Building a Real-Time HTTP Anomaly Detection Engine for Nextcloud with Python, Nginx, and iptables

For this project, I deployed Nextcloud behind Nginx and built a Python daemon that performs real-time anomaly detection on incoming HTTP traffic. The key requirement was to avoid static assumptions and instead learn “normal” traffic behavior continuously. Stack and deployment model VPS: Linux (2 vCPU / 2 GB RAM minimum) Nextcloud container (provided image) Nginx reverse proxy Python detector daemon Slack Incoming Webhooks iptables for active mitigation Live dashboard (Flask) Nginx writes JSON ac