bunkerity/bunkerweb ? reverse-engineered prompt

Build me a modern, open-source web application firewall (WAF) to protect my web services. It should be based on NGINX and run as a reverse proxy in a Docker container. The main goal is to make my web apps "secure by default" without me needing to be a cybersecurity expert.

It must automatically handle HTTPS certificates using Let's Encrypt. The system needs to provide strong out-of-the-box protection, including the OWASP Core Rule Set, bot detection with challenges like captchas, and automatic IP banning for suspicious behavior. I also want it to apply rate limiting and secure HTTP headers automatically.

A crucial feature is a user-friendly web UI for configuration and management, so I don't have to rely on the command line for everything. The system should be extensible, maybe with plugins, so I can add more security features later if needed.