A guardian at the gate
An anti-DDoS reverse proxy in Rust. It sits in front of your app, limits each client, learns what normal traffic looks like, and drops floods before they reach the upstream.
Named after the Dvarapala, the guardian statues at Javanese temple gates. 0.x is alpha: keys and metrics may change between minor versions.
What it protects
Every layer is optional and configurable. Defaults are generic; deployment specifics belong in your config.
Rate limit per client
Token bucket per client with a bounded table. X-Forwarded-For is trusted only from the proxies you list.
Adaptive detection
Heavy hitters, a learned rate baseline and source entropy, plus an optional tree model. Start in observe, switch to enforce.
TLS
rustls listener with ALPN, certificate reload on SIGHUP, bounded handshakes and https:// upstreams.
HTTP/2 and gRPC
h2c or ALPN to the upstream, trailers passed through, gRPC-shaped local errors, limits against rapid reset and header floods.
WebSocket
Upgrades are rate limited like any request. Tunnel count, idle and lifetime limits bound what each admitted client holds.
Prometheus metrics
Verdicts, detection state, tunnels and HTTP/2 limits on a separate listener, so you can watch before you enforce.
How it works
One engine decides a verdict for each request. The proxy only carries it out.
- Identify the client: peer address, or
X-Forwarded-Forfrom a trusted proxy. - Limit it: a token bucket per client answers
429when empty. - Detect floods: per-window counts against a learned baseline mark anomalies.
- Forward what passes, over HTTP/1.1, HTTP/2 or a WebSocket tunnel.
- Report every verdict as a metric and a structured log line.
dvarapala.toml
# the smallest useful config listen = "0.0.0.0:8080" upstream = "http://127.0.0.1:8081" [rate_limit] rate = 20 # tokens per second per client burst = 40 [detection] mode = "observe" # log only; "enforce" later [metrics] listen = "127.0.0.1:9090"
More in Examples: TLS, gRPC and WebSocket.
Install
Binaries for Linux (musl, static) and macOS, x86_64 and aarch64, with SHA256SUMS.
From a release
# download your platform's tarball and SHA256SUMS
shasum -a 256 -c SHA256SUMS --ignore-missing
tar xzf dvarapala-v*-x86_64-unknown-linux-musl.tar.gz
./dvarapala serve --config dvarapala.toml
From source
git clone https://github.com/franzramadhan/dvarapala cd dvarapala cargo build --release ./target/release/dvarapala serve \ --config examples/dvarapala.toml
Environment variables override the file: DVARAPALA__RATE_LIMIT__RATE=5.