An enterprise control plane for NGINX reverse proxies: expirable proxy sites, domain-scoped permissions, validated configuration deployment and automated certificate lifecycle, across many NGINX hosts, without ever opening an SSH session.
The management server never runs a command on a host. Every change reaches a host as an
authenticated call to a small agent, over mutual TLS with a pinned certificate — and no
configuration is ever activated before nginx -t has accepted it.
Running the platform
| Getting started | Requirements, and a development stack in two commands |
| Configuration | Every setting, the database schema, key management |
| Managing proxy sites | Creating and deploying sites, expiry, verification, drift |
| The agent | Running the node agent, and choosing how it reaches the platform |
| Certificates | ACME, renewal, wildcards and DNS-01, agent certificates |
| Access control | The permission model, and granting without over-granting |
| Observability | Audit trail, metrics, health, notifications, rate limiting |
| The admin console | The web interface |
| Running in production | Deployment, Kubernetes, monitoring, runbooks |
| Security posture | The properties the platform holds, and why |
Understanding and extending it
| Architecture | The design: components, data model, permission model, agent protocol |
| The API | REST conventions, the OpenAPI contract, the generated client |
| Contributing | Repository layout, building, testing |
| Roadmap | What is planned, what is still open, and what was deliberately left out |
| Implementation notes | What changed during construction, and why |
| Releases | Cutting a release, and what it publishes |
# Development PKI for management-to-agent mTLS. Prints the agent's certificate fingerprint,
# which is what you register an NGINX instance with.
./docker/pki/generate-dev-certs.sh
docker compose -f docker/docker-compose.yml up -d --buildThe console is at http://localhost:4200 and the API at http://localhost:8080. Sign in as
admin / change-me-on-first-login, which the first start creates and requires you to replace.
No identity provider is needed: the platform can authenticate accounts itself. To federate against
Keycloak instead, add --profile oidc. Getting started covers
both, the first proxy site, and what to do when something does not come up.
docs/architecture.md the design this implementation follows
docker/ development stack: Postgres, NGINX + agent, console, dev PKI, optional Keycloak
deploy/kubernetes/ manifests for the management plane and agents
proxy-management/ Spring Boot management server (Gradle multi-module)
enginx-agent/ Go node agent, co-located with NGINX
frontend/ Angular admin console
Java 25 · Spring Boot 4 · PostgreSQL 17 · Go 1.26 · Angular 21 · optionally any OIDC provider.