apache-waf-feeds

April 4, 2026 · View on GitHub

Automatic threat feed updater for apache-waf. Port of nginx-waf-feeds for Apache.

Overview

apache-waf-feeds is a standalone daemon that automatically downloads IP threat feeds and updates apache-waf list files on a configurable schedule.

Features

Multiple feed sources with independent schedules
Cron expression support for scheduling
Content validation before writes
Atomic file writes (no corruption)
Apache graceful reload triggering
Structured logging
Single-run mode for cron integration
Hot config reload via SIGHUP

Quick Start

make build
cp conf/config.example.yaml /etc/apache-waf-feeds/config.yaml
./apache-waf-feeds -config /etc/apache-waf-feeds/config.yaml

apache-waf Ecosystem

apache-waf - Core Apache module (required)
apache-waf-api - REST API for IP list management
apache-waf-ui - Web management interface

nginx Counterpart

nginx-waf-feeds - Original nginx version

License

Apache License 2.0 - see LICENSE.md for details.