PBC is a lightweight PHP gateway that makes browsers solve a short proof-of-work before forwarding them to a target URL. Each request receives a signed, expiring challenge; the browser computes SHA-256 nonces and, on success, the client IP is added to a whitelist and forwarded.
- Browser-side SHA-256 proof-of-work with configurable difficulty and nonce count (POW_DIFFICULTY, POW_COUNT_MIN/MAX)
- Signed, expiring challenges to prevent tampering and replay
- IP blocklist/whitelist support with APCu and on-disk caching for fast lookups
- Lightweight Bootstrap UI with automatic form submission on success
- Add a low-friction PoW gate in front of simple HTTP endpoints without heavy dependencies
- Keep deploys portable: plain PHP, static assets, and optional APCu caching
- Simple admin page to view and clear cached block/allow lists
This project is currently in development and not yet ready for production use. Please review configuration and security posture before exposing it to the internet.
- Core settings live in app/config.php; every value can be overridden via environment variables for container deployments.
- Target prefixes: set POW_ALLOWED_PREFIXES to allowed http/https prefixes.
- Difficulty and count: POW_DIFFICULTY, POW_COUNT_MIN, POW_COUNT_MAX tune effort per request.
- Secrets and expiry: POW_SECRET signs challenges; POW_EXP_SECONDS bounds validity.
- IP lists: configure POW_BLOCKLISTS/POW_WHITELISTS and their cache paths; defaults point to FireHOL level 1 and local whitelist files.
Using Podman (see BUILD.md):
podman build -t pbc-apcu .
podman run --rm -it -p 8080:80 -v "$PWD":/var/www/html pbc-apcu
Then open http://localhost:8080/app/?url=TEST-ONLY-1234 to exercise the flow.
- Portions of this project were developed using Vibe Coding practices.
- An AI assistant (GPT-5.1-Codex-Max) was used during development; review and validate outputs before production use.
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License and GNU GENERAL PUBLIC LICENSE version 3. If there are any contradictions between the two licenses, the Attribution-NonCommercial-ShareAlike 4.0 International license governs.