Repolode
Submit
linuxserver

linuxserver/docker-swag

Nginx-based reverse proxy and web gateway in a Docker container, with automatic Let's Encrypt/ZeroSSL certificates via Certbot and fail2ban intrusion prevention.

View on GitHubWebsite
Stars
3,755
Forks
273
Open issues
8
Last commit
10 hours ago

What is it?

SWAG (Secure Web Application Gateway) packages an Nginx web server and reverse proxy with PHP support into a Docker container. It includes a built-in Certbot client that generates and renews free SSL certificates from Let's Encrypt or ZeroSSL, so sites served through it can run over HTTPS without manual certificate handling.

The image also ships fail2ban with five default jails for blocking malicious bots and repeated unauthorized requests. Sites can be protected with htpasswd or LDAP authentication, and preset reverse proxy configs are available for popular self-hosted apps. Certificates are also exported in PFX and combined PEM formats for other containers that need them.

SWAG runs on x86-64 and arm64, supports DNS validation through a long list of DNS providers as well as HTTP validation, and can run with a read-only filesystem, though fail2ban is unavailable in that mode.

Key features

  • 01Automatic SSL certificate issuance and renewal via Certbot with Let's Encrypt or ZeroSSL.
  • 02Nginx reverse proxy with PHP support and preset configs for popular apps.
  • 03Built-in fail2ban with default jails for blocking bots and unauthorized requests.
  • 04DNS validation with many providers, including wildcard certificates.
  • 05htpasswd and LDAP authentication options for protecting sites.
  • 06Optional QUIC (HTTP/3) support.

Use cases

  • Putting self-hosted services like Emby or Nextcloud behind HTTPS with automatic certificates.
  • Acting as a single entry point that reverse-proxies several home-lab apps on different subdomains.
  • Using DNS validation to issue wildcard certificates for a domain behind a dynamic DNS provider.
  • Blocking brute-force and bot traffic against web apps exposed to the internet.

In collections

Self-hosted apps

Topics

#nginx#reverse-proxy#lets-encrypt#ssl-certificate#docker#fail2ban#certbot#self-hosted#hacktoberfest

FAQ

What is docker-swag?
Nginx-based reverse proxy and web gateway in a Docker container, with automatic Let's Encrypt/ZeroSSL certificates via Certbot and fail2ban intrusion prevention. SWAG (Secure Web Application Gateway) packages an Nginx web server and reverse proxy with PHP support into a Docker container. It includes a built-in Certbot client that generates and renews free SSL certificates from Let's Encrypt or ZeroSSL, so sites served through it can run over HTTPS without manual certificate handling.
Is docker-swag free to use? What license does it have?
docker-swag is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is docker-swag still maintained?
Actively maintained. The last commit to docker-swag was on Nov 7, 2026.
What can I use docker-swag for?
Putting self-hosted services like Emby or Nextcloud behind HTTPS with automatic certificates. Acting as a single entry point that reverse-proxies several home-lab apps on different subdomains. Using DNS validation to issue wildcard certificates for a domain behind a dynamic DNS provider. Blocking brute-force and bot traffic against web apps exposed to the internet.
Where can I get docker-swag?
The source code and installation instructions are on GitHub: https://github.com/linuxserver/docker-swag

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects