# starjun/openstar

lua waf,nginx+lua,openresty,luajit,waf+,cdn,nginx

Repository: https://github.com/starjun/openstar
Canonical: https://ross.abutalabs.com/products/openstar
Language: Lua
License Family: other
Last push: 2021-10-10T12:38:05+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3759, "days_push": 1788, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1283, forks 417 (observed 2026-08-28T04:04:14.440217+00:00)

## What it is
OpenStar (WAF+) is a Web Application Firewall written in Lua that runs on nginx/OpenResty (LuaJIT), filtering HTTP traffic through JSON-configured rules for host, URI, args, method, IP, referer, and POST form matching. It adds rate limiting keyed on IP or business attributes, external-CSRF blocking, cookie/redirect actions, and Redis-based master/slave config sync for clusters.

## Use cases
- protect an nginx site from sql injection, xss, and scanning
- add a self-hosted waf to openresty
- rate limit requests by ip or by cookie identity
- block external csrf referers while whitelisting static assets
- restrict an admin directory or phpmyadmin to an ip whitelist
- sync waf rules across a cluster of nginx edge servers via redis
- build a cdn-style security layer in front of web apps

## When to choose
- you already run nginx/OpenResty and want a scriptable Lua WAF with rich rule expressions (regex, aho-corasick parallel matching, start/end/in lists, length checks)
- you need per-business-attribute rate limiting (e.g., by cookie guid) rather than plain IP throttling
- you operate multiple edge/proxy nodes and want config pushed over Redis in master/slave mode
- you are comfortable with Chinese-language docs and editing JSON rule files directly

## When to avoid
- you need actively patched security software - the last release was 2021 and there is no license file
- you want a managed dashboard or layer-4 protection - that exists only in the separate closed-source/free-to-use non-open build
- you require license clarity for commercial or enterprise deployment
- you prefer maintained alternatives like ModSecurity, Coraza, or a cloud WAF

## Facets
- artifact type: application
- maturity: maintenance
- function: security, rate-limiting, proxy
- domain: security, web-development
- platform: self-hosted
- tags: waf, web-application-firewall, openresty, nginx, luajit, cdn, csrf-protection, ip-whitelist, reverse-proxy, redis-cluster, linux, web-server

## Member repositories
- starjun/openstar (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:14.440217+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:57:04.661218+00:00, confidence not recorded.
  - readme: https://github.com/starjun/openstar (fetched 2026-08-28T04:04:14.440217+00:00, sha 36a7a231ae0e)
- Data as of 2026-08-30T08:39:29.467469+00:00.