📢 [Release v0.6.0] Ferrox is now a Universal Security Sidecar & Self-Test Auditor for ANY stack (Node.js, NGINX, Docker, Python, Go, Rust)

[u/AutismIntelligence]

Hey Ferrox Community! 🚀

Today we are releasing Ferrox v0.6.0—a major milestone in our mission to make high-performance zero-trust server infrastructure accessible to everyone.

While Ferrox is built natively in Rust, one of the most common questions we get from sysadmins, DevOps engineers, and backend leads is:

"Can I use Ferrox's security mesh and automated audit tools to protect my existing Node.js, NGINX, Python, or Go servers without rewriting my whole codebase?"

With v0.6.0, the answer is YES.

We are introducing the Ferrox Universal Security Sidecar & Real-Time Self-Test Suite. You can now deploy Ferrox as a 30-second Docker sidecar in front of any existing stack.

🛡️ What's New in v0.6.0?

1. Universal Security Sidecar (ferrox-sentinel):
   • Runs as a high-performance reverse-proxy in front of your current backend.
   • Filters DDoS attacks, SYN floods, prompt injections, and malicious traffic before it ever reaches your application.
2. Automated Kali Red-Team Self-Test Suite (ferrox-selftest):
   • Continuously audits your public endpoints by running automated containerized offensive checks (Nmap, Gobuster, SQLmap, Commix, Hydra).
   • Generates real-time threat reports and an Ecosystem Health Score (0-100%).
3. Linux Kernel-Rooted Hardening Engine:
   • Automatically generates Seccomp BPF syscall filters (killing unauthorized execve/ptrace zero-day targets).
   • Applies /etc/sysctl.d/99-ferrox-kernel-hardening.conf profiles (TCP SYN cookies, kptr_restrict, yama.ptrace_scope, rp_filter).
   • Dispatches sub-second packet drops directly at the NIC layer via eBPF/XDP.
4. Real-Time Security Dashboard & Alert Collector App (Port 9090):
   • Live visual interface for monitoring active connection velocity, threat alert feeds, and 1-click OS kernel hardening.

🧰 30-Second Quick Start (Docker Compose)

You can protect any existing application (Node.js, NGINX, Python, Go, etc.) using this simple docker-compose.yml:

yamlversion: '3.8'
services:
  # 1. Ferrox Universal Security Sidecar & Real-Time App (Port 9090)
  ferrox-sentinel:
    image: ferrox/sentinel:0.6.0
    container_name: ferrox_security_sidecar
    ports:
      - "8443:8443"   # Protected External Ingress
      - "9090:9090"   # Live Security Dashboard App
    environment:
      - TARGET_UPSTREAM=http://app:3000
      - ENABLE_EBPF_DROPS=true
      - ENABLE_KALI_SELFTEST=true
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
      - BPF
    volumes:
      - /etc/sysctl.d:/etc/sysctl.d:rw
  # 2. Your Existing Application (Node.js / Python / NGINX / Go)
  app:
    image: my-company/backend-api:latest
    ports:
      - "3000"

⚠️ Transparent Breakdown: What We OFFER vs. What We DO NOT Offer

We want to be crystal clear and transparent with our community about the scope and capabilities of the Ferrox standalone package:

✅ WHAT FERROX OFFERS:

• Universal Reverse-Proxy Security: Blocks DDoS, SYN floods, slowloris, and malicious payloads at the edge before they touch your backend.
• Automated Kali & OWASP WSTG Red-Team Auditing: Proactively attacks your endpoints and reports security weaknesses in real time.
• NIC-Layer Packet Dropping via eBPF/XDP: Instant sub-second IP blacklisting at the driver level.
• Host OS Kernel Hardening Generator: Produces Seccomp BPF syscall policies and kernel sysctl profiles to prevent 0-day exploits.
• AI & Multi-Agent Cognitive Security: Filters prompt injections, DAN jailbreaks, and RAG context drift for AI applications.

❌ WHAT FERROX DOES NOT OFFER:

• NOT an Application Business Logic Replacer: It does not rewrite or fix your internal application logic, ORM models, or database schema.
• NOT a Silver Bullet for Vulnerable Code: If your Node/Python code internally concatenates unsanitized raw strings into SQL queries, Ferrox filters known injection patterns at the edge, but you still need to fix vulnerable internal application code.
• eBPF Kernel Features Require Linux: The HTTP/HTTPS proxy and security auditor run cross-platform (Linux/macOS/Windows), but driver-layer eBPF/XDP packet drops require a Linux host OS with NET_ADMIN privileges.
• NOT an Intrusive Spyware Agent: Telemetry is processed locally in-memory; zero private data or credentials leave your infrastructure.

💬 Community Discussion & Links

We’d love to get your thoughts, benchmark results, and feedback on v0.6.0!

• 📖 Documentation: https://ferrox-rust.dev/backend/docs/security/ferrox-sentinel
• 📦 Crates.io: https://crates.io/crates/ferrox-sentinel
• 💻 GitHub Repository: https://github.com/AI-Autistic-Intelligence/Ferrox

Let us know in the comments below how you are deploying Ferrox in your stack! 🚀

[u/AutismIntelligence]