To your questions: there's an OSS core in that you can use the firewall itself without a connection to Wafris Hub.
We're in a transition where we're moving from our v1 (which required Redis) to a v2 on all clients (which uses locally replicated SQLite) and the docs and clients are in different states.
Some what's driving this is:
1. Solutions like Fastly + Cloudflare are out there, but there's still way too many sites without any "default" type protection.
2. It remains a big issue to try and sync and scale these types of systems if implemented within a framework.
3. It's easy to find stuff to block (look in your logs and it's all sorts of dumb attacks, scrapers, bots, etc.) but much harder to close the loop on discovering what to block. This is really "Wafris Hub" (the web gui) that tries to close the loop on this.
Would love more feedback, either here or mike@wafris.org