Aegis v1.0.0 — first public release

First public release. Aegis was developed privately through an internal
V97 → V245 revision series; this is that work, cleaned up and opened.

Aegis terminates inbound HTTP/HTTPS traffic, runs it through a multi-stage
protection pipeline and forwards only what survives — replacing the usual
"nginx + ModSecurity + commercial bot vendor" stack with one self-hosted
binary. No traffic leaves your perimeter, no per-request pricing, no third
party terminating your TLS.

Install

curl -fsSL https://raw.githubusercontent.com/tnAnGel/Aegis/main/install.sh | sudo bash

Builds the binaries and the admin UI, generates config and certificates,
installs a systemd worker set (one CPU-pinned worker per core), seeds the
GeoIP database and reputation feeds, and prints your panel credentials.
Idempotent — re-run it to upgrade. Then open http://<host>:6280/admin/ui.

What is in it

Data plane — production plane on Cloudflare Pingora as an SO_REUSEPORT
worker set; HTTP/1.1, HTTP/2 with frame-abuse limits, HTTP/3 (QUIC);
eBPF/XDP kernel fast path with deny/allow maps and per-IP packet and SYN
budgets; threat-aware response cache.

Protection — WAF with Aho-Corasick signatures, semantic SQLi analysis,
multi-pass normalisation including Unicode confusable folding, gzip request-body
decompression before inspection, and 569 rules converted from the SigmaHQ
corpus; full JA4 family plus JA3, GREASE-anomaly detection, JA4 churn scoring;
challenge ladder cookie → JS → SHA-256 PoW → Argon2id → CAPTCHA with Privacy
Pass over Ed25519; rate limiting with per-IP and per-URI buckets and IPv6
aggregated to /64; deception layer with honeypot packs, YAML state-machine
honeypots, LLM honeypot, Markov tarpit and decoy CDN headers; IP/ASN
reputation, threat-intel feeds, CrowdSec, GeoIP and an ML risk engine;
actuators with revert TTLs — XDP deny, nftables drop, BGP RTBH announce.

Operations — React admin panel with 35+ pages in English and Russian;
REST admin API with role-based tokens and audit logging; built-in benchmark
suite; Prometheus metrics, request log, per-domain policy, live config reload.

Benchmarks

Debian 12 VM, 16 vCPU / 16 GB (aarch64), 8 CPU-pinned workers. Every proxy runs
as an ephemeral reverse proxy in front of the same upstream, driven by the same
load generator, on the same host. Produced by the benchmark page built into the
admin panel — reproducible on your own hardware in one click.

Proxy	WAF	Throughput	p99
Aegis (raw proxy)	—	217 681 rps	0.80 ms
Aegis + WAF	✅	134 997 rps	1.55 ms
HAProxy 2.6.12	—	116 594 rps	1.30 ms
Caddy 2.6.2	—	83 705 rps	15.70 ms
nginx 1.22.1	—	42 667 rps	1.20 ms
Envoy	—	39 550 rps	4.05 ms
nginx + ModSecurity + OWASP CRS	✅	2 203 rps	25.05 ms

Against the only other lane that actually inspects requests, Aegis serves 61×
more traffic — and with its full WAF on it is still faster than every proxy
here running with no protection at all. Inspection costs Aegis ~38% of raw
forwarding throughput; ModSecurity + CRS costs nginx ~95% of its own.

Security coverage on the same run: Aegis blocked 10/10 attack classes
(SQLi, XSS, traversal, command injection, PHP webshell, webshell drop,
Log4Shell, LFI, SSRF, XXE), nginx+ModSec+CRS 9/10, every plain forwarder 0/10.

As a plain forwarder a tuned nginx is faster than Aegis — roughly 590k vs 513k
rps on a CPU-isolated stand. Aegis wins with inspection on, and in cache mode.

Requirements

Linux (Debian 12 / Ubuntu 22.04+ primary target), 2 cores and 1 GB minimum,
8 cores and 8 GB recommended. The eBPF/XDP fast path needs kernel 5.10+ with
CAP_BPF, CAP_NET_ADMIN and CAP_PERFMON. Building from source needs Rust 1.85+,
Node 20+ and pnpm 10+ — the installer handles all of it.

Documentation

English, Russian and Chinese under docs/.
Start with the overview,
installation
and configuration.

Before you deploy this

Read the security model.
It documents the trust boundaries, a hardening checklist and the known
limitations honestly — including the ones not closed yet. The single most
important item: do not expose the admin port (:6280) to the internet.

Found a vulnerability? Report it privately — see
SECURITY.md.

Licence

AGPL-3.0-or-later. Free to run, study, modify and redistribute; if you offer a
modified version over a network you must offer its source too. A commercial
licence is available if that does not fit your deployment.