keaz/flux-gate-backend repository overview

FluxGate Control Plane provides the management API for FluxGate, a feature flag delivery platform built for safe rollouts, contextual targeting, and real-time visibility.

Full documentation can be found here https://github.com/keaz/fluxgate/tree/main⁠

What is this image? • Runs the Control Plane (management API and streaming channel) for FluxGate • Stores and serves flag configurations, environments, contexts, and access policies • Powers the FluxGate Console (UI) and synchronizes with FluxGate Edge for low-latency evaluations

Key capabilities • Multi-environment feature management and staged rollouts • Context-based targeting and percentage rollouts • Safe change workflows (dependencies and approvals) • Evaluation analytics collection (via the Edge) • Access control suitable for product and platform teams

Tags and architectures • Tags: latest, 1.x.y (semantic versions) • Architectures: linux/amd64, linux/arm64 (varies by release)

Exposed ports • 8080/tcp — Management API (HTTP) • 50051/tcp — Streaming channel (used by FluxGate Edge) Note: Expose 50051 only to trusted networks where your Edge runs.

Quick start • Prerequisites: a PostgreSQL-compatible database with a dedicated database and user • Start the Control Plane:

docker run -d \
  --name fluxgate-control \
  -p 8080:8080 \
  -e DATABASE_URL="postgres://user:pass@db-host:5432/fluxgate" \
  keaz/flux-gate-backend:1.0.0

Configuration (environment variables) • DATABASE_URL (required): PostgreSQL connection string (e.g., postgres://user:pass@host:5432/fluxgate) • ALLOWED_ORIGIN (optional): Console origin allowed to call the API (set per your deployment policy) • Other settings are typically managed via your platform configuration or environment; see your internal FluxGate documentation.

Networking guidance • Publish 8080 for the Console and automation clients • Keep 50051 restricted to private networks accessible by your FluxGate Edge nodes • Place the Control Plane behind your standard ingress/load balancer with TLS termination

Security and hardening • Use strong database credentials; provision least-privilege DB users • Restrict public access to 8080; do not publicly expose 50051 • Set ALLOWED_ORIGIN to your Console’s origin (when applicable) • Enforce TLS at your ingress/load balancer • Rotate credentials regularly (database, API access secrets used by Edge)

Health and readiness • Use your platform’s health/readiness checks on 8080 • Monitor logs and metrics via your standard observability stack