BunkerWeb
Open source maintenance / 2021-present
A cloud-native web application firewall (WAF) built on NGINX, with a web interface, API, and plugin system.
The problem
A web application firewall can become another specialist system to configure and operate. BunkerWeb has to expose strong protection without forcing every team to become an NGINX or security expert first.
Decisions
Start from secure defaults and make configuration explicit.
CostA stricter first run, and more questions to answer in public whenever a safe default blocks something a team expected to work.
Support the environments teams already use, from Linux packages to Kubernetes.
CostEvery release has to stay correct across four install surfaces, and their documentation can drift apart.
Treat the web interface, API, documentation, releases, and plugin surface as one product.
CostA change is only finished when all five surfaces agree, so fewer changes land per release.
Keep public support discussions detailed enough to help the next operator too.
CostAnswering costs more than closing, and that time comes out of the same week as the code.
Outcome
The public project combines NGINX, security rules, automation, and an operator-facing interface in one deployable WAF.
Evidence and scope
Looking for a collaborator?
Share the work and its constraints. I reply by email.