Blocklists
IP, hostname, and User-Agent deny lists from files. Reloaded on an interval without restart.
What it does
TLS terminates at nginx, Caddy, or Traefik. RavenGuard runs on the private hop and filters what reaches the origin.
Rate limits and size caps
Per-client request limits, concurrency caps, and body/header/URL size limits. Temporary bans after repeated strikes.
Scanner scoring
Scores scanner User-Agents, missing browser headers, probe paths, and short-window path fan-out. High scores challenge or block.
Browser challenge
Optional JavaScript proof-of-work and environment probe. Clearance is an HMAC cookie bound to the client key.
Hashed client IPs
Rate limits, behavior state, and logs use a hashed client key by default.
Q-Feeds
Optional malware IP and domain feeds merge into the same deny path as local blocklists.
Request order
Stages run in fixed order for every request.
Client IP
Resolve from trusted X-Real-IP, X-Forwarded-For, or PROXY protocol.
Deny and throttle
Blocklists, optional feeds, rate limits, size caps, and attack signatures.
Detect
Score the request. Challenge or hard-block before the origin.
Proxy
Forward to HTTP or unix upstreams. Rebuild X-Real-IP and X-Forwarded-For from the resolved client.
Build and run
make build, or docker compose up --build from deploy/. Set upstream.url and RG_CHALLENGE_SECRET before exposing the challenge path.