| Port details |
- bunkerweb Self-hosted web application firewall and security platform
- 1.6.13_2 www
 =0      1.6.11_1Version of this port present on the latest quarterly branch. - Maintainer: joneum@FreeBSD.org
- Port Added: 2026-06-01 17:42:05
- Last Update: 2026-08-06 03:21:25
- Commit Hash: 63f9bd8
- Also Listed In: security
- License: AGPLv3
- WWW:
- https://github.com/bunkerity/bunkerweb
- Description:
- BunkerWeb is a security-focused reverse proxy and Web Application
Firewall (WAF) built on top of OpenResty (nginx with Lua support).
It integrates ModSecurity CRS, Lua-based request filtering,
rate limiting, automated TLS handling, an API service,
and a web management interface.
BunkerWeb supports both HTTP and stream-based reverse proxying
and can operate in standalone, containerized, or clustered
deployments.
  ¦  ¦  ¦  ¦ 
- Manual pages:
- FreshPorts has no man page information for this port.
- pkg-plist: as obtained via:
make generate-plist - USE_RC_SUBR (Service Scripts)
- bunkerweb
- bunkerweb_api
- bunkerweb_scheduler
- bunkerweb_ui
- Dependency lines:
-
- bunkerweb>0:www/bunkerweb
- To install the port:
- cd /usr/ports/www/bunkerweb/ && make install clean
- To add the package, run one of these commands:
- pkg install www/bunkerweb
- pkg install bunkerweb
NOTE: If this package has multiple flavors (see below), then use one of them instead of the name specified above.- PKGNAME: bunkerweb
- Flavors: there is no flavor information for this port.
- distinfo:
- TIMESTAMP = 1785943078
SHA256 (bunkerity-bunkerweb-1.6.13-v1.6.13_GH0.tar.gz) = dda4a4e2911bf4b01f93ed4f7453d1d531fe5d6001185746cf146237126a0c8f
SIZE (bunkerity-bunkerweb-1.6.13-v1.6.13_GH0.tar.gz) = 102343608
Packages (timestamps in pop-ups are UTC):
- Dependencies
- NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.
- Runtime dependencies:
-
- openresty : www/openresty
- py312-Jinja2>0 : devel/py-Jinja2@py312
- py312-pydantic-settings>0 : devel/py-pydantic-settings@py312
- py312-schedule>0 : devel/py-schedule@py312
- py312-user_agents>0 : devel/py-user_agents@py312
- py312-sqlalchemy20>0 : databases/py-sqlalchemy20@py312
- py312-sqlite3>0 : databases/py-sqlite3@py312
- py312-pymysql>0 : databases/py-pymysql@py312
- cjson.so : devel/lua-cjson@lua51
- py312-bcrypt>0 : security/py-bcrypt@py312
- py312-biscuit-auth>0 : security/py-biscuit-auth@py312
- py312-passlib>0 : security/py-passlib@py312
- py312-docker>0 : sysutils/py-docker@py312
- py312-kubernetes>0 : sysutils/py-kubernetes@py312
- py312-psutil>0 : sysutils/py-psutil@py312
- py312-defusedcsv>=3.0.0 : devel/py-defusedcsv@py312
- py312-setuptools>0 : devel/py-setuptools@py312
- py312-openpyxl>0 : textproc/py-openpyxl@py312
- py312-qrcode>0 : textproc/py-qrcode@py312
- py312-regex>0 : textproc/py-regex@py312
- py312-cachelib>0 : www/py-cachelib@py312
- py312-fastapi>0 : www/py-fastapi@py312
- py312-flask>0 : www/py-flask@py312
- py312-Flask-Login>0 : www/py-flask-login@py312
- py312-flask-session>0 : www/py-flask-session@py312
- py312-flask_wtf>0 : www/py-flask-wtf@py312
- py312-gunicorn>0 : www/py-gunicorn@py312
- py312-requests>0 : www/py-requests@py312
- py312-slowapi>0 : www/py-slowapi@py312
- py312-uvicorn>0 : www/py-uvicorn@py312
- python3.12 : lang/python312
- Library dependencies:
-
- libmaxminddb.so : net/libmaxminddb
- liblua-5.1.so : lang/lua51
- There are no ports dependent upon this port
Configuration Options:- No options to configure
- Options name:
- www_bunkerweb
- USES:
- lua:51 python:3.11+,run shebangfix
- pkg-message:
- For install:
- BunkerWeb has been installed.
BunkerWeb uses OpenResty as its web server runtime.
Enable the services at boot time with:
sysrc bunkerweb_scheduler_enable=YES
sysrc bunkerweb_api_enable=YES
sysrc bunkerweb_ui_enable=YES
sysrc bunkerweb_enable=YES
Start the services in the following order:
service bunkerweb_scheduler start
service bunkerweb_api start
service bunkerweb_ui start
service bunkerweb start
Configuration files are installed under:
/usr/local/etc/bunkerweb/
/usr/local/etc/nginx/
The web interface is available on port 7000 and the API on port 8888.
- Master Sites:
|
| Commit History - (may be incomplete: for full details, see links to repositories near top of page) |
| Commit | Credits | Log message |
|---|
1.6.13_2
06 Aug 2026 03:21:25
 |
Jochen Neumeister (joneum) |
www/bunkerweb: Fix rc scripts for non-3.11 Python versions
The rc scripts hardcoded /usr/local/bin/python3.11, which only worked
while the tree default happened to be 3.11. With the default at 3.12
none of the three Python services could start. Substitute the
interpreter through %%PYTHON_VERSION%% instead.
While here, create /var/run/bunkerweb in the scheduler precmd. The
scheduler writes its own pid file below that directory and died with
FileNotFoundError on a fresh boot because nothing created it.
Sponsored by: Netzkommune GmbH |
1.6.13_1
06 Aug 2026 02:38:51
|
Jochen Neumeister (joneum) |
www/bunkerweb: Add missing setuptools run dependency
passlib/pwd.py imports pkg_resources at module level, and that module
lives in setuptools. Nothing in the dependency chain requested it, so
the import only succeeded as long as something else happened to pull
setuptools in. Upstream pins setuptools<81 in the scheduler
requirements for the same reason: pkg_resources is gone in 81.
While here, pin the py-biscuit-auth dependency to ${PY_FLAVOR} now
that the port has flavors.
Sponsored by: Netzkommune GmbH |
1.6.13
05 Aug 2026 16:58:23
|
Jochen Neumeister (joneum) |
www/bunkerweb: Update to 1.6.13
This covers the 1.6.12 and 1.6.13 releases.
Security: session fixation on login and an open redirect via the
post-login "next" parameter in the web UI, a second open redirect in
the antibot post-challenge flow, and cache deletion routes that
bypassed authorization. Biscuit token generation now binds the Host
header, client IP and username as typed terms, and adds an optional
API_ALLOWED_HOSTS allowlist. Reverse DNS results are forward-confirmed
before an IGNORE_RDNS or GREYLIST_RDNS suffix match is honored, so a
self-configured PTR record no longer bypasses blocking. ACME challenge
tokens are validated against the base64url character set, closing a
path traversal through the internal API. TOTP verification is enforced
on the exact validation endpoint instead of any path containing /totp. (Only the first 15 lines of the commit message are shown above  ) |
1.6.11_1
24 Jun 2026 14:30:59
|
Jochen Neumeister (joneum) |
www/openresty: Update to 1.31.1.1
Changelog: https://openresty.org/en/changelog-1031001.html
Sponsored by: Netzkommune GmbH |
1.6.11
01 Jun 2026 17:27:52
|
Jochen Neumeister (joneum) |
www/bunkerweb: add new port
BunkerWeb is an open-source next-generation web application firewall
(WAF) and security platform designed to protect and manage web services.
It provides integrated security features such as request filtering,
rate limiting, TLS management, GeoIP support and a web management
interface.
As this is a newly introduced port, users are encouraged to validate
their deployment before using it in production environments.
WWW: https://github.com/bunkerity/bunkerweb
Sponsored by: Netzkommune GmbH |
As an Amazon Associate I earn from qualifying purchases.