Introduction: The Imperative of Edge Security for Personal Infrastructure

In the contemporary digital landscape, personal Virtual Private Servers (VPS) hosting Dockerized applications have become a staple for developers, homelab enthusiasts, and small-business owners alike. However, exposing services like Nextcloud, Gitea, or private APIs to the public internet introduces significant vulnerabilities. Relying solely on the built-in authentication of individual applications is no longer sufficient. Enterprise-grade security demands a shift toward Edge Security.

Edge security implies mitigating threats at the perimeter of your network, long before malicious traffic reaches your core application logic. This technical deep dive explores how to architect an impenetrable defense layer on a single VPS by coupling Coraza WAF (Web Application Firewall) with Authelia, an open-source authentication server. Operating collaboratively at your reverse proxy layer, this stack filters malicious exploits and enforces strict identity verification seamlessly.

Understanding the Core Components

1. Coraza WAF: Enterprise-Grade OWASP Protection

Coraza is a modern, high-performance, open-source Web Application Firewall written in Go. It serves as an excellent, memory-safe alternative to legacy tools like ModSecurity. Coraza natively supports the OWASP Core Rule Set (CRS), enabling it to detect and block a wide array of web vulnerabilities, including:

SQL Injection (SQLi)
Cross-Site Scripting (XSS)
Remote Code Execution (RCE)
Path Traversal and Local File Inclusion (LFI)

By inspecting incoming HTTP requests at the edge, Coraza drops malicious payloads instantly, shielding unpatched or inherently vulnerable Docker containers behind it.

2. Authelia: Centralized Identity and Access Management

Authelia acts as a specialized companion to your reverse proxy, introducing a robust authentication and authorization gateway. Instead of managing separate user databases across dozens of self-hosted Docker containers, Authelia centralizes this process. Key features include:

Single Sign-On (SSO): Log in once to access all authorized subdomains.
Multi-Factor Authentication (MFA): Enforce hardware keys (YubiKey/WebAuthn) or Time-based One-Time Passwords (TOTP via Google Authenticator or Bitwarden).
Granular Access Control: Define policies based on subdomains, user groups, specific request paths, or network subnets.

Architecture Overview: The Chain of Defense

To implement this setup effectively, a reverse proxy (such as Traefik, Nginx Proxy Manager, or Caddy) must act as the primary entry point (port 80/443) on your VPS. The traffic flow follows a strict sequential pipeline:

Ingress: The user requests a protected resource (e.g., [https://dashboard.example.com](https://dashboard.example.com)).
WAF Inspection (Coraza): The reverse proxy passes the request through the Coraza plugin/middleware. Coraza evaluates the request headers, cookies, and body against the OWASP Core Rule Set. If anomalous behavior is detected, the request is immediately blocked (HTTP 403).
Identity Verification (Authelia): If the request passes the WAF, the reverse proxy utilizes its forward authentication mechanism to query Authelia. If the user session is unauthorized, Authelia intercepts the request and redirects the user to a secure login portal.
Upstream Forwarding: Once both security checks pass, the reverse proxy forwards the sanitized, authenticated request to the backend Docker container via the internal Docker virtual network.

Security Axiom: By placing Coraza ahead of Authelia, you prevent attackers from exploiting potential vulnerabilities within the authentication portal itself, ensuring maximum uptime and resilience.

Step-by-Step Deployment Guide via Docker Compose

Let us translate this architecture into an actionable deployment using Docker Compose. We will utilize a modern reverse proxy framework supporting Coraza integration natively.

Phase 1: Structuring the Directory and Networks

Log into your VPS via SSH and create a dedicated directory structure for your edge security configuration:

mkdir -p edge-security/{authelia,coraza,proxy}
cd edge-security

Create an isolated Docker network to facilitate secure communication between the proxy, security services, and upstream apps without exposing internal ports to the host:

docker network create edge_net

Phase 2: Crafting the Docker Compose Configuration

Create a docker-compose.yml file within the root of your configuration directory. This manifest orchestrates the reverse proxy, Coraza configurations, and the Authelia engine.In this architecture, ensure that the reverse proxy configuration points its middleware chain to handle Coraza rules evaluation and defines a forward-auth middleware routing to the Authelia container on port 9091. This isolates application logic behind a unified gateway.

Phase 3: Basic Configuration of Authelia

Within the authelia/ directory, generate a configuration.yml file. At a minimum, specify your JWT secrets, session security keys, storage backends (SQLite is ideal for personal VPS usage), and access control rules. Ensure the domain cookies are explicitly mapped to your primary root domain to enable seamless Single Sign-On across all your subdomains.

Phase 4: Tuning Coraza and the OWASP Core Rule Set

Copy the recommended coraza.conf-recommended and the OWASP CRS rules into your coraza/ directory. For a personal VPS, it is highly recommended to initially set Coraza to DetectionOnly mode. Monitor your logs for a few days to identify potential false positives triggered by legitimate application operations, and then switch the directive to On to actively enforce blocking.

Best Practices for Maintenance and Production Hardening

Deploying the stack is only the first phase; maintaining an optimal security posture requires adherence to industry best practices:

Automate Rule Updates: Web threats evolve rapidly. Automate the updating of your OWASP Core Rule Set via cron jobs or automated container tags to stay protected against zero-day exploits.
Implement Log Aggregation: Monitor Coraza audit logs and Authelia access logs. Tools like Fail2ban can be attached to these log streams to automatically ban IP addresses exhibiting repetitive malicious behavior directly at the VPS firewall level (iptables/UFW).
Enforce Strict TLS Policies: Use Let's Encrypt certificates to encrypt all data in transit. Enforce TLS 1.3 exclusively and utilize strong cipher suites to prevent downgrade attacks.
Regular Backups: Ensure periodic, encrypted backups of your Authelia SQLite database and configuration files to prevent data loss during container migrations or system updates.

Conclusion

By implementing Coraza WAF alongside Authelia at the edge of your personal Docker VPS, you effectively transition your self-hosted infrastructure from a fragmented state into a highly secure, centralized digital fortress. This configuration mitigates raw web application exploits while guaranteeing that only authenticated users can ever interact with your backend code. While the initial configuration requires careful tuning, the resulting peace of mind and robust defense-in-depth profile make it an essential standard for modern self-hosting infrastructure.

Edge Security: Architecting Coraza WAF and Authelia for Personal Docker VPS Infrastructure