ShieldGate Docs

Get started

Local install

Apply migrations and run Api, Web, Worker, and Proxy on your machine.

Goal

Run a full local control plane and (optionally) a data-plane Proxy against your PostgreSQL database.

Prerequisites

Steps

1. Build the solution

dotnet build ShieldGate.slnx

2. Apply database migrations

dotnet ef database update \
  --project src/ShieldGate.Persistence/ShieldGate.Persistence.csproj \
  --startup-project src/ShieldGate.Persistence/ShieldGate.Persistence.csproj

Default design-time connection (override with SHIELDGATE_CONNECTION_STRING):

Host=localhost;Port=5432;Database=shieldgate;Username=shieldgate;Password=shieldgate

Align ConnectionStrings:ShieldGate in src/ShieldGate.Api/appsettings.json with the same database.

3. Start the API

dotnet run --project src/ShieldGate.Api/ShieldGate.Api.csproj

With Seed:Enabled=true, the API creates the platform tenant and bootstrap admin.

4. Start the admin UI

dotnet run --project src/ShieldGate.Web/ShieldGate.Web.csproj

Open https://localhost:7280. Ensure ShieldGate:ApiBaseUrl points at the API.

dotnet run --project src/ShieldGate.Worker/ShieldGate.Worker.csproj

Needed for ACME orders, certificate renewal, threat-intel sync, analytics rollups, and SOC jobs.

6. Configure and start the Proxy

In src/ShieldGate.Proxy/appsettings.json (or environment):

Setting Purpose
DataPlane:ControlPlaneBaseUrl API base URL
DataPlane:InternalApiKey Must match API DataPlane:InternalApiKey
DataPlane:TenantId Real tenant GUID after you create/publish config
DataPlane:AllowEmptyConfig true for local boot before first snapshot 
dotnet run --project src/ShieldGate.Proxy/ShieldGate.Proxy.csproj

Verify

  • API: GET /health
  • Web: sign-in page loads
  • Proxy: GET /health and GET /ready (ready may be 503 until first config unless empty config is allowed)

Pitfalls

  • Mismatched internal API keys between Api and Proxy block snapshot pull.
  • Wrong TenantId means the Proxy never loads your topology.
  • Redis disabled is fine for single-node labs; enable it before multi-proxy.

Next

First login