linuxserver/docker-swag

SWAG, which stands for Secure Web Application Gateway, is a Docker container image that packages several web server tools into one pre-configured unit. Its main components are Nginx (a web server and reverse proxy), automatic SSL certificate management using Let's Encrypt and ZeroSSL, and fail2ban, a tool that blocks IP addresses after repeated failed login attempts. Docker is a system for running applications in isolated containers. With SWAG, you pull a single image and configure it with environment variables: your domain name, your email address, and whether you want to verify your domain through HTTP or through your DNS provider. The container then requests a free SSL certificate, sets itself up as a web server or reverse proxy for your services, and renews the certificate automatically before it expires. The reverse proxy feature is what many users rely on most. Instead of exposing multiple services (a media server, a home automation system, a password manager) directly to the internet on separate ports, you point all external traffic to SWAG, which routes requests to the right internal service based on the domain name or URL path. This avoids the need for each application to manage its own certificates and public-facing port. Fail2ban runs alongside Nginx and watches for suspicious patterns in the access logs, such as repeated failed authentication attempts. When it detects an attack pattern, it adds the offending IP address to a block list. SWAG supports x86-64 and ARM64 architectures and is maintained by LinuxServer.io, a community that publishes regularly-updated Docker images for self-hosted software. The full README is longer than what was shown.