Documentation

Configure ShieldGate with confidence

A learning-friendly path from first install through WAF proxy controls and the network firewall appliance plane. Follow the curriculum in order, or jump to the feature you need.

Start here First proxy guide Network firewall

Get started

5 topics

What is ShieldGate Planes, tenancy, and how control, proxy, and appliance work together.
Prerequisites Tools and services you need before a local or container install.
Local install Apply migrations and run Api, Web, Worker, and Proxy on your machine.
Docker Compose quickstart Bring up Postgres, Redis, Api, Proxy, and Worker with Compose.
First login Sign in with the seeded admin and orient yourself in the console.

First proxy

6 topics

First proxy overview End-to-end path from empty tenant to traffic through the Proxy.
Create a host Register the public hostname your Proxy will accept.
Create cluster and destinations Point ShieldGate at your upstream application instances.
Create a route Match requests and bind them to a cluster.
Publish and attach the Proxy Ensure the data plane loads your tenant snapshot.
Health and readiness Use /health and /ready to know when the Proxy is safe to receive traffic.

Topology

3 topics

Hosts Manage public hostnames accepted by the data plane.
Clusters and destinations Upstream pools, load balancing, affinity, and health checks.
Routes and transforms Match traffic and reshape requests before upstream.

Network firewall

10 topics

Network firewall overview Appliance plane, permissions, console sections, and how network config differs from WAF.
Zones and L2 Zones, interfaces, VLANs, and bridges on the appliance plane.
Addresses and routing Interface addresses, static routes, and ECMP groups.
Firewall rules Zone-based stateful firewall policy on appliances.
NAT and PBR SNAT, DNAT, masquerade, and policy-based routing.
VPN tunnels WireGuard and IPSec tunnel configuration for the appliance plane.
Services (DHCP and DNS) DHCP scopes and DNS forwarders via the Service Manager.
Dynamic routing OSPF areas and BGP neighbors (MVP config + FRR hooks).
WAN and QoS SD-WAN policies and QoS (tc) policies for path and bandwidth control.
Publish, HA, and settings Network publish/rollback, clusters, monitoring, and appliance settings.

WAF policies

4 topics

Policy modes and actions Enforce, Detect, Simulate, Test—and what each action does.
JSON AST rules Author structured expressions that compile to fast matchers.
Built-in inspectors SQLi, XSS, path traversal, command injection, threat intel, bot score.
Testing policies Safe rollout workflow from Test/Detect to Enforce.

Traffic control

5 topics

Rate limiting Fixed, sliding, and token-bucket limits with route or global bindings.
IP lists and bans Allowlists, blocklists, and temporary or permanent bans.
GeoIP and geo rules Country and ASN controls with MaxMind MMDB databases.
Bot management Score and enforce automated client behavior at the edge.
Challenges and CAPTCHA Challenge gate and CAPTCHA provider hooks for suspicious clients.

Gateway & identity

4 topics

Gateway authentication Protect routes with JWT validation or API keys at the edge.
Users and roles Invite operators and assign RBAC permissions.
API keys Machine credentials for automation against the control plane.
Tenants Isolate configuration and users per customer or environment.

Certificates

4 topics

Certificates overview PEM upload, ACME HTTP-01, SNI, and Worker renewal jobs.
PEM upload Import an existing certificate and private key.
ACME HTTP-01 Automate certificates with Let’s Encrypt-style HTTP-01 challenges.
SNI bindings Attach certificates to hosts for hostname-based TLS selection.

Config & ops

5 topics

Publish and rollback Versioned snapshots, hot reload, and safe rollback.
Analytics Traffic overview, security events, and live dashboard metrics.
Audit log Track who changed what in the control plane.
Notifications Alert channels for cert expiry, threat sync, and operational events.
Plugins Load PluginSdk assemblies from the plugins directory.

Observability

3 topics

OpenTelemetry and Prometheus Export traces and metrics from ShieldGate hosts.
SIEM export Stream security and audit signals to external SIEM systems.
Live metrics Watch request and block counters in near real time.

Deploy

4 topics

Docker Compose Production-minded notes for the Compose stack.
Kubernetes Deploy control and data planes on Kubernetes.
Redis multi-proxy sync Hot-reload configuration across many data-plane nodes.
Bootstrap configuration Env and JSON bootstrap vs database-driven runtime policy.

Advanced

7 topics

IDS and IPS Signature packs in Detect or Prevent mode.
Threat intelligence Providers, sync jobs, and the threatIntel inspector.
ZTNA Zero-trust application access with claims and optional peer binding.
Secure tunnel HTTPS enrollment and heartbeat for tunnel peers (MVP).
SOC playbooks Cases and automated responses such as ban and webhook.
Anomaly detection UEBA-lite baselines that raise threat scores.
Building plugins Extend ShieldGate with ShieldGate.PluginSdk contracts.