have anybody got experiences with WebApplicationFirewalls (WAF) on Illumos? i am looking at Suricata right now, which supposed to support Solarish systems.

but i might should bite the bullet and go full mTLS instead.

geoff tried to compile it some time ago, but there are some challenges getting it to compile. Also it's an IDS not a WAF so you wont have then things you need. mTLS is again for something different. Nginx has an extension so does appache. And I think we have a running envoy so you can try running that golang WAF. It's essentially a reverse proxy so if you find one in Rust or go it will work.

If the ask is, which clients can connect to what, you are looking at Basic Auth and or oidc with path based grants

only one user needs access: me. so mtls is the most secure way afaik.

i had no luck with envoy. for mtls however i plan to use haproxy.