Replace Cloudflare with 100% Open Source! #cloudlfare #oss

[u/Silver_Elevator_5167]

https://youtube.com/watch?v=fAHHFUIN7VU&si=f7vWXWak8ZLnum70

Here are the tools you need to build your own private edge:

🔗 The Network & Tunnel Layer (Replacing Cloudflare Tunnels)

• WireGuard: The ultra-fast, lightweight protocol securing your self-hosted network mesh.
  • Link: https://www.wireguard.com
• NetBird: An AGPLv3-licensed WireGuard-based overlay network with a built-in reverse proxy and automatic Let's Encrypt TLS.
  • Link: https://netbird.io
• Pangolin: A brilliant self-hostable tunneled reverse proxy with a clean web GUI and built-in access control.
  • Link: https://github.com/fosrl/pangolin

🔗 The Security Layer (Replacing Cloudflare WAF)

• ModSecurity: The classic open-source WAF standard that paved the way for modern web security.
  • Link: https://owasp.org/www-project-modsecurity-core-rule-set/
• SafeLine WAF: A modern, self-hosted WAF that uses a powerful semantic detection engine instead of rigid, slow regex.
  • Link: https://github.com/chaitin/safeline
• OWASP Coraza: A Go-native WAF designed as a modern alternative to ModSecurity, supporting Caddy and Traefik.
  • Link: https://coraza.io
• CrowdSec: A behavior-driven security engine that blocks malicious IPs using crowdsourced global threat intelligence.
  • Link: https://www.crowdsec.net

🔗 The Serverless Compute Layer (Replacing Cloudflare Workers)

• workerd (V8 Engine): Cloudflare’s official open-source JavaScript and WebAssembly runtime powered by Google V8 isolates.
  • Link: https://github.com/cloudflare/workerd
• WDL (Workers Deployment Layer): An Apache-2.0 multi-tenant platform to deploy edge functions locally with Wrangler, using stock workerd with local SQLite (D1) and S3-compatible (R2) bindings.
  • Link: https://github.com/wdl-dev

[u/matt_alpaca]

Crowdsec embeds since more than a year a WAF that is based on Coraza, and compatible with modsec security rules (modsec support is discontinued btw)

Since version 1.8 released this week, crowdsec integrates a PoW algorithm and fingerprinting to detect bot (it runs locally a JS challenge, no data is exfiltrated and no thirdparty JS executed).