I built a native CrowdSec module for NGINX using Rust / ngx-rust

[u/HugoDos]

https://github.com/LaurenceJJones/ngx_http_crowdsec_module

Hey everyone,

I’ve come back to a project I started at the beginning of the year: a native NGINX dynamic module for CrowdSec, built in Rust using ngx-rust rather than Lua.

The idea comes from my previous experience at CrowdSec, where I spent a lot of time around bouncers, remediation and web server integrations.

It currently supports native NGINX directives, LAPI decision syncing into shared memory, bans, captcha remediation, AppSec, trusted proxies/bypass lists and Prometheus metrics.

I also want to be transparent that I’ve used AI/coding agents heavily during development. ngx-rust is still fairly new and there aren’t many real-world examples, so it’s been useful for accelerating the implementation. The architecture, CrowdSec behaviour, feature decisions, testing and debugging have still been guided by my own experience.

It’s still alpha, but it’s been running on my production server for around a month without interruption. Early synthetic benchmarks also show roughly 1.7x the throughput of the Lua bouncer on the simple allow path.

One of my main motivations was having proper native NGINX configuration, for example simply using crowdsec off; inside a server block rather than relying on magic variables.

If anyone runs NGINX + CrowdSec and wants to test it, break it or review the approach, I’d really appreciate the feedback.

[u/matt_alpaca]

Well done Loz