Configuration
Raw plugin JSON for pow-proxy-wasm on Envoy
Plugin JSON (raw Envoy / WASM)
{
"secret": "your-32+-byte-or-longer-hmac-secret-here-please-change",
"base_difficulty": 18,
"min_difficulty": 12,
"max_difficulty": 26,
"header": "x-challenge-passed",
"value": "1"
}| Field | Required | Description |
|---|---|---|
secret | Yes | HMAC key, ≥ 32 bytes. Plugin fails to start if missing or short |
base_difficulty | No | Default difficulty (default 18 leading zero bits) |
min_difficulty | No | Floor (default 12) |
max_difficulty | No | Ceiling (default 26) |
header / value | No | Optional response header on pass-through |
kubeWAF
Do not hand-write this JSON when using the operator. Set spec.challenge on
the WAF resource instead — the controller injects the resolved HMAC and maps
fields for you.
→ Proof-of-Work challenge (kubeWAF)
Difficulty cost (order of magnitude)
| Difficulty (zero bits) | Expected SHA-256 tries |
|---|---|
| 12 | ~4k |
| 18 | ~260k |
| 22 | ~4M |
| 26 | ~67M |