Does Caddy have some kind of WAF?

Help
1

Hi,
does Caddy have some kind of WAF or some way to protect Meteor.js Node/MongoDB app that is behind Caddy proxy?

Logs for current problem are here:
https://github.com/wekan/wekan/issues/1908

Currently I have this config. http/1.1 if for compatibility with Firefox inspect console, that only supports http/1.1

boards.example.com {
	tls {
	    alpn http/1.1
	}
	proxy / localhost:3001 {
	  websocket
	  transparent
	}
}
1 Like
2

Hi @xet7,

Caddy itself is not a WAF. I’d guess that WAF-like behaviours could be implemented easily as a plugin, though.

3

Plugins like clamav scan (file uploads, downloads if used as forward proxy) or something like mod_security would be nice.
Any plans to do that? First step a clamav plugin would be really nice!

4

Hi @pwFoo, don’t think there’s any plans for this.

With v2 development still going ahead full steam, it isn’t likely to go on the docket for v1. You could open an issue on the Github requesting this as a feature in v2 though, see if you can get some interest.

2 Likes
5

That’s correct.

I definitely want to see a WAF app for Caddy 2.

2 Likes
6

I hope so too!. WAF would be expected for PCI compliance and “enterprise readiness”. Unfortunately I am not a plugin writer. :frowning: