NK's own Rust 80/443 gateway, included Personal+. Faster than nginx mode, built-in WAF + JA3 + GeoIP + cache + sub_filter.
Site config: microservice-site/upsert
- cache_enabled / cache_ttl_secs / cache_max_file_bytes / cache_path_rules JSON
- stale_while_error / permanent_fallback (serve cache when backend down)
- sub_filters JSON [(search, replace)] response rewrite
- waf_enabled — master switch, 1 = WAF on / 0 = entire site bypass
- waf_extra_rule_set_ids array, stack user/system rule_sets
- ja3_blocklist_ids / ip_rule_set_ids / geoip_rule_set_ids arrays
Disable WAF for WordPress install
WP install.php / Discuz install always trip CRS rules. Workflow: get site → upsert waf_enabled=0 → install → upsert waf_enabled=1 after. See WAF.