synapse-waf 0.9.1

High-performance WAF and reverse proxy with embedded intelligence — built on Cloudflare Pingora
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

# Synapse WAF Demo Configuration
server:
  listen: "127.0.0.1:6190"
  admin_listen: "127.0.0.1:6191"
  workers: 0
  waf_threshold: 1
  waf_enabled: true
  # Trust localhost for X-Forwarded-For/X-Real-IP spoofing in demos
  trusted_proxies:
    - "127.0.0.1/32"

upstreams:
  - host: "127.0.0.1"
    port: 5555  # CHIMERA_API_PORT - Flask API from demo-targets

rate_limit:
  rps: 10000
  enabled: true

logging:
  level: "info"
  format: "text"
  access_log: true

detection:
  sqli: true
  xss: true
  path_traversal: true
  command_injection: true
  action: "block"
  block_status: 403

tls:
  enabled: false
  cert_path: "certs/server.crt"
  key_path: "certs/server.key"
  min_version: "1.3"

telemetry:
  enabled: true
  endpoint: "http://localhost:3100/telemetry"
  api_key: null
  batch_size: 100
  flush_interval:
    secs: 10
    nanos: 0
  max_retries: 3
  initial_backoff:
    secs: 0
    nanos: 100000000
  max_backoff:
    secs: 30
    nanos: 0
  max_buffer_size: 10000
  circuit_breaker_threshold: 5
  circuit_breaker_timeout:
    secs: 60
    nanos: 0
  enabled_events: []
  instance_id: "synapse-waf-1"

tarpit:
  enabled: true
  base_delay_ms: 100
  max_delay_ms: 2000
  progressive_multiplier: 1.5
  max_states: 10000
  decay_threshold_ms: 300000
  cleanup_threshold_ms: 1800000

dlp:
  enabled: true
  max_scan_size: 5242880
  max_matches: 100
  scan_text_only: true
  max_body_inspection_bytes: 8192
  fast_mode: false

crawler:
  enabled: false
  dns_cache_ttl_secs: 300
  verification_cache_ttl_secs: 3600
  max_cache_entries: 50000
  dns_timeout_ms: 2000
  max_concurrent_dns_lookups: 100
  verify_legitimate_crawlers: false
  block_bad_bots: false
  dns_failure_policy: "apply_risk_penalty"
  dns_failure_risk_penalty: 50
  max_stats_entries: 1000