0030 (ADR-008): Keel Web appliance: Nginx, Coraza and Anubis #35

New issue

Open

opened 2026-09-30 10:10:50 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-30 10:10:50 -03:00

(Migrated from github.com)

Decision (maintainer, 2026-09-30). Keel Web is Nginx + Coraza (WAF as an Nginx module) + Anubis (proof of work), useful alone and the base of every web appliance. Simple: Nginx only. Advanced: Coraza and Anubis configured. Pipeline: CrowdSec bans first; Nginx terminates TLS, serves static files, runs Coraza inline; Anubis behind Nginx; then the application. Anubis never at the edge; Googlebot and Bingbot (Yandex where relevant) exempt. Apache retired as default web server, migrated per appliance.

Handbook: docs/decisions/0030-keel-web.md (handbook#26)

Amends: 0013 (apache-php layer superseded; Keel PHP = Keel Web + PHP-FPM), 0022 (LNPP's nginx is Keel Web).

Review notes (resolved by the maintainer, 2026-09-30)

The Coraza Nginx connector is still experimental. Resolved: Coraza stays as the Nginx module; the risk is an implementation task (below). Known fallbacks, which would need a new decision: ModSecurity v3 (libnginx-mod-http-modsecurity 1.0.3 in trixie) or Coraza as a proxy.
Package facts (Debian archive and WNPP, 2026-09-30): Anubis not in Debian, ITP #1102132 being packaged, upstream publishes a .deb (v1.27.0); Coraza has no package and no ITP; CrowdSec 1.4.6-10 in trixie (upstream 1.8.1). Coraza and Anubis are Keel packages under 0039; Anubis is a candidate to contribute to Debian via tracker#15, coordinating with the ITP owner.

First tasks

Build the Coraza Nginx connector and test it against the OWASP CRS in the Keel Web gate; track its maturity.
Package Anubis for the Keel repository.
Nginx overlay in common; Keel Web recipe with Coraza/Anubis disabled in simple.

**Decision (maintainer, 2026-09-30).** Keel Web is Nginx + Coraza (WAF as an Nginx module) + Anubis (proof of work), useful alone and the base of every web appliance. Simple: Nginx only. Advanced: Coraza and Anubis configured. Pipeline: CrowdSec bans first; Nginx terminates TLS, serves static files, runs Coraza inline; Anubis behind Nginx; then the application. Anubis never at the edge; Googlebot and Bingbot (Yandex where relevant) exempt. Apache retired as default web server, migrated per appliance. **Handbook:** `docs/decisions/0030-keel-web.md` (handbook#26) **Amends:** 0013 (`apache-php` layer superseded; Keel PHP = Keel Web + PHP-FPM), 0022 (LNPP's nginx is Keel Web). **Review notes** (resolved by the maintainer, 2026-09-30) - [x] The Coraza Nginx connector is still experimental. Resolved: Coraza stays as the Nginx module; the risk is an implementation task (below). Known fallbacks, which would need a new decision: ModSecurity v3 (`libnginx-mod-http-modsecurity` 1.0.3 in trixie) or Coraza as a proxy. - [x] Package facts (Debian archive and WNPP, 2026-09-30): Anubis not in Debian, ITP #1102132 being packaged, upstream publishes a .deb (v1.27.0); Coraza has no package and no ITP; CrowdSec 1.4.6-10 in trixie (upstream 1.8.1). Coraza and Anubis are Keel packages under 0039; Anubis is a candidate to contribute to Debian via tracker#15, coordinating with the ITP owner. **First tasks** - [ ] Build the Coraza Nginx connector and test it against the OWASP CRS in the Keel Web gate; track its maturity. - [ ] Package Anubis for the Keel repository. - [ ] Nginx overlay in common; Keel Web recipe with Coraza/Anubis disabled in simple.