Systems administration, simplified

Infrastructure you run yourself. One binary per job.

A web application firewall, a secrets vault, a log analyzer, a domain controller console and a NAS. Each one is memory-safe, installs as a single package, and keeps every byte inside your own network.

Rust core Single binary No external databases 100% self-hosted
admin@edge-01 — bash
# Trust the signed EasySYS repository $ curl -fsSL \ https://repo.easysys.io/easywaf/stable/debian/key.gpg \ | sudo gpg --dearmor -o /usr/share/keyrings/easysys.gpg # Install and start the service $ sudo apt install easywaf $ sudo systemctl enable --now easywaf # Open the TLS-only console and create your admin https://edge-01:8443/
Binary
/usr/bin/easywaf
State
one SQLite file
Arch
x86_64 · arm64
Packaged for
Debian / Ubuntu RHEL / Fedora openSUSE / SLES Air-gapped .deb / .rpm x86_64 · arm64
Products

The EasySYS Suite

Five independent services, each doing one operational job well. Run one, or run them together — they integrate, but none depends on another.

v0.10.0
Web application firewall

EasyWAF

A reverse proxy that routes by Host header and scores every request against OWASP-style rules — then passes it, challenges it with a self-hosted CAPTCHA, or blocks it.

99 bundled rules: SQLi, XSS, LFI, RFI, RCE, scanners
HTTPS per site via SNI, with automatic Let's Encrypt renewal
Off, DetectionOnly or On — try a policy on live traffic safely
easywaf.easysys.io
EasyWAF dashboard: requests per hour split into passed, challenged and blocked
v0.1.6
Secrets manager

EasyVault

Passwords, API keys and certificates behind envelope encryption, served over a HashiCorp Vault–compatible KV v2 API — so existing scripts keep working.

Shamir-sealed master key, held only in RAM
Tokens scoped by path, CIDR and TTL
AppRole login for CI and automation
AES-256-GCM X25519 Argon2id
easyvault.easysys.io
EasyLog world map of requests by country
v0.9.0
Log analyzer

EasyLog

Ingests syslog over UDP and TCP, parses each source by type into DuckDB, and gives every source a live dashboard of its own.

Apache, Nginx, Caddy, HAProxy, Traefik, Cisco ASA, Palo Alto, EasyWAF
Offline IP geolocation and a click-to-filter world map
easylog.easysys.io
v0.2.1
Samba AD management

EasyDC

Administer Samba Active Directory domain controllers from the browser — users, groups, computers, DNS, GPOs and OUs — with nothing installed on the DC.

Several domain controllers from one dashboard
Read-only health check: clock skew, FSMO, LDAPS certificate expiry
Audit log of who changed what, and when
LDAPS SQLite bcrypt
easydc.easysys.io
In active dev
Storage appliance

EasyNAS

A turnkey NAS operating system. Install one image on a spare PC, a Raspberry Pi, an ARM board or a VM — then manage storage and shares from the browser.

Btrfs pools: RAID 0/1/5/6/10, compression, snapshots
SMB, NFS and SSH; iSCSI, FTP and DLNA as add-ons
Being rewritten from Perl into Rust, with native ZFS
www.easynas.org
Architecture

Where each service sits in your network

Every product speaks an open protocol — HTTP, syslog, LDAP, Vault's KV v2, SMB and NFS — so it slots in beside what you already run instead of replacing it.

TRAFFIC SECRETS & LOGS IDENTITY & STORAGE Internet clientsbrowsers · bots · APIs EasyWAF:80 / :443 · console :8443 Your web appsupstream http://… HTTPS pass Firewalls & proxiesASA · PAN-OS · Nginx EasyLogsyslog :514 · UI :3000 EasyVaultKV v2 API :8200 CI & automationpipelines · cron syslog event log (logfmt) secrets at runtime X-Vault-Token AppRole IT administratorsany browser EasyDCweb console :3000 Samba AD DCsnothing installed EasyNASSMB · NFS · :1443 HTTP LDAPS
EasySYS service Your existing infrastructure Every service also runs on its own — the lines show optional integrations.
Technology

One engineering standard across five products

The same stack, the same packaging, the same operational shape — learn one EasySYS service and you already know how to run the next.

Memory-safe by design

Written in Rust, so buffer overflows, use-after-free and data races are ruled out at compile time.

Single static binary

Templates and assets are compiled in. No Python, Node.js or JVM to install, patch and keep in step.

Zero external databases

State lives in embedded SQLite or DuckDB files. No PostgreSQL or Redis cluster to stand up first.

Data sovereignty

Everything runs inside your perimeter. No telemetry, no CDN, no cloud account required to start.

SpecEasyWAFEasyVaultEasyLogEasyDCEasyNAS
LanguageRustRustRustRustPerl → Rust (rewrite)
RuntimeTokio · AxumTokio · AxumTokio · AxumTokio · AxumopenSUSE Tumbleweed
StorageSQLiteSQLite, encrypted valuesDuckDB (columnar)SQLiteBtrfs pools
ProtocolsHTTP/1.1, TLS (SNI), WebSocketsREST, Vault KV v2Syslog UDP/TCP, RFC 3164 & 5424LDAP / LDAPSSMB, NFS, SSH, iSCSI
Default portsper site · 84438200514 · 300030001443
Delivered as.deb / .rpm, signed repo.deb / .rpm, signed repo.deb / .rpm, signed repoBinary + systemd unitISO, Pi image, qcow2
LicenseGPL-3.0MITMITMITGPL-3.0
Security

Secure by construction, not by checklist

The safe path is the default path. There are no default passwords, no unsigned updates, and no call-outs to services you didn't choose — and every claim here can be checked in the source.

EasyVault key hierarchy envelope encryption

No single stored value can decrypt anything on its own.

User passwordnever stored
Argon2id → AES-256-GCM
User private keyX25519 · in memory while signed in
ECDH shared secret
Vault keyone per vault
AES-256-GCM
Secret valueversioned · never logged
Master key: RAM only, Shamir-sealed
Escrows each vault key. Split into shares at init (5 shares, 3 to unseal by default), mlock-ed out of swap, zeroized after use, and gone on every restart.

Signed supply chain

Packages ship from GPG-signed apt and yum repositories. EasyWAF checks a rule set's signature and SHA-256 before reading it — and never applies one without you.

No default credentials

You create the first admin at first run. EasyWAF generates its cookie-signing key per install and serves its console over TLS only.

Tamper-evident audit

EasyVault HMACs every audit row and flags any that were altered. EasyDC records actor, action, target and result for each change.

Least privilege

EasyVault's master account can't read a single secret. Tokens carry path, CIDR and TTL limits; trusted proxies are off until you list them.

No telemetry

GeoIP databases are bundled and the CAPTCHA is self-hosted. Rule-update checks can be switched off, so air-gapped hosts work the same.

Encrypted in transit

TLS via rustls — per-site SNI certificates in EasyWAF, HTTPS in EasyVault. EasyDC changes passwords over LDAPS only.

We publish what our software does not do.
Every known gap is documented with its target release, so you never trust coverage that isn't there.
Read EasyWAF's limitations
Performance

Fast because there's less in the way

No interpreter, no garbage collector and no database server between a request and its answer. Light enough for an arm64 board at the edge.

Async I/O end to end

Built on Tokio, EasyWAF inspects headers, query strings, cookies and bodies at thousands of requests per second with sub-millisecond latency.

Changes without restarts

Saving a site binds its listener immediately. Rules and IP lists reload on the fly, so a policy change never drops a connection.

Analytics without re-ingest

EasyLog stores events in DuckDB's columnar engine. Every chart — p95 durations included — is a live SQL aggregation, so new views work on history you already have.

Streams, not buffers

Responses stream straight through the proxy and WebSockets are tunnelled. Only request bodies are held, up to 32 MB, for rules to inspect.

Measured benchmarks Placeholder — fill before launch
[HARDWARE · METHOD · VERSION]
[REQ/S]
EasyWAF throughput, policy On
[P99 MS]
Latency added by inspection
[EVENTS/S]
EasyLog sustained syslog ingest
[MB RSS]
Idle memory per service
Deploy

Running in minutes. Upgraded like everything else.

Every service installs the way your other packages do, starts on boot under systemd, and upgrades through the package manager you already trust.

1
Add the signed repository
Signed apt, yum and zypper channels for each product.
2
Install and enable the service
The right build for x86_64 or arm64 is picked for you.
3
Open the web console
Create your admin account. No config files to edit first.
# 1 — trust the repository $ curl -fsSL https://repo.easysys.io/easylog/stable/debian/key.gpg \ | sudo gpg --dearmor -o /usr/share/keyrings/easysys.gpg $ echo "deb [signed-by=/usr/share/keyrings/easysys.gpg] \ https://repo.easysys.io/easylog/stable/debian ./" \ | sudo tee /etc/apt/sources.list.d/easylog.list # 2 — install and start $ sudo apt update && sudo apt install easylog $ sudo systemctl enable --now easylog # 3 — create your admin http://<host>:3000/
# 1 — trust the repository $ sudo tee /etc/yum.repos.d/easylog.repo >/dev/null <<'EOF' [easylog] name=EasyLog baseurl=https://repo.easysys.io/easylog/stable/redhat enabled=1 gpgcheck=1 gpgkey=https://repo.easysys.io/easylog/stable/redhat/key.gpg EOF # 2 — install and start $ sudo dnf install easylog $ sudo systemctl enable --now easylog # 3 — create your admin http://<host>:3000/
# 1 — trust the repository $ sudo zypper addrepo -fg \ https://repo.easysys.io/easylog/stable/redhat easylog # 2 — install and start $ sudo zypper install easylog $ sudo systemctl enable --now easylog # 3 — create your admin http://<host>:3000/
# 1 — download the package for your architecture # github.com/easysysio/EasyLog/releases # 2 — install and start $ sudo dpkg -i easylog_*_amd64.deb # or _arm64.deb $ sudo rpm -i easylog-*.x86_64.rpm # or .aarch64.rpm $ sudo systemctl enable --now easylog # 3 — create your admin http://<host>:3000/

Open source. Self-hosted. Yours.

Every product is MIT or GPL-3.0 licensed and developed in the open. Pick the one that solves today's problem and have it running before lunch.