First proxy
First proxy overview
End-to-end path from empty tenant to traffic through the Proxy.
Goal
Understand the minimal topology you need before HTTPS traffic hits an upstream.
The happy path
Host → Cluster (+ destinations) → Route → Publish → Proxy loads snapshot → Traffic
| Object | Purpose |
|---|---|
| Host | Public hostname (SNI / Host header) ShieldGate accepts |
| Cluster | Upstream group with load balancing and health |
| Destination | Concrete upstream address in a cluster |
| Route | Match rules + which cluster handles the request |
| Publish | Freeze a versioned snapshot and notify proxies |
Topology writes often auto-publish. You can still publish manually from Config.
Prerequisites
- First login completed.
- Proxy can reach the API with the shared internal key.
- You know the upstream URL for a test app (for example
http://127.0.0.1:5000).
Learning sequence
- Create a host
- Create cluster and destinations
- Create a route
- Publish and attach the Proxy
- Health and readiness
Verify mindset
After the guide you should be able to:
- Hit the Proxy with the configured Host header and reach upstream.
- See a config version on
/ready. - Find the same objects again in the admin UI.