18:49:40 <extrowerk> have anybody got experiences with WebApplicationFirewalls (WAF) on Illumos? i am looking at Suricata right now, which supposed to support Solarish systems.
18:50:24 <extrowerk> but i might should bite the bullet and go full mTLS instead.
20:20:08 <toasterson> geoff tried to compile it some time ago, but there are some challenges getting it to compile. Also it's an IDS not a WAF so you wont have then things you need. mTLS is again for something different. Nginx has an extension so does appache. And I think we have a running envoy so you can try running that golang WAF. It's essentially a reverse proxy so if you find one in Rust or go it will work.
20:21:11 <toasterson> If the ask is, which clients can connect to what, you are looking at Basic Auth and or oidc with path based grants
22:21:13 <extrowerk> only one user needs access: me. so mtls is the most secure way afaik.
22:22:57 <extrowerk> i had no luck with envoy. for mtls however i plan to use haproxy.