I build and harden web/mail infrastructure: nginx / Angie (HTTP/3, big dynamic-module set), WordPress performance & security, Rspamd / Dovecot mail, and OWASP CRS / ModSecurity rule tuning. I also maintain a modernised fork of ViMbAdmin (virtual mailbox admin). Most of it ships through my Debian/Ubuntu APT repo at deb.myguard.nl and as containers on Docker Hub.
Original work — authored and maintained by me.
| Project | What it is |
|---|---|
| nginx-autocert-module | Automatic TLS certificates built into nginx — autocert on; per vhost obtains, serves and renews certs (ACME) |
| nginx-cache-turbo-module | Edge page cache for nginx — shared-memory cache, stale-while-revalidate, probabilistic single-flight refresh |
| nginx-error-abuse-module | nginx module that rate-limits error (404) abusers |
| nginx-label-autoconf-module | Traefik-style Docker-label routing as a native nginx HTTP module — a watcher reads container labels and configures vhosts |
| webserver-hardening | Hardening patches + config snippets for nginx, Angie and OpenSSL — the deb.myguard.nl stack |
| vaultwarden-crs-plugin | OWASP CRS plugin for Vaultwarden (Bitwarden) — JSON-API-aware FP exclusions + opt-in path allowlist |
| vimbadmin-crs-plugin | OWASP CRS / ModSecurity plugin for ViMbAdmin |
| wordpress-hardening-plugin | OWASP CRS 4.0+ (ModSecurity) plugin to harden WordPress |
| gazor | Fast, zero-dependency Go reimplementation of the razor (Razor2) client (library + CLI) |
| gdcc | From-scratch, dependency-free Go DCC protocol client (library + CLI) |
| gozer | The DCC/Razor/Pyzor rspamd backend binary — links gdcc/gazor/gyzor in-process, one authenticated HTTP endpoint, no per-message forks |
| gyzor | Fast, dependency-light Go reimplementation of the pyzor client (library + CLI) |
| rspamd-dcc-razor-pyzor | Rspamd plugin + ~6 MB distroless Go backend (gozer) scoring mail via DCC / Razor / Pyzor in-process |
| rspamd-kam-rules | Download, validate, convert and deploy KAM rules for Rspamd |
| rspamd-olefy | Concurrency/timeout/cache front-end wrapping Heinlein's olefy (oletools VBA-macro scanning) for busy rspamd pipelines |
| rspamd-yarad | YARA scanner backend for rspamd — distroless nonroot Go service, statically-linked libyara, public rulesets baked in |
| dockerized | Dockerized stuff |
Abandoned upstream projects I forked and now maintain.
| Fork | Upstream | What it is |
|---|---|---|
| zstd-nginx-module | tokers/zstd-nginx-module | ZSTD compression for nginx / Angie |
| ViMbAdmin | opensolutions/ViMbAdmin | Modernised fork (2026) of the ViMbAdmin mail admin |
| roundcube-elastic4mobile | stoyanpetrov/elastic4mobile | Mobile-optimised Elastic skin for Roundcube webmail |
deb.myguard.nl — Debian/Ubuntu APT repository where I package and keep up to date a hardened web/mail stack (issue tracker):
- nginx — HTTP/3, security hardening, 100+ curated dynamic modules
- Angie — nextgen nginx fork, packaged with the same module set
- Packages — multiple Debian and Ubuntu packages
EOL projects
| Project | What it is |
|---|---|
| DShield.py | Parse Linux iptables / Snort logs into DShield format and mail them |
| Botnet.pm | SpamAssassin module |
| build_psol | Build the PageSpeed Optimization Library (PSOL) |
Get in touch via the contact page on deb.myguard.nl.