# netgoat

> NetGoat is an open-source, self-hosted Go reverse proxy and free Cloudflare alternative with domain routing, WAF rules, rate limiting, TLS/ACME and bot challenges.

- **Category:** Reverse Proxy
- **Licence:** AGPL-3.0
- **Latest version:** 0.0.1-alpha.1
- **Open source:** oss
- **Languages:** Go
- **Platforms:** Docker, Docker Compose, Go
- **Tags:** DNS, Acme, Homelab, Reverse Proxy, Bot Protection, Proof-of-Work, Rate Limiting, WAF, Javascript, Typescript, Next.js, Prometheus, Tailwindcss, Websockets, Foss, Cloudflare, Load Balancing, Hackclub, Nameserver, TLS Termination, Edge Proxy, Traffic Management

## Description

NetGoat is an alpha-stage project for self-hosters and homelab users: a Go-based proxy agent that routes inbound web traffic to your services and enforces edge security policy. The repository pitches it as a Cloudflare substitute for local and cloud use, one that can also sit in front of Cloudflare to obtain paid-plan capabilities at no cost. Host and path routing supports exact names, wildcards, regexes, and prefix matching; upstream pools balance round-robin with bounded health checks, and retries stay limited to idempotent methods. Built-in defenses include ordered WAF expression rules, token-bucket request caps, backpressure queues, byte-rate throttles, honeypot handling, and a JavaScript challenge driven by proof of work tied to the terminated TLS session, with Web Bot Auth allowlists able to skip it. The agent terminates TLS from static or streamed certificates and can run ACME issuance against an explicit domain allowlist; it also forwards WebSocket upgrades intact, caches safe public responses, and publishes counters as JSON or Prometheus text. Optional extras: sandboxed JS/TS request rules, compiled-in middleware selected at restart, local machine-learning classifiers, and verification of Cloudflare Access JWTs. Operationally you clone the repository, edit one YAML file, and start it with Go; when the control plane disappears, the agent keeps serving from a snapshot kept on disk. Caveats: the admin dashboard belongs to a separate control-plane component, the website's install guide calls itself a placeholder, the shipped file defines no routes so every host answers 404, and cleartext HTTP on a non-loopback address is blocked at startup.

## Links

- [Homepage](https://github.com/netgoat-xyz/netgoat)
- [Website](https://netgoat.app)
- [GitHub](https://github.com/netgoat-xyz/netgoat)
- [Documentation](https://netgoat.app/docs)
- [Discord](https://discord.gg/3aJ7MdJsZV)
- [Blog](https://netgoat.app/blog)
- [Status](https://netgoat.app/status)

---
Source: https://selfhost.directory/project/netgoat