threatail/threatail-node repository overview

⁠Threatail Node

Cloud-managed reverse-proxy Web Application Firewall (data plane).

The Threatail node sits in front of your web app, terminates traffic, and enforces protection — signatures, an ML detection model, a SQLi/XSS tokenizer, bot detection, rate-limiting, API protection (JWT/JSON/OpenAPI/ATO/DLP) and mTLS. It is operated entirely from the Threatail dashboard⁠: the node enrolls with a one-time token, then pulls its site config and per-asset ML models at runtime (long-poll, changes apply within seconds) and reports incidents and metrics back.

Traffic and request bodies are processed locally on the node — only incidents and aggregated metrics are sent to the cloud.

⁠Quick start

1. In the dashboard go to Nodes → Add node and copy the one-time enrollment token.
2. Run the container:

docker run -d --name threatail-node \
  -p 80:80 -p 443:443 \
  -e THREATAIL_CLOUD_URL=https://api.threatail.com \
  -e THREATAIL_ENROLLMENT_TOKEN=<enrollment-token> \
  -v threatail-state:/var/lib/threatail \
  --restart unless-stopped \
  threatail/threatail-node:latest

The enrollment token is used once. After enrolling, the node stores its permanent node token in the state volume and appears online in the dashboard within a minute.

⁠Tags & architectures

• latest and <version> (e.g. 1.1.42) — multi-arch: linux/amd64, linux/arm64.
• Minimal Alpine image running a single static (musl) binary; no other services inside.

⁠Ports

⁠Persistence (important)

Mount THREATAIL_STATE_DIR (default /var/lib/threatail) as a named volume. It holds the permanent node token and cached policy. Without it the node loses its identity on restart and would need a fresh enrollment token each time.

⁠Environment variables

Backends, TLS/mTLS, rules and detectors are configured per-site in the dashboard, not via environment variables.

⁠How it works

enroll (one-time token) ──► node token saved to state volume
        │
        ▼
long-poll cloud ──► site config + per-asset ML model  (applied in seconds)
        │
        ▼
protect traffic locally  ──►  incidents + metrics ──► dashboard

⁠Security

• Release binaries are integrity-checked; with policy signing enabled the node rejects any unsigned or tampered configuration from the channel.
• The cloud metadata endpoint (169.254.0.0/16) is always blocked as a backend; private/loopback backends are off unless explicitly allowed.
• Runs as a single unprivileged binary; updates are applied out-of-process.

⁠Links

• Dashboard & sign-up: https://threatail.com⁠
• Docs: https://threatail.com⁠ after registration
• Support: [email protected]⁠ · security issues: [email protected]⁠