A control plane, governed rule management, compliance evidence and SIEM export — layered on the core through its extension seams. Self-hosted, off the request path, and open source like the rest of Light WAF.
Three things change when you move from a standalone WAF to a governed deployment across many nodes.
The core protects one node; the data-path components coordinate across the whole cluster — one rate-limit budget, shared reputation, managed certificates.
A control plane collects every node's telemetry, shows what's blocked and why, alerts on attack signatures, and manages rules with per-node convergence.
RBAC and SSO, a signed tamper-evident audit log, on-demand SOC2/PCI evidence, and a SIEM feed — the paperwork a security program needs.
Data-path components plug into the core's seams, survive reloads, and act across the whole cluster. Each one is default-off and turned on by its own [enterprise.*] table.
One token-bucket budget shared across every node via Redis, accounted atomically server-side. No node over-allows.
Score client IPs from your blocklists; a single-writer feed keeps the shared, self-expiring reputation fresh across the fleet.
Hitless certificate issuance and rotation (TLS-ALPN-01 or DNS-01 wildcards), coordinated across nodes so one issues for the cluster. Plus mutual TLS.
A maintained pack of high-signal content — Log4Shell, Spring4Shell, cloud-metadata SSRF, CISA-KEV CVEs — on top of the CRS engine.
Validate every GraphQL, gRPC and REST request against your app's real schema or OpenAPI spec; a route or field the real client never sends is a probing signal.
Flag clients that impersonate a browser, and gate your own WASM modules behind a detached minisign signature — a plugin that fails verification never loads.
A separate service, off the request path, that turns every node's telemetry into one operational picture.
Optionally capture the complete denied request — headers, cookies and body — off the data path, so the drill-down shows exactly what was blocked. Node-side redaction, short retention, RBAC-gated and audited on every view.
Rules over the decision stream fire when a pattern crosses a threshold (a per-IP or per-rule block burst), with cooldowns, and push to a webhook.
Events and alerts stream in over SSE — the console updates the moment a node reports, without a page reload.
Who can do what, a record that can't be quietly altered, and the reports your auditors ask for.
Viewer / operator / admin roles, local accounts, and OpenID Connect single sign-on behind HttpOnly session cookies.
Every action hash-chained and Ed25519-signed — tamper-evident, and verifiable on demand from the dashboard.
Generate a signed SOC2 / PCI evidence bundle for any period: access control, audit integrity, WAF effectiveness, incidents.
Push denied verdicts, audit records and alerts to your SIEM as versioned ECS-like NDJSON — at-least-once, with visible lag.
Helm charts, a first-class operator, and GitOps examples — a WAF per workload, not a rewrite of the data path. Multi-arch images (amd64 + arm64) are published on the GitHub Container Registry.
One chart puts a hardened WAF in front of a workload; another runs the control plane with bundled or managed Postgres. Everything is a value — modules, TLS, rate limits, capture.
A namespaced CRD (waf.io/v1alpha1): declare a WafProxy and the operator renders and owns the ConfigMap, Deployment and Service. Delete the CR and it cleans up.
Ready-made Argo/Flux, Ingress, Gateway API and cert-manager examples — drop the WAF into the traffic path you already run.
Non-root, read-only rootfs, dropped capabilities; on SIGTERM readiness flips so Kubernetes drains in-flight requests before the pod exits.
| Image | What it runs |
|---|---|
| ghcr.io/0x00spor3/waf-enterprise:1.0.2 | The data plane: the WAF proxy with every component wired in. |
| ghcr.io/0x00spor3/waf-controlplane:1.0.2 | The control plane: API, embedded dashboard and governance. |
| ghcr.io/0x00spor3/waf-node-agent:1.0.2 | Pulls published rulesets onto a WAF node and triggers a reload. |
| ghcr.io/0x00spor3/waf-operator:1.0.2 | The Kubernetes operator for the WafProxy custom resource. |
The properties that matter when you put software in front of your traffic.
The control plane never sits between clients and your backend. It reads telemetry — it cannot add latency or fail a request.
Every component plugs into the core's typed extension seams through the builder. The core never depends on a component.
The same memory-safe foundation as the core; TLS is rustls — no OpenSSL linked into any shipped binary.
Runs on your infrastructure — your Postgres, your Redis, your network. Nothing phones home; your traffic stays with you.
The WAF, the control plane and the node agent run in a few minutes from source or from the images. Start with one node and grow into the rest.