Sentry

Sentry is a real-time access monitor and inline edge WAF for services exposed to the internet. In passive mode it watches nginx (access logs), syslog, the Cloudflare Logs API and TCP capture; in inline mode it becomes the reverse proxy in front of the application (HTTP 80/443 with TLS, HTTP/2, PoW challenge and body inspection). It uses rules + heuristics + AI to detect malicious payloads, suspicious behavior and invalid routes, computes a risk level per request/IP and acts: block, challenge, rate-limit, kernel bans, webhooks.

Key features

• Inline WAF: an axum reverse proxy that rules before proxying (Block→403, RateLimit→429, Challenge→PoW page), with a per-IP block fast-path and a block table shared across nodes.
• TLS 443 + JA3/JA4: HTTPS termination, ClientHello telemetry (JA3/JA4 fingerprint, SNI, ALPN) and HTTP/2 via ALPN.
• Multi-source: plugins for nginx, syslog (RFC 5424/3164), Cloudflare Logs, TCP capture with scanner fingerprinting, and non-HTTP protocols via YAML schemas (sentry-protocol).
• Layered detection: deterministic rules engine (DSL + packs) → URL-decoding heuristics → local ONNX AI → optional LLM (OpenRouter/Ollama), with repeat-offender escalation and cross-IP scan→attack correlation.
• Action at every layer: Cloudflare (block/challenge/rate-limit, IPv6 /64), kernel bans (nftables/ipset/firewalld), OPNsense/pfSense, nginx deny + challenge, signed webhooks, community reporting (AbuseIPDB).
• Operable: web dashboard with Argon2id auth + RBAC, ratatui TUI, Prometheus metrics + Grafana, SIEM export (CEF/LEEF/syslog), OS service mode.
• Exposure hardening: [real_ip] with trusted proxies, rDNS bot verification, DB-backed datasets with hot-reload, header posture (advisory).
• Fast: ~4.36 µs/event pipeline (~800× faster than v1), two action lanes and tiered degradation under overload — detection and containment never degrade.

Documentation

• Overview — goals, non-goals, stack and status (F0–F12 concluded).
• Quickstart — Docker, local build, basic configuration.
• Architecture — pipeline, data model, request flow.
• Rules Engine — deterministic rules, DSL, packs, datasets.
• Plugins — Source and Action traits, challenge providers.
• AI — heuristics, local ONNX, optional LLM.
• CLI & TUI — command reference and interactive interface.
• Configuration — sentry.toml reference.
• Reference — crates, modules and types with source links.
• Examples — example configs by scenario.
• Deploy — Docker e Kubernetes.