Overview
Sibuna is a web protection tool that makes clients complete computational proof of work before receiving access. It can forward requests directly to an application or operate alongside an existing proxy such as Caddy, nginx, or Traefik.
Proof of work raises the cost of automated requests without claiming to prove that a visitor is human or stop every attack. After admission, signed sessions let clients return without solving a new puzzle for every request.
Key Features
- Offers configurable Hashcash or sequential browser challenges through WebAssembly.
- Applies allow, challenge, or deny policies based on address, path, headers, and User-Agent.
- Inspects applications for SQL injection, cross-site scripting, and path traversal attempts.
- Supports optional OWASP Core Rule Set updates with audit, enforcement, private testing, and rollback modes.
- Controls burst and sustained traffic with local rate limits, including optional per-rule limits.
- Provides an optional console for traffic, sampled country activity, incidents, and policy editing.
Deployment
The engine, embedded storage, browser solver, and console assets are packaged as one executable. Native packages cover Linux, macOS, Windows, FreeBSD, and OpenBSD, with platform requirements varying by release.
Linux packages include an optional system service that is disabled by default, while BSD packages do not create a service, account, or state. A separate source build adds cluster support by replicating policy and reputation data.
Operational Considerations
Operators can combine proof-of-work admission with access rules and local rate limits to constrain admitted clients. Because computation consumes energy and performance depends on hardware and settings, challenge configuration should reflect the protected application's traffic and resource profile. Release archives include checksums, licenses, source references, and build manifests for verification.