I love uncloud and the design thought behind it!

Some of its nice features are automatic SSL and built-in reverse proxy! However, small businesses are very concerned with DDoS (distributed denial-of-service) attacks these days . So, they resort to Cloudflare tunnels which offers free plans. But once you implement that, you realize that you can use their free SSL as well, and then you realize you do no need Caddy at all .. you are back to square one - "uncloud" put you back in "cloud" lock-in!

Can uncloud provide some basic/good DDoS feature to remove that pressure to use DDoS cloud proxies? This can be a configurable feature to shut down an attack in progress, as soon as it detects unusually high traffic from an IP address. Then it can "jail" that remote IP for some amount of time (and monitor further traffic coming from it, possibly extending the jail time). A "policeman" thread loops periodically over the jailed IPs (in-memory lookup table) and decides when to let them off the block list. Policies can be refined, but some good basic ones are enough.

From implementation point of view:

• this is best handled at a very low level - if you stop http request in Caddy, it is too late - your CPU cycles have been wasted, especially on SSL handshakes.
• the uncloud daemon can utilize iptables to dynamically implement blocking / unblocking - probably the easiest way to do it.
• better yet, this could be some eBPF level implementation.
• some though need to be put in whether the black lists should be persistent and survive machine reboot, or not.
• the CLI can show list of DDoS blocked IPs with some stats (jail time, hits etc.)