FAQ

Deployment

What deployment options does vigie-waf support?

You can run the pre-built binary on Windows or Linux, or use Docker. Docker is the recommended path. See Getting Started.

Does it support OTA upgrades?

Yes. Use the upgrade page in the admin panel.

Note: when deploying with Docker, you must mount the host directory into the container for OTA to work. Running the binary embedded in the image will not support OTA.

What is the default admin account?

Default is admin / admin123, configured via the ADMIN_USERNAME, ADMIN_PASSWORD, and JWT_SECRET environment variables. Always change these defaults in production.

Defense

How do I configure CC defense?

In Site Settings → CC Defense, set the per-IP time window and request limit. Requests exceeding the threshold are rejected.

How do I add IPs to the blacklist / whitelist?

Under "Defense Strategy" in the left sidebar, open IP Blacklist or IP Whitelist. You can add individual IPs or CIDR ranges, with optional expiration. Omit expiration for permanent entries.

Proof-of-Work: first-time visitors are redirected to a lightweight loading page where the browser solves a small JS challenge before reaching the upstream server. This mitigates most bots and some DDoS traffic.

How do I write custom defense logic?

Use Lua scripts. Under "Defense Strategy → Defense Rules" you can reorder or edit the built-in scripts, or add your own. See Lua Scripts.

How does it detect forged search-engine crawlers?

Enable "Crawler Management". Requests that declare a crawler User-Agent are verified via reverse DNS. Forged crawlers are rejected and their IPs are blacklisted for 30 minutes.

HTTPS / Certificates

Does it support automatic certificate renewal?

Strongly recommended. Enable it in Site Settings → HTTPS.

Any caveats when deploying behind nginx?

You must configure "Trusted IP Sources". Otherwise client_ip will resolve to the upstream nginx IP and break IP-based defenses.

FAQ