Ask HN: What's a good open-source alternative to Cloudflare?

It's not neccessarily about code being open source or not: you can pretty much run a wide and large proxy network for any of the services using run of the mill free software.

This means that to prevent all of the issues, you need a huge overprovisioned network. So to make economics work, you'd have to become one of the largest networks in the world, and thus serve lots of clients, making you again a "centralized" service.

The closest thing i can think of is ngnix - if i remember correctly, cloudflare built their business on top of ngnix in early days

“Just” run ngnix on your own servers from different geo locations. ngnix is very versatile, eg, load balancing, rate limiting, rule based firewall, caching…

but one important reason why saas/api/cloud businesses exist is that people don’t want to run their own servers for every project.

What would it even mean to be an open source Cloudflare? The entire point of Cloudflare is that they run the tricky stuff for you. As another user said here, you can use nginx and lots of other OSS to achieve the same end goals. You will work much harder for it though.

Building your own DDOS protection and CDN will involve a lot of devops bandwidth in ensuring both low latency and high availability. You may need to negotiate good rates with your ISP/VPS/Cloud for network bandwidth. It will also involve keeping in sync with security fixes and the state of the art in terms of bot protection, etc. If this use case is not a core part of your business, it will be better to bite the bullet and go ahead with a 3rd party solution like Cloudflare / AWS Cloudfront + WAF + Route 53 / Google Cloud Armor / Fastly

Openresty with a few Nginx modules and Lua scripts can go a long way for many use-cases mentioned:

- ModSecurity for WAF: https://github.com/SpiderLabs/ModSecurity

- L7 Rate limiting: https://github.com/openresty/lua-resty-limit-traffic

- Cache: https://github.com/ledgetech/ledge . Or use varnish which gives you VCL for high configurability

- Load balancing: https://github.com/openresty/lua-resty-balancer

- CDN: https://github.com/taythebot/lightpath . This project seems to be a WIP which you can use as a starting point for your needs. You will also need to find good enough "edge" locations for your CDN.

Similarly, HAProxy does a lot of stuff with the correct config and is also extensible using Lua:

- Some basic DOS protection: https://www.sysbee.net/blog/haproxy-sysadmins-swiss-army-kni...

- L7 DDoS protection: https://github.com/mora9715/haproxy_ddos_protector

You can run your own authoritative DNS server using either djbdns or nsd. Or use AWS Route 53.

Ultimately, it will involve (a lot of) glue code/config depending on what solution you go ahead with.

The value of CloudFlare comes from its network, not the software they run. You can hack together a caching reverse proxy (intentionally oversimplified) pretty easily, but it won't be "CloudFlare".