Caddy

Place BotStopper between Caddy and your backend. Caddy terminates TLS, then sends requests to BotStopper for filtering:

Loading diagram...

BotStopper forwards accepted requests to the backend and blocks rejected requests.

Registry access

The BotStopper image requires GitHub Container Registry credentials with permission to pull the package. Authenticate before you start Compose:

docker login ghcr.io -u your-username --password-stdin

Supply your access token on standard input. Refer to installation for registry authentication details.

Docker Compose configuration

Create compose.yml with these services:

services:
  caddy:
    image: caddy:2
    ports:
      - 80:80
      - 443:443
      - 443:443/udp
    volumes:
      - ./conf:/etc/caddy
      - caddy_config:/config
      - caddy_data:/data
 
  anubis:
    image: ghcr.io/techarohq/botstopper/anubis:latest
    pull_policy: always
    environment:
      BIND: ":3000"
      TARGET: http://httpdebug:3000
 
  httpdebug:
    image: ghcr.io/xe/x/httpdebug
    pull_policy: always
 
volumes:
  caddy_data:
  caddy_config:

Create conf/Caddyfile:

# conf/Caddyfile
 
yourdomain.example.com {
  tls your@email.address
 
  reverse_proxy http://anubis:3000 {
    header_up X-Real-IP {remote_host}
    header_up X-Http-Version {http.request.proto}
    header_up X-TLS-SNI-Name {tls_server_name}
  }
}

Multiple services

To protect multiple services, run one BotStopper instance for each backend. You can also use two Caddy instances. The first terminates TLS and forwards requests through BotStopper. The second routes accepted requests to the backends.

Refer to Nginx or Apache for similar routing configurations.

For clients behind Cloudflare, use the Cloudflare configuration to preserve the client address.

Next, read configuration and policy definitions.