ShieldGate Docs

Get started

What is ShieldGate

Planes, tenancy, and how control, proxy, and appliance work together.

Goal

Understand what ShieldGate is before you configure anything—so every later step maps to a clear place in the architecture.

Prerequisites

  • Curiosity and about ten minutes.
  • Optional: skim the architecture overview in the repository (engineer-facing detail).

How ShieldGate is organized

ShieldGate is a multi-tenant, self-hosted platform for application (WAF) protection and a sibling network firewall on appliances.

Plane Hosts Role
Control plane ShieldGate.Api, ShieldGate.Web, ShieldGate.Worker Admin UI, REST APIs, config publish, certificates, analytics, background jobs
Proxy plane ShieldGate.Proxy YARP reverse proxy, WAF evaluation, rate limits, geo/bot filters, TLS
Appliance plane ShieldGate.Appliance L2/L3 packet path: zones, routes, firewall, NAT, VPN, DHCP/DNS, and related services

Configuration changes are versioned snapshots. Proxies and appliances each pull their own snapshot over Redis—WAF config and network config publish independently and never share one blob.

Multi-tenancy

  • Each tenant owns hosts, routes, policies, certificates, and users.
  • The seeded platform tenant slug is typically platform.
  • JWT claims carry tid (tenant id). Platform admins can work across tenants.

Request path (data plane)

Incoming traffic on the Proxy runs through middleware roughly in this order:

  1. Geo filter
  2. Bot enforcement
  3. IP allow/block and bans
  4. Rate limiting
  5. Challenge / CAPTCHA gate
  6. WAF policy evaluation
  7. Gateway authentication (JWT or API key)
  8. IDS inspection
  9. ZTNA checks
  10. Forward to upstream

Where you configure things

Surface Use for
Admin console (ShieldGate.Web) Day-to-day configuration (preferred for learning)
Network sidebar Appliance plane: L2–L3, firewall, NAT, VPN, services, publish
REST API (/api/v1) Automation and integrations (including /api/v1/network/...)
appsettings / env Bootstrap secrets: DB, JWT, Redis, data-plane keys
Docker / Kubernetes Production deployment

ShieldGate is not a NuGet middleware you drop into another app. You run the control plane, point HTTP traffic at the Proxy, and run appliances where you need packet firewalling.

Verify

You should be able to answer:

  1. Which hosts are control, proxy, and appliance?
  2. Why WAF publish and network publish are separate?
  3. Where operators make day-to-day changes?

Next

Continue with Prerequisites. When you are ready for the appliance plane, see Network firewall overview.