www/bunkerweb 1.6.16 FreeBSD

Self-hosted web application firewall and security platform

System: FreeBSD
Repository: FreeBSD ports
Maintainer: [email protected]
Last update: 2026-10-15
Commit: 7a0111efd5
License: AGPLv3
Categories: www, security
Package size: 28481.9 KiB, 146883.8 KiB installed

Description

BunkerWeb is a security-focused reverse proxy and Web Application Firewall (WAF) built on top of OpenResty (nginx with Lua support).

It integrates ModSecurity CRS, Lua-based request filtering, rate limiting, automated TLS handling, an API service, and a web management interface.

BunkerWeb supports both HTTP and stream-based reverse proxying and can operate in standalone, containerized, or clustered deployments.

Install

Binary package:

pkg install bunkerweb

From the ports tree:

cd /usr/ports/www/bunkerweb/ && make install clean

To depend on this port in another port's Makefile:

RUN_DEPENDS=	bunkerweb>0:www/bunkerweb

Packages

The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.

Repository

aarch64

amd64

armv6

armv7

i386

FreeBSD:14:latest

1.6.15_2

1.6.15_4

1.6.16

FreeBSD:14:quarterly

1.6.15_2

n/a

1.6.15_2

FreeBSD:15:latest

1.6.15_4

1.6.16

n/a

FreeBSD:15:quarterly

1.6.15_2

n/a

FreeBSD:16:latest

1.6.15_2

1.6.16

n/a

FreeBSD:16:quarterly

n/a

Dependencies

As this port's Makefile names them.

Library 1

libmaxminddb.so : net/libmaxminddb

Runtime 36

openresty : www/openresty
sudo : security/sudo
${PYTHON_PKGNAMEPREFIX}brotli>0 : archivers/py-brotli
${PYTHON_PKGNAMEPREFIX}Jinja2>0 : devel/py-Jinja2
${PYTHON_PKGNAMEPREFIX}pydantic-settings>0 : devel/py-pydantic-settings
${PYTHON_PKGNAMEPREFIX}schedule>0 : devel/py-schedule
${PYTHON_PKGNAMEPREFIX}user_agents>0 : devel/py-user_agents
${PYTHON_PKGNAMEPREFIX}alembic>0 : databases/py-alembic
${PYTHON_PKGNAMEPREFIX}sqlalchemy20>0 : databases/py-sqlalchemy20
${PYTHON_PKGNAMEPREFIX}sqlite3>0 : databases/py-sqlite3
${PYTHON_PKGNAMEPREFIX}pymysql>0 : databases/py-pymysql
${PYTHON_PKGNAMEPREFIX}maxminddb>0 : net/py-maxminddb
${LUA_MODLIBDIR}/cjson.so : devel/lua-cjson
${PYTHON_PKGNAMEPREFIX}bcrypt>0 : security/py-bcrypt
${PYTHON_PKGNAMEPREFIX}certbot>0 : security/py-certbot
${PYTHON_PKGNAMEPREFIX}biscuit-python>0 : security/py-biscuit-python
${PYTHON_PKGNAMEPREFIX}passlib>0 : security/py-passlib
${PYTHON_PKGNAMEPREFIX}docker>0 : sysutils/py-docker
${PYTHON_PKGNAMEPREFIX}kubernetes>0 : sysutils/py-kubernetes
${PYTHON_PKGNAMEPREFIX}psutil>0 : sysutils/py-psutil
${PYTHON_PKGNAMEPREFIX}defusedcsv>=3.0.0 : devel/py-defusedcsv
${PYTHON_PKGNAMEPREFIX}setuptools>0 : devel/py-setuptools
${PYTHON_PKGNAMEPREFIX}openpyxl>0 : textproc/py-openpyxl
${PYTHON_PKGNAMEPREFIX}qrcode>0 : textproc/py-qrcode
${PYTHON_PKGNAMEPREFIX}regex>0 : textproc/py-regex
${PYTHON_PKGNAMEPREFIX}cachelib>0 : www/py-cachelib
${PYTHON_PKGNAMEPREFIX}fastapi>0 : www/py-fastapi
${PYTHON_PKGNAMEPREFIX}flask>0 : www/py-flask
${PYTHON_PKGNAMEPREFIX}Flask-Compress>0 : www/py-flask-compress
${PYTHON_PKGNAMEPREFIX}Flask-Login>0 : www/py-flask-login
${PYTHON_PKGNAMEPREFIX}flask-session>0 : www/py-flask-session
${PYTHON_PKGNAMEPREFIX}flask_wtf>0 : www/py-flask-wtf
${PYTHON_PKGNAMEPREFIX}gunicorn>0 : www/py-gunicorn
${PYTHON_PKGNAMEPREFIX}requests>0 : www/py-requests
${PYTHON_PKGNAMEPREFIX}slowapi>0 : www/py-slowapi
${PYTHON_PKGNAMEPREFIX}uvicorn>0 : www/py-uvicorn

The full lists below include those, and their dependencies in turn.

Build dependencies 3

Run dependencies 253

The first 100 are listed.

No port depends on this one.

Configuration

No options to configure.

USES: lua:51 python:3.11+,run shebangfix
Service scripts: bunkerweb, bunkerweb_api, bunkerweb_scheduler, bunkerweb_ui

Message after installing

BunkerWeb has been installed.

BunkerWeb runs on OpenResty. Its settings are stored in the database
and are managed through the web interface on port 7000 or the API on
port 8888.

Enable the services at boot time with:

  sysrc bunkerweb_scheduler_enable=YES
  sysrc bunkerweb_api_enable=YES
  sysrc bunkerweb_ui_enable=YES
  sysrc bunkerweb_enable=YES

Start the services in this order:

  service bunkerweb_scheduler start
  service bunkerweb_api start
  service bunkerweb_ui start
  service bunkerweb start

The nginx configuration in /usr/local/etc/nginx/ is generated from the
templates in /usr/local/share/bunkerweb/common/confs/ and is rewritten
on every scheduler run, changes made there are lost.

Put your own nginx directives into the matching subdirectory of
/usr/local/etc/bunkerweb/configs/ instead. The scheduler imports them
into the database and includes them in the generated configuration.

Files

pkg-plist 8620

share/bunkerweb/VERSION
share/bunkerweb/all-in-one/Dockerfile
share/bunkerweb/all-in-one/conf/acquis.yaml
share/bunkerweb/all-in-one/conf/appsec.yaml
share/bunkerweb/all-in-one/conf/config.yaml
share/bunkerweb/all-in-one/conf/redis.conf
share/bunkerweb/all-in-one/deps/crowdsec.json
share/bunkerweb/all-in-one/deps/go.json
share/bunkerweb/all-in-one/deps/re2.json
share/bunkerweb/all-in-one/entrypoint.sh
share/bunkerweb/all-in-one/logging-utils.sh
share/bunkerweb/all-in-one/logstream.sh
share/bunkerweb/all-in-one/scripts/install-crowdsec.sh
share/bunkerweb/all-in-one/scripts/install-go.sh
share/bunkerweb/all-in-one/scripts/install-re2.sh
share/bunkerweb/all-in-one/scripts/utils.sh
share/bunkerweb/all-in-one/service-log-wrapper.sh
share/bunkerweb/all-in-one/supervisor.d/api.ini
share/bunkerweb/all-in-one/supervisor.d/autoconf.ini
share/bunkerweb/all-in-one/supervisor.d/bunkerweb.ini
share/bunkerweb/all-in-one/supervisor.d/crowdsec.ini
share/bunkerweb/all-in-one/supervisor.d/logrotate.ini
share/bunkerweb/all-in-one/supervisor.d/logstream.ini
share/bunkerweb/all-in-one/supervisor.d/redis.ini
share/bunkerweb/all-in-one/supervisor.d/scheduler.ini
share/bunkerweb/all-in-one/supervisor.d/ui.ini
share/bunkerweb/all-in-one/supervisord.conf
share/bunkerweb/api/Dockerfile
share/bunkerweb/api/app/__init__.py
share/bunkerweb/api/app/auth/__init__.py
share/bunkerweb/api/app/auth/biscuit.py
share/bunkerweb/api/app/auth/common.py
share/bunkerweb/api/app/auth/guard.py
share/bunkerweb/api/app/config.py
share/bunkerweb/api/app/deps.py
share/bunkerweb/api/app/host_allowlist.py
share/bunkerweb/api/app/main.py
share/bunkerweb/api/app/models/__init__.py
share/bunkerweb/api/app/models/api_database.py
share/bunkerweb/api/app/models/models.py
share/bunkerweb/api/app/rate_limit.py
share/bunkerweb/api/app/routers/__init__.py
share/bunkerweb/api/app/routers/auth.py
share/bunkerweb/api/app/routers/bans.py
share/bunkerweb/api/app/routers/cache.py
share/bunkerweb/api/app/routers/configs.py
share/bunkerweb/api/app/routers/core.py
share/bunkerweb/api/app/routers/crowdsec.py
share/bunkerweb/api/app/routers/global_settings.py
share/bunkerweb/api/app/routers/instances.py
share/bunkerweb/api/app/routers/jobs.py
share/bunkerweb/api/app/routers/plugins.py
share/bunkerweb/api/app/routers/services.py
share/bunkerweb/api/app/schemas.py
share/bunkerweb/api/app/utils.py
share/bunkerweb/api/app/yaml_base_settings.py
share/bunkerweb/api/entrypoint.sh
share/bunkerweb/api/requirements.in
share/bunkerweb/api/requirements.txt
share/bunkerweb/api/utils/__init__.py
share/bunkerweb/api/utils/gunicorn.conf.py
share/bunkerweb/api/utils/logger.py
share/bunkerweb/api/utils/worker.py
share/bunkerweb/autoconf/Config.py
share/bunkerweb/autoconf/Dockerfile
share/bunkerweb/autoconf/controllers/Controller.py
share/bunkerweb/autoconf/controllers/DockerController.py
share/bunkerweb/autoconf/controllers/GatewayController.py
share/bunkerweb/autoconf/controllers/IngressController.py
share/bunkerweb/autoconf/controllers/KubernetesController.py
share/bunkerweb/autoconf/controllers/SwarmController.py
share/bunkerweb/autoconf/controllers/__init__.py
share/bunkerweb/autoconf/entrypoint.sh
share/bunkerweb/autoconf/main.py
share/bunkerweb/autoconf/requirements.in
share/bunkerweb/autoconf/requirements.txt
share/bunkerweb/bw/Dockerfile
share/bunkerweb/bw/entrypoint.sh
share/bunkerweb/bw/loading/index.html
share/bunkerweb/bw/lua/bunkerweb/acme.lua
share/bunkerweb/bw/lua/bunkerweb/api.lua
share/bunkerweb/bw/lua/bunkerweb/banlease.lua
share/bunkerweb/bw/lua/bunkerweb/cachestore.lua
share/bunkerweb/bw/lua/bunkerweb/clusterstore.lua
share/bunkerweb/bw/lua/bunkerweb/ctx.lua
share/bunkerweb/bw/lua/bunkerweb/datastore.lua
share/bunkerweb/bw/lua/bunkerweb/duration.lua
share/bunkerweb/bw/lua/bunkerweb/helpers.lua
share/bunkerweb/bw/lua/bunkerweb/logger.lua
share/bunkerweb/bw/lua/bunkerweb/mmdb.lua
share/bunkerweb/bw/lua/bunkerweb/plugin.lua
share/bunkerweb/bw/lua/bunkerweb/pushswap.lua
share/bunkerweb/bw/lua/bunkerweb/rediskeys.lua
share/bunkerweb/bw/lua/bunkerweb/utils.lua
share/bunkerweb/bw/lua/middleclass.lua
share/bunkerweb/bw/misc/asn.mmdb
share/bunkerweb/bw/misc/country.mmdb
share/bunkerweb/bw/misc/root-ca.pem
share/bunkerweb/common/README.de.md
share/bunkerweb/common/README.es.md

The first 100 are listed.

distinfo 1

File

Size

SHA256

bunkerity-bunkerweb-1.6.16-v1.6.16_GH0.tar.gz

1.01696076e+08

a293a652e798e48c8f7a27e9c28067195950260be18e5b8e119605776d574f96

Commit history 12

Date Commit Credits Log message

2026-10-15

7a0111efd5

Jochen Neumeister

www/bunkerweb: Update to 1.6.16

The web UI now compresses its responses, which adds py-brotli and py-flask-compress to the run dependencies. Replace the LUA_VER substitutions makeplist left in pkg-plist: they stand for parts of bundled version numbers, not for the Lua version. Changes: https://github.com/bunkerity/bunkerweb/releases/tag/v1.6.16 Sponsored by: Netzkommune GmbH

2026-10-12

05fa6e5b6f

Jochen Neumeister

www/bunkerweb: Add missing py-maxminddb dependency

The mmdb-country and mmdb-asn jobs validate the downloaded GeoIP databases with the maxminddb Python module. Without it they abort with "maxminddb is not installed", the databases are never installed, and country and ASN stay unknown in the metrics, the web UI and the country-based access rules. Sponsored by: Netzkommune GmbH

2026-10-12

d5d30594ed

Jochen Neumeister

www/bunkerweb: Fix Let's Encrypt, multisite and the profile page

- Let's Encrypt: BunkerWeb runs certbot from its own Linux layout. Add security/py-certbot to RUN_DEPENDS, point CERTBOT_BIN, DEPS_PATH and the plugin path to the installed locations, and install the certbot hook scripts executable since certbot runs them directly. - Multisite: the Templator patch forced NGINX_PREFIX to the global directory for every server. With MULTISITE=yes each server then included /usr/local/etc/nginx/set-lua.conf, which only exists without multisite, and nginx -t failed. Only set the prefix when the server configuration does not provide one. - Profile page: devel/py-user_agents is still at 1.0.1 and lacks get_browser(), get_os() and get_device(), so /profile failed with an AttributeError and two-factor setup was unreachable. Build the same …

2026-09-27

eb8f323512

Jochen Neumeister

www/bunkerweb: Make the scheduler and the API work together

The scheduler registered the instance with HTTP_PORT instead of API_HTTP_PORT, so it never reached it and ran no jobs at all. Run it as the worker user and share the directories with the API, which replaces those files on a push. Point the remaining Linux paths in the API and the config saver at their FreeBSD locations, teach the reload path about the openresty binary, and let the worker reload through the rc script, the fallback upstream already uses. Sponsored by: Netzkommune GmbH

2026-09-24

379784574f

Jochen Neumeister

www/bunkerweb: Enable ModSecurity when the module is available

Render the ModSecurity directives only if ngx_http_modsecurity_module.so is installed, like upstream does for the stream module. Build www/openresty with the MODSECURITY option to get it. Point the remaining paths at their FreeBSD locations, error pages, assets and rule files were read from /usr/share/bunkerweb. Sponsored by: Netzkommune GmbH

The latest 5 of 12 in the history this site was built from.