kubeWAF is under active development — feedback and stars on GitHub are very welcome!
kubeWAFkubeWAF
kubeWAFmodsecurity-proxy-wasmpow-proxy-wasm

Standalone Envoy

Build pow-proxy-wasm and run the docker-compose example

Build

Requires Go 1.23+ (module may pin a newer toolchain).

cd pow-proxy-wasm
make build          # → build/main.wasm
TargetOutput
make buildbuild/main.wasm
make oci / oci-buildOCI image / tarball
make publishPush image (IMAGE=...)

Local verification

make build
cd example/envoy
docker compose down -v && docker compose up

Open http://localhost:8080:

  1. First visit → verification page (auto-solves).
  2. Reload → backend; DevTools shows challenge-clearance.
  3. Later visits pass until clearance expires (~30 minutes).

The example envoy.yaml includes a required plugin configuration with a dev-only secret (≥ 32 bytes). Without config the plugin does not start.

See the standalone Envoy example.

Module layout

pow-proxy-wasm/
├── main.go           # Proxy-WASM lifecycle, cookies, IP, difficulty tick
├── crypt.go          # Challenge / clearance generate + verify, timers
├── crypt_test.go
├── challenge.html    # Embedded solver UI
├── Makefile
├── Dockerfile
├── example/envoy/    # docker compose smoke test
└── README.md

On this page