OxiRule Pack is the official, curated repository for reusable OxiRule rulepacks for OxiBelt. OxiRule is OxiBelt's CEL-like, declarative Web Application Firewall (WAF) rule model for evaluating request, response, and stream traffic.
This repository is intended to collect reviewable policy packages that can be validated with OxiBelt tooling and deployed deliberately by operators.
The repository contains its first rulepack: Vaultwarden. It is a monitor-first, request-phase hardening package for Vaultwarden 1.37.0 and later.
There is no hosted catalog or repository-wide policy feed yet. Validate and install packages from their documented directories.
| Package | Target | Default mode | Documentation |
|---|---|---|---|
vaultwarden |
Vaultwarden 1.37.0+ | Monitor | rulepacks/vaultwarden/README.md |
| Path | Purpose |
|---|---|
rulepacks/<package>/rulepack.oxirule-rulepack.toml |
Schema version 2 package manifest |
rulepacks/<package>/rules/ |
External OxiRule policy files |
rulepacks/<package>/tests/ |
Sanitized values, fixtures, replays, and validation |
rulepacks/<package>/README.md |
Compatibility, inputs, behavior, rollout, and rollback |
For the language, manifest format, actions, object model, and development tools, read the upstream OxiRule WAF reference.
Run the package validation from the repository root:
VAULTWARDEN_REQUIRE_OXIBELTCTL=1 \
rulepacks/vaultwarden/tests/validate.shThe validator requires compatible oxibeltctl and jq binaries and checks
both root and subpath renderings. See the
Vaultwarden package guide for the full
fixture, replay, and preinstall validation procedure.
WAF policy can reject requests, mutate headers, replace responses, select upstreams, rate-limit clients, or close streams. Review every rule against representative traffic before deployment. Packages default to monitor mode; move individual rules to enforcement only after validation and false-positive review.
See CONTRIBUTING.md for authoring requirements, validation commands, security expectations, commit conventions, and the pull request checklist.
Report an undisclosed vulnerability in a rulepack or other content in this repository through OxiRule-pack private vulnerability reporting. Do not disclose an unpatched vulnerability in a public issue, discussion, commit, or pull request, and never include real credentials or private traffic data in a report.
This repository is licensed under the Apache License 2.0.