The number of attacks my servers get has increased by 3x since May of this year. Now personally, I don't like hiding behind Cloudflare because I don't want them to be a SPOF, but it was becoming a bit too scary to just be open to the web. Because it is a family cloud, it can't hide behind a VPN, it has to support devices like TV sticks that can't connect properly over VPN. It has to support HTTPS.

So I put together a Rust/Ratatui TUI+cron/CLI that manages my second line of defense: firewall and HTTP server. I run a reverse Nginx proxy in front of apps like Nextcloud, and a nftables firewall with SSH as my admin tunnel. It does several things:

1) It allows me to block entire segments, countries, datacenter IP ranges, TOR exit nodes etc...

2) It allows me to block specific bots: search bots, AI bots, security scanners

3) It does dynamic blocking too, looking at the logs to spot bad behavior and block it. I used to run fail2ban for SSH for example, but a centralized UI for both SSH and HTTP(S) is nicer IMHO.

So if this is useful to anyone else, feel free. It's AGPL v3.

In my experience, geoblocking is the biggest win, reducing the attacks by 30x.

AI Disclosure: I use AI assisted development. I follow Linus Torvalds and Bob Martin model, with using AI as a tool and verifying the result.