Rebuilding the public reverse proxy and WAF
Rebuilt the public reverse proxy, hardened it with ModSecurity (OWASP CRS) and Fail2Ban, put every config change under Git, and surfaced block events in Grafana.
My scope
Architecture, configuration, scripting and ongoing operations.
Approach
- Nginx with ModSecurity (OWASP CRS) and Fail2Ban; config managed with GitOps so every change is traceable.
- Automation: first crontab plus Ansible playbooks for OS and certificate updates; since H2 2025, AWX schedules them centrally.
- Logs flow through Fluent Bit to OpenSearch and surface in Grafana.
Verification
Per-site CORS, TLS and page regression checks; every TLS configuration change is verified with ECDHE/TLS 1.3 handshakes and page regressions.
Results
| Metric | Value | Source | Evidence |
|---|---|---|---|
| My commits to the config repo | 1,425 | GitLab (latest 1,500 commits) | System record |
| Config change rollout | under 1 minute | Own estimate | Own estimate |
| Related hours | 939 h | Timesheets since Oct 2022 | System record |
| Logged hours split: me / AI execution | me ≈843 h, AI execution ≈96 h (hours before 2025-02-22 count as mine) | Own estimate; hours since 2025-02-22 split by the period’s ratio; company-logged hours only | Own estimate |
Limits and next steps
WAF block volume is not quantified here.
Tools
- Nginx
- ModSecurity
- Fail2Ban
- Ansible
- AWX
- Fluent Bit
- OpenSearch
- Grafana