Skip to content
@myguard-labs

MyGuard Labs

Security-focused nginx modules, mail-filtering tooling, and hardening plugins. Home of the packages published at deb.myguard.nl.
README.md

myguard labs

Security-focused infrastructure software: hardened nginx/Angie modules, a mail-filtering stack in Go, and OWASP CRS hardening plugins — everything packaged and served as ready-to-install Debian/Ubuntu packages at deb.myguard.nl.

Package repository — deb.myguard.nl

Our APT repository ships nginx and Angie builds with HTTP/3, compile-time hardening, and a large set of dynamic modules, plus supporting packages (rspamd, dovecot, clamav, libmodsecurity, lua-resty, and more) for Debian and Ubuntu on amd64 + arm64. Install instructions, the full package index, and in-depth articles live on the site. Full directive reference for every module: modules synopsis. Bugs and requests go to the deb.myguard.nl issue tracker.

nginx / Angie modules

Dynamic modules, all shipped pre-built in the APT repo:

  • nginx-cache-turbo-module — edge page cache: shared-memory cache, stale-while-revalidate, probabilistic single-flight refresh
  • nginx-strip-filter-module — smart HTML/CSS/JS/JSON response-body minifier
  • nginx-error-abuse-module — rate-limits clients that hammer your site with 404s
  • nginx-autocert-module — automatic certificates via the ACME protocol
  • nginx-zstd-module — Zstandard compression, fixed and maintained
  • nginx-http-shield-module — upcoming: legacy-exploit floor, ~400 compiled-in signatures (Log4Shell, Shellshock, SQLi, traversal, RCE chains, SSRF) in one Aho-Corasick pass, ~1 µs/request. Not a WAF — ModSecurity/Coraza + CRS stay the front line; this is the last line of defense for hosters who don't control what their customers install
  • nginx-http-sentinel-module — experimental: client reputation + JA4+ fingerprinting + AI-scraper tarpit
  • nginx-test-harness — how we test the modules above: functional + leak testing in C (fd/cycle-pool deltas, fault injection), runs the same rule files on nginx and Angie (guide)

Mail security stack

Out-of-process attachment analysis and hash-clearinghouse clients, built for busy rspamd/SpamAssassin pipelines:

  • mailstrix — the owl that finds malware hiding in your mail: recursively unwraps OLE2/OOXML, VBA, RTF, PDF, and nested archives until YARA rules can see the dangerous bits
  • gozer — standalone Go binary bundling DCC/Razor/Pyzor with an HTTP backend
  • gazor / gyzor / gdcc — pure-Go clients for Razor 2, Pyzor, and DCC — each a library, CLI, and daemon
  • rspamd-dcc-razor-pyzor — rspamd plugin + Docker image wiring the Go clients in, with optional Redis caching
  • rspamd-olefy — front-end wrapping oletools VBA-macro scanning for rspamd
  • rspamd-kam-rules — SpamAssassin KAM rules transpiled to rspamd

OWASP CRS / ModSecurity plugins

False-positive exclusions plus opt-in positive-security allowlists for apps behind OWASP CRS 4.x:

Also here

  • ViMbAdmin — modernised 2026 fork of the virtual mailbox admin panel
  • dockerized — the Docker stacks we run in production; images on Docker Hub
  • build_psol — build scripts for the PageSpeed Optimization Library (PSOL) (archived)

Links

Popular repositories Loading

  1. nginx-zstd-module nginx-zstd-module Public

    Forked from tokers/zstd-nginx-module

    ZTSD Compression for NGINX/Angie, fixed and tested

    C 40 4

  2. dockerized dockerized Public

    dockerized stuff

    Shell 18 8

  3. wordpress-hardening-plugin wordpress-hardening-plugin Public

    Plugin for Owasp CRS4.0+ (modsecurity) to harden wordpress

    Python 14 2

  4. deb.myguard.nl deb.myguard.nl Public

    issue tracker for deb.myguard.nl packages

    10

  5. ViMbAdmin ViMbAdmin Public

    modernised fork of vimbadmin (2026)

    PHP 7

  6. nginx-error-abuse-module nginx-error-abuse-module Public

    NGINX module that ratelimits error (404) abusers

    C 7 1

Repositories

Showing 10 of 26 repositories
  • ViMbAdmin Public

    modernised fork of vimbadmin (2026)

    myguard-labs/ViMbAdmin's past year of commit activity
    PHP 7 GPL-3.0 0 0 2 Updated Oct 31, 2026
  • mailstrix Public

    Mailstrix is the owl that finds malware hiding in your mail. It takes hostile attachments apart — unwrapping OLE2/OOXML, VBA, RTF objects, PDFs, archives and nested carriers — until YARA detection rules can finally see the dangerous bits. It runs out-of-process behind Rspamd (async HTTP), SpamAssassin, an ICAP server, Dovecot Sieve, or standalone

    myguard-labs/mailstrix's past year of commit activity
    Go 5 MIT 0 0 0 Updated Oct 30, 2026
  • rspamd-kam-rules Public

    Transpile SpamAssassin KAM rules to RSPAMD

    myguard-labs/rspamd-kam-rules's past year of commit activity
    Python 2 0 0 0 Updated Oct 31, 2026
  • vaultwarden-crs-plugin Public

    OWASP CRS plugin for Vaultwarden (Bitwarden): FP exclusions + opt-in path allowlist. JSON-API aware (no arg-name allowlist).

    myguard-labs/vaultwarden-crs-plugin's past year of commit activity
    Go 4 Apache-2.0 0 0 1 Updated Oct 30, 2026
  • dockerized Public

    dockerized stuff

    myguard-labs/dockerized's past year of commit activity
    Shell 18 8 0 3 Updated Oct 30, 2026
  • nginx-strip-filter-module Public

    nginx dynamic module: smart HTML/CSS/JS/JSON response-body minifier

    myguard-labs/nginx-strip-filter-module's past year of commit activity
    C 0 BSD-2-Clause 0 0 10 Updated Oct 26, 2026
  • nginx-skeleton-module Public template

    nginx / angie dynamic-module skeleton (BSD-2-Clause template)

    myguard-labs/nginx-skeleton-module's past year of commit activity
    Shell 0 BSD-2-Clause 0 0 10 Updated Oct 26, 2026
  • nginx-zstd-module Public Forked from tokers/zstd-nginx-module

    ZTSD Compression for NGINX/Angie, fixed and tested

    myguard-labs/nginx-zstd-module's past year of commit activity
    C 40 BSD-2-Clause 39 1 4 Updated Oct 26, 2026
  • nginx-http-shield-module Public

    nginx module blocking exploitation of long-patched web vulns (SQLi, Log4Shell, Shellshock, traversal, RCE chains). Not a WAF -- a near-zero-FP legacy-exploit floor.

    myguard-labs/nginx-http-shield-module's past year of commit activity
    C 4 BSD-2-Clause 1 1 4 Updated Oct 26, 2026
  • nginx-autocert-module Public

    nginx module to automate certificates through the ACME protocol, with dual-certifate, wildcard and ip-cert support

    myguard-labs/nginx-autocert-module's past year of commit activity
    C 7 BSD-2-Clause 0 1 13 Updated Oct 26, 2026
View all repositories