SWAG (Secure Web Application Gateway)
A Docker container providing a secure Nginx web server and reverse proxy with automated SSL certificates and fail2ban protection.
What is SWAG (Secure Web Application Gateway)?
SWAG is a Docker container that bundles Nginx, PHP, Certbot, and fail2ban into a single image to serve as a secure web application gateway. It automates the setup of HTTPS with free SSL certificates, acts as a reverse proxy for routing traffic to backend services, and provides intrusion prevention to protect web applications. The project solves the complexity of manually configuring and maintaining a secure web server stack.
System administrators, DevOps engineers, and self-hosting enthusiasts who need a pre-configured, secure web server and reverse proxy for deploying web applications, especially in containerized environments.
Developers choose SWAG because it combines multiple essential tools (Nginx, Certbot, fail2ban) into one easy-to-deploy Docker container, drastically reducing setup time and configuration errors. Its included reverse proxy configurations and automated certificate renewal make it a turnkey solution for securing web services.
Overview
Nginx webserver and reverse proxy with php support and a built-in Certbot (Let's Encrypt) client. It also contains fail2ban for intrusion prevention.
Use Cases
Best For
- Self-hosting multiple web applications behind a single reverse proxy with HTTPS
- Automating SSL certificate issuance and renewal for personal projects or internal services
- Securing web servers with fail2ban to block brute-force attacks and malicious traffic
- Deploying a pre-configured Nginx and PHP stack for development or production environments
- Routing traffic to backend containers or services using pre-built reverse proxy configurations
- Setting up a secure gateway for home lab services with minimal manual configuration
Not Ideal For
- Enterprises requiring custom Nginx optimizations for high-traffic load balancing beyond pre-built configs
- Teams using Kubernetes who prefer native Ingress controllers over a Docker-based reverse proxy
- Projects needing real-time, dynamic configuration changes without container restarts, as SWAG's auto-reload is optional and filesystem-dependent
Pros & Cons
Pros
Integrates Certbot to automatically obtain and renew free SSL certificates from Let's Encrypt or ZeroSSL, supporting both HTTP and DNS validation methods, with nightly renewal checks as per the setup instructions.
Includes a collection of pre-configured reverse proxy configurations for popular applications in /config/nginx/proxy_confs, drastically reducing setup time for routing traffic to backend services.
Comes with fail2ban pre-configured with multiple jails like nginx-http-auth to block malicious IPs, and ships with strong Diffie-Hellman parameters (ffdhe4096) and security headers for enhanced protection.
Provides PHP-FPM for running PHP-based web applications and optional QUIC/HTTP/3 support, configurable by exposing UDP port 443 and editing configuration files for improved performance.
Cons
Config updates noted in the changelog are not automatically applied; users must manually update files or delete and regenerate them, which can lead to errors or missed security patches.
DNS-based certificate validation requires setting up credentials in specific files under /config/dns-conf, with varying processes per provider like Cloudflare or DuckDNS, increasing setup complexity and potential for misconfiguration.
Running the container in read-only mode disables fail2ban as it needs to modify iptables, limiting intrusion prevention features in security-restricted environments, as noted in the caveats section.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.