Modsecurity - Tag - arleo.euhttps://www.arleo.eu/en/tags/modsecurity/Modsecurity - Tag - arleo.euHugo -- gohugo.ioenThu, 14 May 2026 05:32:19 +0200NUC Security Audit: ModSecurity Removed, 500 MB Recoveredhttps://www.arleo.eu/en/posts/audit-securite-modsecurity-crowdsec/Thu, 14 May 2026 05:32:19 +0200Jmrhttps://www.arleo.eu/en/posts/audit-securite-modsecurity-crowdsec/

⚡ TL;DR

A security stack audit on the homelab NUC reveals redundant double WAF inspection: ModSecurity + OWASP CRS load 11,872 rules into memory despite SecRuleEngine Off, running in parallel with CrowdSec AppSec which already covers the same surface. After removing the ModSecurity nginx module and five other targeted fixes, nginx drops from ~520 MB to ~27 MB PSS. Same security, memory footprint divided by 20.

🏗️ Architecture Before the Audit

The security stack had six stacked layers:

]]>