Infrastructure you run yourself. One binary per job.
A web application firewall, a secrets vault, a log analyzer, a domain controller console and a NAS. Each one is memory-safe, installs as a single package, and keeps every byte inside your own network.
The EasySYS Suite
Five independent services, each doing one operational job well. Run one, or run them together — they integrate, but none depends on another.
EasyWAF
A reverse proxy that routes by Host header and scores every request against OWASP-style rules — then passes it, challenges it with a self-hosted CAPTCHA, or blocks it.
EasyVault
Passwords, API keys and certificates behind envelope encryption, served over a HashiCorp Vault–compatible KV v2 API — so existing scripts keep working.
EasyLog
Ingests syslog over UDP and TCP, parses each source by type into DuckDB, and gives every source a live dashboard of its own.
EasyDC
Administer Samba Active Directory domain controllers from the browser — users, groups, computers, DNS, GPOs and OUs — with nothing installed on the DC.
EasyNAS
A turnkey NAS operating system. Install one image on a spare PC, a Raspberry Pi, an ARM board or a VM — then manage storage and shares from the browser.
Where each service sits in your network
Every product speaks an open protocol — HTTP, syslog, LDAP, Vault's KV v2, SMB and NFS — so it slots in beside what you already run instead of replacing it.
One engineering standard across five products
The same stack, the same packaging, the same operational shape — learn one EasySYS service and you already know how to run the next.
Memory-safe by design
Written in Rust, so buffer overflows, use-after-free and data races are ruled out at compile time.
Single static binary
Templates and assets are compiled in. No Python, Node.js or JVM to install, patch and keep in step.
Zero external databases
State lives in embedded SQLite or DuckDB files. No PostgreSQL or Redis cluster to stand up first.
Data sovereignty
Everything runs inside your perimeter. No telemetry, no CDN, no cloud account required to start.
| Spec | EasyWAF | EasyVault | EasyLog | EasyDC | EasyNAS |
|---|---|---|---|---|---|
| Language | Rust | Rust | Rust | Rust | Perl → Rust (rewrite) |
| Runtime | Tokio · Axum | Tokio · Axum | Tokio · Axum | Tokio · Axum | openSUSE Tumbleweed |
| Storage | SQLite | SQLite, encrypted values | DuckDB (columnar) | SQLite | Btrfs pools |
| Protocols | HTTP/1.1, TLS (SNI), WebSockets | REST, Vault KV v2 | Syslog UDP/TCP, RFC 3164 & 5424 | LDAP / LDAPS | SMB, NFS, SSH, iSCSI |
| Default ports | per site · 8443 | 8200 | 514 · 3000 | 3000 | 1443 |
| Delivered as | .deb / .rpm, signed repo | .deb / .rpm, signed repo | .deb / .rpm, signed repo | Binary + systemd unit | ISO, Pi image, qcow2 |
| License | GPL-3.0 | MIT | MIT | MIT | GPL-3.0 |
Secure by construction, not by checklist
The safe path is the default path. There are no default passwords, no unsigned updates, and no call-outs to services you didn't choose — and every claim here can be checked in the source.
No single stored value can decrypt anything on its own.
Signed supply chain
Packages ship from GPG-signed apt and yum repositories. EasyWAF checks a rule set's signature and SHA-256 before reading it — and never applies one without you.
No default credentials
You create the first admin at first run. EasyWAF generates its cookie-signing key per install and serves its console over TLS only.
Tamper-evident audit
EasyVault HMACs every audit row and flags any that were altered. EasyDC records actor, action, target and result for each change.
Least privilege
EasyVault's master account can't read a single secret. Tokens carry path, CIDR and TTL limits; trusted proxies are off until you list them.
No telemetry
GeoIP databases are bundled and the CAPTCHA is self-hosted. Rule-update checks can be switched off, so air-gapped hosts work the same.
Encrypted in transit
TLS via rustls — per-site SNI certificates in EasyWAF, HTTPS in EasyVault. EasyDC changes passwords over LDAPS only.
Fast because there's less in the way
No interpreter, no garbage collector and no database server between a request and its answer. Light enough for an arm64 board at the edge.
Async I/O end to end
Built on Tokio, EasyWAF inspects headers, query strings, cookies and bodies at thousands of requests per second with sub-millisecond latency.
Changes without restarts
Saving a site binds its listener immediately. Rules and IP lists reload on the fly, so a policy change never drops a connection.
Analytics without re-ingest
EasyLog stores events in DuckDB's columnar engine. Every chart — p95 durations included — is a live SQL aggregation, so new views work on history you already have.
Streams, not buffers
Responses stream straight through the proxy and WebSockets are tunnelled. Only request bodies are held, up to 32 MB, for rules to inspect.
Running in minutes. Upgraded like everything else.
Every service installs the way your other packages do, starts on boot under systemd, and upgrades through the package manager you already trust.
Open source. Self-hosted. Yours.
Every product is MIT or GPL-3.0 licensed and developed in the open. Pick the one that solves today's problem and have it running before lunch.