How to Add WAF Protection to Nginx

This approach puts Caddy+Coraza in front of your existing Nginx. The architecture looks like this:

Client -> Caddy + Coraza WAF (:443) -> Nginx (:80) -> Your App

Your Nginx config stays exactly as it is. You add a Caddy container that inspects all traffic before forwarding clean requests to Nginx. Malicious requests are blocked before reaching your server.

See our dedicated step-by-step guide: How to Protect Nginx with Coraza WAF Using Docker. That guide walks through every file, build step, and test in detail.

When to choose this: you have a working Nginx setup, you do not want to change it, and you just want to add WAF protection on top.

Instead of running two containers, you can replace Nginx entirely. Caddy handles static files, reverse proxying, TLS, headers, and compression, just like Nginx. With the Coraza plugin, it also provides WAF protection.

The result: one container, one config file, web server + WAF + automatic HTTPS.

When to choose this: you are starting fresh, you want a simpler stack, or your Nginx config is straightforward enough to translate to Caddy.

Both options use the same Docker image. Create a Dockerfile:

FROM caddy:2-builder AS builder
RUN xcaddy build \ --with github.com/corazawaf/coraza-caddy/v2
FROM caddy:2
COPY --from=builder /usr/bin/caddy /usr/bin/caddy

Build it:

docker build -t caddy-coraza .

Here is how common Nginx directives map to Caddy. Use this table to convert your config:

Static Files and Basics

# Nginx                          -> Caddy root /var/www/html;              -> root * /srv index index.html;                -> (automatic with file_server) try_files $uri $uri/ =404;       -> file_server try_files $uri /index.html;      -> try_files {path} /index.html gzip on;                         -> encode gzip listen 443 ssl;                  -> (automatic with domain name)

Reverse Proxy

# Nginx                          -> Caddy proxy_pass http://app:3000;      -> reverse_proxy app:3000 proxy_set_header Host $host;     -> (automatic) proxy_set_header X-Real-IP ...;  -> (automatic) proxy_read_timeout 60s;          -> reverse_proxy app:3000 { read_timeout 60s } proxy_buffering off;             -> reverse_proxy app:3000 { flush_interval -1 }

Headers and Security

# Nginx                          -> Caddy add_header X-Frame-Options ...;  -> header X-Frame-Options DENY add_header X-Content-Type ...;   -> header X-Content-Type-Options nosniff server_tokens off;               -> (off by default in Caddy)

Redirects and Rewrites

# Nginx                          -> Caddy return 301 https://$host$uri;    -> redir https://{host}{uri} permanent rewrite ^/old(.*)$ /new$1;       -> rewrite /old* /new{path.1} location /blog { ... }           -> handle /blog/* { ... } location = /health { ... }       -> handle /health { ... }

TLS / HTTPS

# Nginx                          -> Caddy ssl_certificate /path/cert.pem;  -> tls /path/cert.pem /path/key.pem ssl_certificate_key /path/...;   -> (or just use a domain name for auto-HTTPS) ssl_protocols TLSv1.2 TLSv1.3;  -> (TLS 1.2+ by default)

Here is a complete Caddyfile that replaces a typical Nginx static site config, with WAF protection:

{ order coraza_waf first }
yourdomain.com { coraza_waf { load_owasp_crs directives ` Include @coraza.conf-recommended Include @crs-setup.conf.example Include @owasp_crs/*.conf SecRuleEngine On ` }
root * /srv file_server encode gzip
header { X-Content-Type-Options nosniff X-Frame-Options DENY Referrer-Policy strict-origin-when-cross-origin } }

For a reverse proxy setup (e.g., proxying to a Node.js or Python app):

{ order coraza_waf first }
yourdomain.com { coraza_waf { load_owasp_crs directives ` Include @coraza.conf-recommended Include @crs-setup.conf.example Include @owasp_crs/*.conf SecRuleEngine On ` }
reverse_proxy app:3000 }

Start the container (static file example):

docker run -d -p 80:80 -p 443:443 \ -v ./Caddyfile:/etc/caddy/Caddyfile:ro \ -v ./site:/srv:ro \ -v caddy_data:/data \ caddy-coraza

Test that normal traffic works:

curl http://localhost/

Test that attacks are blocked:

# SQL injection - should return 403 curl -o /dev/null -w "%{http_code}\n" "http://localhost/?id=1%20OR%201=1"
# XSS - should return 403 curl -o /dev/null -w "%{http_code}\n" "http://localhost/?q=%3Cscript%3Ealert(1)%3C/script%3E"
# Scanner - should return 403 curl -o /dev/null -w "%{http_code}\n" -H "User-Agent: nikto" http://localhost/

Some Nginx features do not have direct Caddy equivalents. Here is what to watch for:

Works differently

• upstream blocks with weights/health checks: Caddy handles this inline in reverse_proxy with different syntax. Load balancing policies (round_robin, least_conn, ip_hash) are supported but named differently.
• map directive: no direct equivalent. Use vars or Caddy's expression matcher for simple cases.
• limit_req_zone / rate limiting: use Caddy's rate_limit directive (available as a plugin).
• Complex location regex: Caddy uses path matchers and named matchers instead of regex locations. Most patterns translate cleanly, but deeply nested regex locations need rethinking.

Not available in Caddy

• proxy_cache: Caddy does not have built-in response caching (there is a cache-handler plugin, but it is less mature than Nginx's). If you rely heavily on Nginx's proxy cache, keep Nginx as the backend.
• Lua/njs scripting: no equivalent. If you have Nginx Lua scripts, they need to be rewritten as Caddy plugins (Go) or moved into your application.
• HTTP/2 push: deprecated in browsers and not supported in Caddy.

If your Nginx config is long or complex, you can use an AI assistant to help with the conversion. Here is a prompt you can paste into ChatGPT, Claude, or any LLM:

Convert the following Nginx configuration to a Caddy (Caddyfile) configuration. Also add Coraza WAF protection using the coraza-caddy plugin with OWASP CRS.
Requirements: - Use the coraza_waf directive with load_owasp_crs - Include @coraza.conf-recommended, @crs-setup.conf.example, and @owasp_crs/*.conf - Set SecRuleEngine On - Use "order coraza_waf first" in the global options block - Preserve all existing functionality (redirects, headers, proxy targets) - Add comments explaining each section - Flag anything that does not have a direct Caddy equivalent
Here is my Nginx config:
[paste your nginx.conf or site config here]

Review the output carefully. Check that all your locations, redirects, and proxy targets are preserved. Test the converted config in a staging environment before switching production traffic.