Hi team — I run 20+ backend services on Railway (Next.js APIs + a few frontends), and I'm currently seeing persistent bot/scanner traffic hitting exploit paths (/wp-admin, .env, .git, etc.) and abusive request volume across multiple services daily — not a single DDoS spike, just constant low-grade scanning and abuse.

I found Under Attack Mode, but it's not a fit for my API-only services since it blocks all non-browser traffic while active — which would take down legitimate service-to-service and client API calls, not just bots.

What I'm actually looking for is something closer to Cloudflare's always-on WAF: persistent IP block/allow lists, rate-limiting rules enforced at the edge (before traffic reaches my containers), and ideally geo-blocking — running continuously, not just during a manually-triggered incident window.

I've built a Redis-backed rate limiter and IP ban system in application code (proxy.ts / Node middleware) as a stopgap, but edge-level enforcement would reduce load on my containers significantly, especially across 20+ services all currently doing this work independently.

Is this on the roadmap, or is there a recommended pattern for this today (e.g. proxying through Cloudflare in front of Railway)? Happy to be an early tester if something like this is in development.