Security parameters
Every key on this page is set once per host, at the top of the configuration. A GUI key has a field in the interface; a YAML only key is set in the Source (YAML) view, which accepts the same configuration.
TurboShield
TurboShield protects your applications against malicious traffic. For what each mechanism does, see What is TurboShield?.
Example - every key in this section, with realistic values:
turboshield:
enabled: true
level: medium # low | medium | high | attack
allow_bots: [channable]
limit_bots: [bytespider, gptbot]
bot_protection: true # browser check for suspicious visitors (Nginx)turboshield.enabled
boolean GUI
Default true.
Turns the protection on for this host. On by default. Switching it off removes the protection completely.
turboshield.level
enum GUI
One of low, medium, high, attack. Default medium.
How aggressive the limits are, and whether the attack-only mechanisms run. Raise it while an attack is happening, and lower it again afterwards.
turboshield.allow_bots
list GUI
Default empty.
Bots that are never slowed down. Protects crawlers your revenue depends on, such as marketplace and comparison feeds.
turboshield.limit_bots
list GUI
Default empty.
Bots that are strictly slowed down. Your lever against crawlers that consume capacity without bringing customers.
turboshield.bot_protection
boolean YAML only
Default false.
Shows suspicious visitors an automatic browser check before they reach your site. Effective against scraping and credential stuffing spread across many addresses.
Note: requires Nginx.
Trusted addresses and the firewall
The firewall controls which networks and ports reach the server at all. The trusted list is shared with TurboShield.
Example - every key in this section, with realistic values:
firewall_whitelist:
- 203.0.113.10 # office
- 198.51.100.0/24 # partner integration
firewall_country_block: "CN,RU"
# Or restrict to only certain countries instead:
# firewall_country_allow: "BE,NL,FR"
firewall_tcp_ports: [80, 443, 8080]
firewall_udp_ports: [53]firewall_whitelist
list GUI
Default empty.
Addresses that bypass every check and can never be blocked automatically. The most important list to maintain. Prevents your own office, integrations and monitoring from being locked out.
Warning
A trusted address skips all protection. Keep the list short and never add a broad public range.
firewall_country_block
string GUI
Refuses all traffic from the listed countries. Cuts a lot of unwanted traffic when you only sell in certain regions.
Warning
Blocks real customers and travelling staff in those countries.
firewall_country_allow
string GUI advanced
Allows traffic only from the listed countries. For applications meant for one region only, such as an internal tool.
Warning
Everything else is refused, including search engines and monitoring.
firewall_tcp_ports
list YAML only
Default: Detected automatically.
Which TCP ports the firewall opens. Open a port for your own service.
Warning
Every open port is a way in. Only open what you actually use.
firewall_udp_ports
list YAML only advanced
Default: Detected automatically.
Which UDP ports the firewall opens. For services that do not use TCP.
Web Application Firewall
The Web Application Firewall (WAF) inspects incoming requests and blocks attacks against the application itself, such as SQL injection and cross-site scripting. It also scans the files on the host for malware. TurboStack uses Imunify for this. You switch it on per host on the Security tab.
Example - every key in this section, with realistic values:
imunify:
enabled: true
email: security@example.comimunify.enabled
boolean GUI
Default false.
Installs and activates the Web Application Firewall and malware scanning on the host. Blocks application-layer attacks that the network firewall cannot see, and finds malware in your files.
imunify.email
string GUI
The address that receives Web Application Firewall alerts, such as a malware detection. Without it you only see findings when you open the interface yourself.
Note: only used when imunify.enabled is true.