Semrush / Ash

DDoS protection beyond Cloudflare

JS challenges, Go code generation and Lua for Nginx.

2020–2021 · Team period

Go
Lua
Security

The task

Build DDoS protection after Semrush moved away from Cloudflare.

Browser / JS Challenge
Go / hashcash
Nginx / Lua

Main components recalled from the project, not a complete request-flow diagram.

What I worked on

A hashcash puzzle generator and checker in Go, HTTP and TCP APIs, Lua code generation for Nginx, browser-side puzzle solving with service workers, and end-to-end tests in Cypress. CIDR ranges were supplied through JSON.

Reconstructing the story

The original source code has not been located. This account draws on my recollection and my earlier professional profile; architecture details and results are still being recovered.