in Go. It takes the place of Nginx in front of your web applications: it listens on ports 80 and 443, picks the site by the requested domain, terminates HTTPS, checks each request against your rules and forwards it to the application. Everything is set up in a web console instead of configuration files, and the settings live in a database that several gateway nodes can share.

Getting startedCopy Anchor Link

• Introduction: what CasWAF does and how a request goes through it
• Quick start: build it, run it and put the first site behind it
• Sign in with Casdoor: the Casdoor application the console signs in through
• Docker: build and run the image with Docker Compose

SitesCopy Anchor Link

• Sites: domains, where requests go, and the site status
• HTTPS: the SSL modes, how a certificate is picked, and the headers CasWAF adds
• Redirects: extra domains, www. and trailing slashes
• Login protection: only let signed-in Casdoor users reach a site
• Health alerts: email or SMS when a site stops answering

CertificatesCopy Anchor Link

• Certificates: adding certificates and how they are matched to domains
• Let's Encrypt: certificates issued and renewed automatically

RulesCopy Anchor Link

• Rules: how rules are attached to sites, checked in order, and what each action does
• IP rules: addresses, ranges and traffic from abroad
• User-Agent and URL path rules: match the client or the path
• Rate limiting: requests per second per IP, and how long an address stays blocked
• WAF rules: ModSecurity SecLang rules run by Coraza
• CAPTCHA: send visitors through a CAPTCHA instead of blocking them

MonitoringCopy Anchor Link

• Request records: every request the gateway receives, and how long they are kept
• Dashboard: requests over time, top sites, IPs and User-Agents

OperationsCopy Anchor Link

• Configuration: every key in conf/app.conf and the environment variables
• Client IP behind a proxy: trusted proxies and X-Forwarded-For
• Nodes: several gateways sharing one database
• Upgrading: updating by hand, and self-update

MoreCopy Anchor Link

• Roadmap: what is being built next
• Comparison: CasWAF next to Nginx, Caddy, Nginx Proxy Manager, BunkerWeb and SafeLine
• FAQ