Reverse proxy
The default mode: ToutWAF terminates TLS, inspects HTTP/1.1, HTTP/2 and WebSocket, and forwards clean traffic to your origins.
Deploy it your way
Reverse proxy, Kubernetes, or alongside the proxy you already run. Same engine and same console everywhere.
The public version is a development version, 0.3.0-dev. No stable version exists yet.
Architecture at a glance
Clients
CDN / load balancer (optional)
Data plane nodes
Your origins
Control plane: console, API, policy
Kubernetes
A Helm chart and manifests (ingress, sidecar) supplied with your distribution; the operator is CRDs and a skeleton.
Alongside your proxy
nginx (auth_request), Traefik (forwardAuth) and Caddy can ask ToutWAF for a decision; Envoy and HAProxy call an HTTP decision endpoint (no gRPC ext_authz, no SPOE agent).
Docker
An all-in-one image for Docker Compose, built from the supplied files, with a read-only file system and no extra capabilities. No image is published to a registry yet; tested on Linux amd64 only.
Standalone
A data plane driven by a YAML policy file with hot reload, without a control plane; offline installation from a local archive.
Infrastructure as code
YAML or JSON policy files for Git and CI, an Ansible role, a Helm chart and an API client for Terraform (a Terraform provider is not available yet).
High availability
Stateless data-plane nodes behind your load balancer or keepalived. They keep protecting with the last policy if the control plane is unreachable. A standby console takes over when you decide.
Native binaries
Single binaries for Linux (amd64, arm64) and Windows, run as hardened systemd services or Windows services. See the supported systems for what was tested.
Developers: test locally in one command
Run ToutWAF in front of your dev app and watch blocks live in the terminal and the console. Everything in the console is also available through the API and the command line.
bash
toutwaf-dp dev --upstream http://localhost:3000Fast, honest and measured
Short-circuit at the blocking threshold, a time budget per request and atomic hot reload of the compiled policy. Latency and throughput are measured with the built-in benchmark; the figures that exist are published in the documentation with their limits, never promised in advance.
bash
toutwaf-dp benchPut a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.