synitio/synit-waf repository overview

⁠Synit WAF

Tenant-aware reverse proxy and Web Application Firewall for modern web applications and APIs.

Synit WAF is an open-source reverse proxy and WAF written in Go. A single instance can protect multiple hostnames, apply an independent security policy to each tenant, and route accepted traffic to healthy upstream services.

It combines application-layer firewalling with authentication, network policies, API protection, optional threat intelligence, LLM request controls, response masking, health-aware load balancing, and Prometheus observability.

Source: github.com/synit-io/synit-waf⁠ Maintained by: synit.io⁠ License: Apache License 2.0 Community: Discord⁠

⁠Quick start

Pull the latest stable image:

docker pull synitio/synit-waf:latest

For reproducible deployments, use a versioned tag:

docker pull synitio/synit-waf:1.0.0

Production deployments should preferably pin the image digest as well:

synitio/synit-waf:1.0.0@sha256:<digest>

Supported platforms:

• linux/amd64
• linux/arm64

⁠Run with Docker

Synit WAF reads its configuration from /etc/waf/config.yml.

docker run --rm \
  -p 8080:80 \
  -p 127.0.0.1:9090:9090 \
  -e WAF_GLOBAL_ADMIN_ADDRESS=0.0.0.0:9090 \
  -v /absolute/path/config.yml:/etc/waf/config.yml:ro \
  synitio/synit-waf:latest

The container image is distroless and runs as a non-root user.

The Synit WAF binary is located at:

/usr/local/bin/synit-waf

The container also includes example rule profiles under:

/etc/waf/rules

⁠Key capabilities

⁠Multi-tenant routing

Protect multiple applications from one Synit WAF instance.

• Exact hostname matching
• Leading wildcard hostnames
• Strict host allow-listing
• Multiple upstreams per tenant
• Independent security policy per hostname

Requests for unknown hosts are rejected.

⁠Web Application Firewall

Synit WAF integrates with Coraza and supports:

• Coraza-compatible rules
• Reusable rule sets
• Custom rules
• External rule files
• Audit mode
• Custom block pages
• Per-tenant WAF policies

⁠Authentication

Authentication can be configured independently for each tenant:

• JWKS-backed JWT validation
• RSA, ECDSA and EdDSA JWT keys
• bcrypt-backed Basic Authentication

⁠Network security

Apply edge-level network controls before requests reach your applications:

• Global IP block and allow lists
• Trusted proxy chains
• Global rate limiting
• Per-tenant/client rate limiting
• IPv6 /64 grouping
• Optional MaxMind GeoIP country blocking

⁠CrowdSec integration

Synit WAF can query an external CrowdSec LAPI for IP decisions.

Features include:

• Per-client decision caching
• Configurable cache TTL
• Fail-open or fail-closed behavior

⁠GraphQL protection

GraphQL endpoints can be protected with configurable limits for:

• Introspection
• Query depth
• Query size
• Batched operations

Controls apply only to configured GraphQL paths.

⁠LLM protection

Synit WAF includes request controls designed for applications exposing LLM functionality.

Supported modes:

• rules
• ml
• hybrid

Capabilities include:

• Static prompt inspection rules
• Configurable inspection paths
• Authenticated ONNX classifier integration
• Audit or deny workflows

Machine-learning mode uses the optional synit-llm-guard sidecar. No model weights are bundled with the WAF image.

⁠Response protection

Synit WAF can mask sensitive information in eligible upstream responses using regex-based rules.

Supported response types include bounded:

• Text
• JSON
• XML

⁠Reverse proxy

Proxy functionality includes:

• Health-aware round-robin upstream selection
• Active TCP health checks
• Active HTTP health checks
• Passive circuit breakers
• Response-header timeouts
• Connection pool limits
• WebSocket upgrades
• Server-Sent Events
• Request header transformations
• Response header transformations
• Controlled forwarding headers

⁠TLS

Deploy Synit WAF behind an existing TLS terminator or let the WAF manage certificates using ACME.

Supported deployment approaches include:

• External ingress/load balancer TLS
• Automatic ACME certificates
• Optional Cloudflare DNS-01 support for wildcard certificates

⁠Minimal configuration

At least one tenant and one HTTP or HTTPS upstream are required.

global_settings:
  log_level: "INFO"
  admin_address: "127.0.0.1:9090"
  request_body_limit: 1048576
  write_timeout: "0s"

waf_rule_sets:
  starter: |
    SecRule REQUEST_METHOD "@rx (?i:^(trace|track)$)" "id:110001,phase:1,deny,status:403,log,msg:'Blocked unsafe method'"

tenants:
  "app.example.com":
    upstreams:
      - url: "http://app:8080"
        response_header_timeout: "30s"

    health_check:
      path: "/healthz"

    security:
      waf_enabled: true
      audit_mode: true
      paranoia_level: 1
      include_rule_sets:
        - "starter"

Start new WAF rules in audit mode, observe representative traffic, tune false positives, and enable enforcement once the policy has been validated.

⁠Request processing

Requests pass through a defined security pipeline:

Client
  ↓
IP policy
  ↓
GeoIP
  ↓
Global rate limit
  ↓
Tenant matching
  ↓
Tenant rate limit
  ↓
JWT / Basic Auth
  ↓
CrowdSec
  ↓
Coraza WAF
  ↓
GraphQL / LLM controls
  ↓
Healthy upstream
  ↓
Response masking / header transforms

Only configured exact or wildcard hostnames are served.

⁠Configuration

Synit WAF uses strict YAML configuration.

A sibling tenants.d/ directory can optionally be used to split tenant configurations across multiple .yml or .yaml files.

Configuration validation rejects issues such as:

• Unknown YAML fields
• Missing tenants or upstreams
• Duplicate or conflicting hostnames
• Invalid URLs
• Invalid IP addresses or CIDRs
• Invalid regular expressions
• Invalid durations
• Invalid security combinations
• Missing block pages
• Invalid ACME configuration

Configuration files are watched for changes.

Reloads are transactional: Synit WAF builds and validates the complete candidate configuration before publishing it. If validation fails, the currently running configuration stays active.

⁠Operational endpoints

Synit WAF exposes separate public and administrative health endpoints.

The administrative listener defaults to:

127.0.0.1:9090

Keep the admin listener on a private operations network.

⁠Observability

Synit WAF supports JSON or text logs and exposes Prometheus metrics covering:

• HTTP requests and latency
• Blocked requests
• Coraza rule matches
• Audit-mode events
• Upstream requests
• Upstream health
• Configuration reloads
• Dropped forwarded logs
• Build/version information

An optional authenticated ai-logs-receiver service is also available for receiving batched NDJSON log events.

⁠Container tags

Docker Hub publishes stable version aliases without a v prefix.

For a release such as 1.0.0, tags include:

1.0.0
1.0
1
latest

Use an explicit version or immutable digest for production deployments rather than relying solely on latest.

⁠Deployment options

Synit WAF can be deployed using:

• Docker
• Docker Compose
• Kubernetes
• Docker Swarm
• Standalone binary deployments
• Multi-replica environments

Deployment templates are available in the GitHub repository.

⁠Security considerations

For production deployments:

• Pin container images by digest.
• Keep configuration and WAF rules read-only.
• Keep the admin endpoint private.
• Trust forwarded headers only from explicitly configured proxy CIDRs.
• Store credentials in environment variables or mounted secret files.
• Never commit secrets to source control.
• Keep CrowdSec, LLM Guard, log receiver and coordinator traffic private or encrypted.
• Supply and maintain your own MaxMind database when GeoIP is enabled.
• Test fail-open and fail-closed behavior before rollout.
• Evaluate new WAF rules in audit mode before enforcement.

⁠Related images

The Synit WAF project also publishes optional supporting services:

synitio/synit-llm-guard
synitio/ai-logs-receiver

⁠Synit LLM Guard

Authenticated ONNX text-classification sidecar used by the WAF's ml and hybrid LLM protection modes.

Operators supply and evaluate their own compatible classification model.

⁠AI Logs Receiver

Optional authenticated sink for WAF log forwarding.

It accepts NDJSON batches and JSON events and stores bounded tenant-specific daily log files.

⁠Important limitations

• The OWASP Core Rule Set is not bundled.
• Most runtime state is local to each WAF process.
• Configuration is file-based; there is no central control-plane API or configuration database.
• GeoIP quality depends on the operator-supplied database.
• LLM classification accuracy and latency depend on the selected model and workload.
• Response masking cannot preserve streaming, compressed, ranged or oversized responses when masking is required.
• Log forwarding is asynchronous and does not provide a durable retry queue.

See the project documentation for the complete operational and security details.

⁠Documentation

• Documentation⁠
• Quick start / onboarding⁠
• Configuration reference⁠
• Use cases⁠
• Deployment models⁠
• Security policy⁠
• Releases⁠

⁠Community & support

For questions, configuration help and deployment discussions:

Discord: https://www.synit.io/discord⁠

For defects and feature requests, use GitHub Issues.

Security vulnerabilities should be reported privately according to the project's security policy rather than through public issues or Discord.

⁠License

Synit WAF is open source under the Apache License, Version 2.0.

See the repository's LICENSE, NOTICE, and third_party/ files for licensing and attribution information.