liberatti/nxguard repository overview

⁠ NXGuard

NXGuard is a high-performance, secure API Gateway and Reverse Proxy powered by OpenResty and ModSecurity. It provides a robust layer of protection for your API ecosystem, ensuring scalability, security, and operational simplicity.

⁠🚀 Key Features

• 🛡️ Advanced Security: Native integration with ModSecurity v3 for real-time threat detection (SQLi, XSS, etc.).
• ⚡ High Performance: Leverages the power of OpenResty (Nginx + LuaJIT) for sub-millisecond request processing.
• 📊 Real-time Monitoring: Detailed transaction logging and telemetry for proactive threat identification.
• ⚖️ Smart Load Balancing: Sophisticated traffic distribution across backend services.
• 🛠️ Operational Simplicity: Lightweight architecture with a modern management interface.
• 🌐 Scalability: Modular design built for horizontal scaling in containerized environments.

⁠📸 Dashboard Preview

Modern, intuitive management interface for full control over your API security.

⁠🏗️ Architecture

High-performance architecture integrating OpenResty, ModSecurity, and Redis.

⁠🚦 Getting Started

⁠Quick Start with Docker Compose

Deploy a full NXGuard stack including the Management UI and IPGuard in seconds:

services:
  redis:
    image: redis:7.2
    command: ["redis-server", "--save", "", "--appendonly", "no"]

  nxguard:
    image: liberatti/nxguard:latest
    environment:
      NXGUARD_ROLE: "main"
      SERVERID: "nxguard-admin"
      NXGUARD_IPGUARD_URL: "http://ipguard:5000"
      REDIS_CACHE_HOST: redis
    ports:
      - 5000:5000
      - 80:80
      - 443:443
    deploy:
      resources:
        limits:
          memory: 256M

  ipguard:
    image: liberatti/ipguard:latest
    volumes:
      - ipguard_data:/opt/ipguard/data
    deploy:
      resources:
        limits:
          memory: 64M
      replicas: 2

volumes:
  ipguard_data:

• Management Interface: http://localhost:5000⁠
• Default Credentials: [email protected] / admin

⁠🧪 Security Validation

Validate your WAF rules using GoTestWAF:

docker run --rm -v ${PWD}/reports:/app/reports \
    wallarm/gotestwaf --url=https://<YOUR_ENDPOINT> --noEmailReport

⁠🔢 WAF Rule ID Reservations

⁠📡 Telemetry Notice

To improve our security engine, NXGuard collects anonymous traffic statistics over 24-hour cycles. No sensitive, personal, or request-specific data is ever collected. This information is used solely to enhance threat detection accuracy.

⁠📄 License

This project is licensed under the Apache License 2.0. See the LICENSE⁠ file for the full text.

Developed with ❤️ by Gustavo Liberatti