nocleye/api-gateway repository overview

⁠Nocleye API Gateway

A self-hosted API gateway that sits in front of your backend services. For every request it decides which service receives it, who the caller is, whether they exceeded a usage limit, and which headers are forwarded. Everything is driven by a single YAML file.

⁠Features

• Servers & routes: map public paths to backends, rewrite paths, HTTPS backends with custom CA
• Authentication: JWT validation before forwarding
• Usage control: rate limits per global, server or route scope
• Client ID rules: identify callers by IP, token, header or query string
• Header rules: allow, remove or add headers, preserve Host
• Observability: gateway log, access log, Prometheus /metrics, health probes
• Config check: validate a config without starting the gateway

⁠Getting started

1. Create a config file (gateway.yaml):

ApiVersion: "v1Beta"
Rules:
  UsageControlRules:
    ten-per-minute:
      RequestCount: 10
      WindowTime: 1m
ServerConfigs:
  my-service:
    URL: "http://host.docker.internal:9090"
    UsageControlRules:
      - ten-per-minute
ServerRoutes:
  v1-api:
    TargetServer: "my-service"
    PathPattern: "/v1/api"

1. Validate it:

docker run --rm -v $(pwd):/etc/nocleye-beta/gateway:ro \
  nocleye/api-gateway check --gConfigPath gateway.yaml

1. Run it:

docker run -d --name gateway -p 8080:8080 \
  -v $(pwd):/etc/nocleye-beta/gateway:ro \
  nocleye/api-gateway gateway --gConfigPath gateway.yaml --gPort 8080

⁠Ports

⁠Configuration

• Config files live in /etc/nocleye-beta/gateway/ (put auths/ and certs/ inside it). A read-only mount is enough, the gateway never writes files.
• The default command is gateway; the entrypoint is nocleye, so other commands (check, ...) are passed as arguments.

⁠Security and supply chain

• Rootless (65532:65532), distroless static base, no shell.
• License texts in /licenses.
• Each release ships signed image digests and an SPDX SBOM per platform. Verify the GPG signature, then pull by digest: docker run nocleye/api-gateway@sha256:...

⁠Tags

• <version> (e.g. v0.2.0-beta): pinned release (recommended)
• latest: newest release

⁠Documentation

• Docs: https://docs.nocleye.com⁠
• Release verification (signatures, SBOMs): https://nocleye.com/docs/releases⁠

⁠Company

Built by Nocleye. Website: https://nocleye.com⁠ · Contact: [email protected]⁠

⁠License

Proprietary (see /licenses in the image for third-party notices).