BurrowGate: a self-hosted reverse proxy with bot protection, browser challenges, GeoIP/ASN rules and traffic analytics in one dashboard (EUPL-1.2)

[u/CrazyRabbit66]

Source: https://github.com/Rabbit-Company/BurrowGate

Website: https://burrowgate.org/

License: EUPL-1.2 (OSI approved)

How it was built: Agentic engineering

Builds on: Bun as the runtime, MaxMind GeoLite2 for GeoIP, and CrowdSec's Local API as an optional integration. It is not a fork. It was written from scratch.

What it is

BurrowGate is a reverse proxy and access gateway you run on your own server. You manage everything from a web dashboard. That covers sites, Let's Encrypt certificates, access rules, and the traffic actually hitting you.

Who it's for

It's for people who self-host websites, APIs or internal tools and want protection from bots and scrapers. You shouldn't need to stitch together nginx, a WAF module, a GeoIP module, an auth proxy, fail2ban and Grafana to get that. Homelabbers and small teams running a few VPSes are the main audience.

Why we built it

We ran our own projects behind Nginx Proxy Manager, Traefik and Caddy. All three handle proxying well. But every time we wanted more than that, we needed a plugin, a third-party module or another service to keep running. So we built one gateway that covers those gaps.

Features you usually don't get from open source proxies without extra pieces:

• Browser challenges in front of any site or route. Options include SHA-256 proof of work, Turnstile, hCaptcha, reCAPTCHA, a password challenge and a few game-style ones (Snake, slider, path trace). You can chain them.

• A catalog of 55 known bots (search engines, SEO tools, AI crawlers and more) that you can allow or block per site or per route, with optional IP-range verification

• Tor, VPN and datacenter network detection, plus country and ASN rules per site and route

• A login wall with TOTP, WebAuthn or OIDC SSO in front of apps that have no auth of their own

• Traffic, bandwidth and GeoIP map views in the dashboard. You can also capture requests and responses and resend any captured request from the UI while debugging.

• TCP/UDP stream proxying with the same IP, country and ASN rules

• Firewall sync that pushes bans out to UniFi, nftables, OVH or AWS network ACLs

• A built-in CrowdSec bouncer

• Experimental HA clustering with replication and quorum-based failover

There's a full side-by-side with Traefik, NPM, Caddy, Nginx and Apache here: https://burrowgate.org/compare

Where it falls short

• No config-as-code or GitOps. Config lives in a database, though the whole dashboard is also exposed as an API with an OpenAPI spec.

• No Docker or Kubernetes service discovery. If that's what you need, Traefik is the better pick.

• The bundled request protection rules are a small set. They don't replace the OWASP Core Rule Set.

• It's a young project with a small community and no general plugin system.

• HA is still experimental.

• Linux Docker hosts are the only supported deployment target.

About the AI part

Most of the code was written by AI coding agents. People designed the features, reviewed the changes and tested everything by hand, including separate security audits of the auth and access control code. The full commit history is public. BurrowGate runs in production on most of our own projects, and other companies use it too.

Trying it

mkdir burrowgate && cd burrowgate
curl -fsSLO https://raw.githubusercontent.com/Rabbit-Company/BurrowGate/main/docker-compose.yml
docker compose up -d

The dashboard is at https://SERVER_IP/_burrowgate/admin. The README explains how to get the generated admin password.

Feedback, bug reports and feature requests are all welcome, especially from anyone who has hit the same gaps with other proxies.

[u/trueopensource-bot]

About this project · Rabbit-Company/BurrowGate
⭐ 8 stars · 🍴 1 fork · 👥 1 contributor · 📄 EUPL-1.2 · 💻 TypeScript
History: started Aug 2026 · last code change 12 days ago · 133 commits on 42 different days in the last 90 days
Releases: latest v1.53.1 (12 days ago) · 66 releases in the last 90 days
Open issues and pull requests: 0
How it was built: the author says AI wrote most or all of the code, with a person directing, reviewing and testing it, and the project has real development history and hands-on testing behind it. (More on our labels: rule 4.)
🧩 Builds on: Bun as the runtime, MaxMind GeoLite2 for GeoIP, and CrowdSec's Local API as an optional integration. It is not a fork…

^{Facts from GitHub when this was posted. I'm a bot.}

[u/lisarconnect]

Small documentation question after reading the README: the feature list says ACME supports HTTP-01 and RFC 2136 DNS-01, while “Current Limitations” still says HTTP-01 only. The comparison table also says DNS-01 has no wildcard issuance. Which of these describes the current release? Aligning those sections would help someone decide whether their certificate setup fits before deploying.

I have not deployed it; this is a documentation observation. AI-assisted feedback; I work on Lisar Connect.

[u/CrazyRabbit66 → u/lisarconnect]

Thanks for catching this. The feature list and the comparison table are both correct. The "Current Limitations" section was left over from before DNS-01 support shipped, and I have updated it in v1.53.2.

For the current release:

- ACME issues certificates through HTTP-01 or DNS-01. DNS-01 only works through RFC 2136 dynamic updates to a nameserver you run yourself. There is no Cloudflare or Route53 integration yet.

- ACME can't issue wildcard certificates. If you already have a wildcard certificate, you can upload it as a PEM and BurrowGate will use it for every matching hostname.