Crivo · Reverse proxy · Web security
The front door to your web services, under control at last.
Crivo is the control panel for Caddy, the reverse proxy that carries traffic to your websites and applications. Sites, certificates, bans and alerts are managed in one place, and every change is kept in the history, ready to be undone.
A sieve for your web traffic (that’s what “crivo” means in Italian): it lets the good through and holds back the rest.
The problem
The front door to every web service, often managed by hand.
All traffic to your websites and applications goes through the reverse proxy. Yet it is often just a configuration file edited over SSH: no record of who changed what, certificates that expire without warning, attacks and traffic visible only by reading the logs.
Manual changes
Every change means an SSH session, a manual backup, an edit to the file and a restart. A single mistake can take a site down.
No history
Nobody records who changed what, and when. Rolling back means remembering how things were before.
Certificate surprises
Let’s Encrypt no longer sends expiration notices, and certificates keep getting shorter: 64 days from 2027, 45 from 2028. A failed renewal is discovered when the site stops responding.
Attacks spotted too late
Scanners and bots hunting for sensitive files are noticed only after the fact, if someone reads the logs.
How it works
A single source of truth, every change reversible.
The entire configuration lives in Crivo, which translates it into Caddy’s native configuration. Nothing else can modify Caddy, so nothing changes without control.
If Crivo stops, traffic doesn’t: Caddy keeps serving the last valid configuration.
Configure
From the web interface, the API or an AI assistant.
Review
Every change is a revision, with its diff against the previous one and its author.
Apply
Changes are applied together, without restarts.
Verify
If a site stops responding after a change, Crivo automatically rolls back to the previous version.
Guard
Security is built in.
Crivo’s guard reads traffic in real time and blocks anyone who shouldn’t get through, across all sites at once.
A bot looking for sensitive files, such as /.env, is blocked on every site within seconds.
- Bans enforced in about 2 seconds, without reloading the configuration or dropping open connections.
- fail2ban-style rules, with a list of addresses that are never banned and a “shadow” mode to test rules before enabling them.
- Rate limiting and geographic rules.
- Optional per-site web application firewall with the OWASP rules: it starts in observe-only mode and blocks once it is tuned.
All in one panel
What Crivo manages for you.
Certificates without surprises
Automatic issuance and renewal with multiple authorities and validation methods, a certificate inventory and alerts before expiration.
Upstreams under control
Load balancing, active and passive health checks, maintenance mode and error pages.
Statistics and logs
Traffic per site, response codes, latency, top addresses and paths, log search and a live stream.
Monitoring and alerts
Certificates, upstream health, DNS, configuration drift and server resources, with alerts by email or webhook (Microsoft Teams included).
Users, SSO and API
Multiple administrators with local sign-in or Single Sign-On (with a preset for Microsoft Entra ID), scoped API keys and every action logged.
AI assistants
An MCP server lets you manage the proxy from an AI assistant: “add this site,” “why is this address blocked?”
Who it’s for
A product you install yourself.
Crivo is installed on the customer’s premises, on their own server or cloud virtual machine: one installation per company, with an interface in Italian and English.
- An installable package that works even without Internet access.
- Guided first run: a setup wizard decides how Crivo itself is made reachable.
- When the license expires, Crivo becomes read-only: traffic never stops.
- Built on reliable open-source software: Caddy, Coraza with the OWASP rules, SQLite.
In production
The first installation is our own.
Crivo manages the public entry point for Intelya’s services: websites, applications and their certificates all go through it.
- Rust
- Caddy
- SQLite
- CrowdSec bouncer
- Coraza
- OWASP CRS
- MCP
Crivo
Want to see Crivo at work?
We’ll show you how to manage sites, certificates and security from a single panel.