Put a gate between the internet and your origin servers.
BurrowGate is a self-hosted reverse proxy and access gateway. It blocks bots and scrapers, enforces route-level access policy, terminates TLS, and gives you full visibility into every request - all from one dashboard you run yourself.
Runs on infrastructure you already trust
One gateway, full control
No per-request pricing, no third-party seeing your traffic, no black-box rules. BurrowGate runs on your own VPS and answers only to you.
Stop bots before the origin
SHA-256 proof-of-work challenges, opaque revocable sessions, managed WAF rules, and layered rate limits keep abusive traffic from ever reaching your application.
See every request
Paginated traffic, session, and rule monitoring, per-country GeoIP analytics on an interactive world map, and Prometheus/OpenTelemetry export for your existing stack.
Own your data, own the rules
GPLv3-licensed and self-hosted on your VPS. Deploy with Docker Compose, back up SQLite/Postgres/MySQL like any other database, and change the source whenever you need to.
Everything a production edge needs
From TLS termination to WAF rules to TCP/UDP streams - BurrowGate covers the full path between the internet and your origin.
Reverse proxy & TLS
Multi-site hostname routing, automatic Let's Encrypt certificates, SNI, and transparent HTTP/HTTPS/WebSocket proxying.
Bot & abuse protection
Managed WAF rules with monitor/block modes, ordered challenge chains, and proof-of-work verification.
Network & access control
IPv4/IPv6/CIDR and country rules, per-route access modes, TOTP-backed access lists, and OIDC SSO.
Rate limiting
Fixed-window, sliding-window, and token-bucket limiters keyed by IP, session, or application header.
Load balancing & health
Priority failover, round robin, and weighted round robin with per-origin health checks and webhook alerts.
Monitoring & GeoIP
Traffic, bandwidth, and session analytics with an interactive country map and OpenMetrics export.
A dashboard for every layer of the edge
Traffic, sessions, network rules, streams, and bandwidth - all in one control panel.
Deploy in minutes
A Linux VPS, Docker, and a domain pointed at it is all you need. BurrowGate generates a dashboard password, encryption key, and temporary certificate on first boot.
Download the Compose file
Create a directory and fetch the production-ready Compose configuration.
Start the container
BurrowGate binds ports 80 and 443 and stores runtime data in ./data.
Sign in and add a site
Read the generated password, open the dashboard, and point a hostname at an origin.
# create a directory and fetch the Compose file
mkdir burrowgate && cd burrowgate
curl -fsSLO https://raw.githubusercontent.com/Rabbit-Company/BurrowGate/main/docker-compose.yml# start BurrowGate
docker compose up -d
docker compose logs burrowgate
# read the generated dashboard password
docker compose exec burrowgate cat /app/data/bootstrap-admin-password.txthttps://SERVER_IP/_burrowgate/adminFull install steps, environment variables, and the config reference live in the docs.
Built in the open, improved by its users
BurrowGate is GPLv3-licensed and developed on GitHub. Report issues, request features, or just come talk shop on Discord.