HAProxy configuration and lua scripts implementing a challenge-response page where visitors solve a captcha and/or proof-of-work (cpu intensive) task. Intended to stop bots, spam, ddos, etc.
Go to file
2024-06-11 15:23:33 +10:00
haproxy Bump haproxy to 3.0 in docker build 2024-06-11 15:23:33 +10:00
nginx Fully convert to data plane api 2023-02-18 15:14:40 +11:00
src Browser compatibility improvements. Tweak arguments of translate function, and try/catch navigator.hardwareconcurency 2024-01-20 20:32:29 +11:00
tor close #4 2021-11-26 00:27:47 +11:00
.gitignore Don't check for wasm support when using sha256 challenge type 2023-07-19 20:55:48 +10:00
docker-compose.yml Add ACL so alt-svc header is only sent when geo continent not matching server env 2024-01-28 17:44:07 +11:00
INSTALLATION.md update config for crawler-whitelist, cleanup a few things in the example 2023-06-04 13:04:13 +10:00
LICENSE-GPL-3.0.txt GPL-3.0 from now on 2023-04-13 20:41:28 +10:00
LICENSE.txt GPL-3.0 from now on 2023-04-13 20:41:28 +10:00
README.md ditto of jschan repo change 2024-06-07 16:23:40 +10:00

haproxy-protection

HAProxy configuration and lua scripts allowing a challenge-response page where users solve a captcha and/or proof-of-work. Intended to stop bots, spam, ddos.

Integrates with https://gitgud.io/fatchan/haproxy-panel-next to add/remove/edit domains, protection rules, blocked ips, backend server IPs, etc during runtime.

Originally inspired by a proof of concept from https://github.com/mora9715/haproxy_ddos_protector.

Features / improvements in this fork:

  • Implement a proof-of-work mode, in addition to the existing captcha only mode.
  • Ability to choose between argon2 or sha256 proof of work modes.
  • Sharing POW answers with storage events to prevent unnecessary re-solving when opening multiple tabs.
  • Supports either hcaptcha or recaptcha.
  • Support .onion/tor with the HAProxy PROXY protocol, using circuit identifiers as a substitute for IPs.
  • Allow users without javascript to solve the POW by providing a shell script and html form inside noscript tags.
  • Use HAProxy http-request return directive to directly serve files from the edge without a separate backend.
  • Adjustable cookie validity lifetime.
  • Adjustable "mode" ("none", "pow" or "pow+captcha") per domain or domain+path
  • Improved the appearance of the challenge page.
  • Add several useful maps & acls to the haproxy config:
    • Whitelist or blacklist IPs/subnets.
    • Rerwite/redirect specific paths or whole domains.
    • Maintenance mode page for selected domains.
  • Geoip mapping support for alt-svc headers.
  • Support simple load balancing to multiple backends per domain dynamically.
  • Multiple language support with locales files (currently en-US and pt-PT).
  • Fix multiple security issues.
  • Many bugfixes.

Installation

See INSTALLATION.md

For generous people

Bitcoin (BTC): bc1q4elrlz5puak4m9xy3hfvmpempnpqpu95v8s9m6

Monero (XMR): 89J9DXPLUBr5HjNDNZTEo4WYMFTouSsGjUjBnUCCUxJGUirthnii4naZ8JafdnmhPe4NP1nkWsgcK82Uga7X515nNR1isuh