Corvus (reverse proxy with built-in WAF and auto-bans) is now in the Community train

Apps and Virtualization
,
1

Hi all. I’m the author of Corvus, and it was just merged into the Community train, so I wanted to share it here and get feedback from TrueNAS users.

What it is
A reverse proxy in the spirit of Nginx Proxy Manager, with the protection layer in the same console:

  • Proxy hosts, Let’s Encrypt with auto-renewal (including DNS challenge for wildcards), redirections, TCP/UDP streams
  • Known attack patterns (SQL injection, path traversal, scanners…) blocked as soon as you add a host, plus automatic bans for IPs that keep trying
  • Security rules on IP, country, path, header and User-Agent, a browser challenge and an access queue (waiting room)
  • Live traffic monitor, alerts to Slack/Discord/Teams/Telegram and others
  • Can import an existing NPM setup

Apache-2.0, no paid tier.

Installing on TrueNAS

  1. Apps → Discover Apps → search “Corvus” → Install.
  2. Default ports: admin console 30553, HTTP 30554, HTTPS 30555 (the TrueNAS UI already uses 80/443). To serve sites from the internet, forward ports 80/443 on your router to 30554/30555.
  3. There is no default password. Open https://<truenas-ip>:30553 (self-signed certificate, so expect a browser warning). Enter the one-time setup token, which you’ll find under Apps → corvus → Logs, on the line with setup_token. Then create the admin account.
    From 1.1.1 you can choose the token yourself instead: add CORVUS_SETUP_TOKEN (12+ characters) under Additional Environment Variables.

It runs as the apps user (568) with all capabilities dropped, and keeps its data in one dataset.

Feedback welcome
It’s young (1.1.x), and this is the first time it’s packaged for TrueNAS. Anything that was confusing during install (ports, storage, permissions) or that you’d expect from a proxy app here would help a lot. Questions are welcome in this thread.

GitHub: GitHub - corvus-gateway/corvus: Corvus AWPG — self-hosted Active Web Protection Gateway: reverse proxy, free SSL, attack blocking, live monitoring and an access queue · GitHub

2

Good to see an alternative to NPM/NPM+. And maybe, just maybe, we’ll have fewer cases of people calling that just “Nginx,” though I’m not really holding my breath there.

A pretty common problem we’d see with NPM on the Let’s Encrypt forum was that its logging was very poor when it came to cert issues, to the point that we just weren’t able to troubleshoot them there. How’s your logging in this regard?

3

Thanks!
Cert logging was one of the things I specifically wanted to get right. When an issuance or renewal fails, Corvus keeps Let’s Encrypt’s full error response for that certificate (the ACME problem type and detail, e.g. which domain failed validation and what the CA got back). It shows up in three places: on the certificate in the console, in the container log, and optionally as an alert (email, webhook, etc.). There’s also a staging toggle per certificate so people can retry without burning rate limits.
One gap I found while checking this for you: if a renewal fails while the current cert is still valid, the error is logged and alerted, but the console list still just shows “valid”. I’ll fix that so it’s visible there too. Thanks for the nudge.