I haven't had any luck finding a decent option. Currently, there are no plans to bring naxsi back and mod_security doesn't look to be a great option either. As Thomas mentioned, adding modules means we get to constantly deal with updates of both the module and nginx. I'm not sure I see any viable options to provide any sort of WAF at this moment.
-- Michael Lustfield -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org