Everything between the internet and your origin
Ten layers of control, all configured from one dashboard and stored in one database you own.
Reverse proxy & TLS
Multi-site routing with automated certificates.
- Native HTTP and HTTPS listeners on ports 80 and 443
- Multi-site reverse proxy routing by hostname
- Automatic Let's Encrypt certificates via ACME HTTP-01, or upload your own PEM chain
- SNI certificate selection for multiple domains on one listener
- Transparent HTTP, HTTPS, WebSocket, and secure WebSocket proxying
- Signed
X-BurrowGate-*origin verification headers (HMAC-SHA256)
Bot & abuse protection
Keep automated traffic away from your application.
- Managed request protection (WAF) with monitor and block modes
- Per-route overrides, rule exclusions, and auditable outcomes
- Pluggable challenge providers with ordered challenge chains
- SHA-256 browser proof-of-work challenge
- Opaque, revocable visitor sessions - only a SHA-256 hash is stored
Network & access policies
Decide who reaches your origin, and how.
- IPv4, IPv6, CIDR, and country pass, bypass, block, and challenge rules
- Site-wide default IP and country actions for allow and blocklists
- Per-route access modes: inherit, challenge, bypass, or block
- Access lists with global users, Argon2id password hashing, and rate-limited logins
- TOTP two-factor enrollment and OIDC SSO with back-channel logout
Rate limiting & request limits
Layered limits at the edge, not in your app.
- Fixed-window, sliding-window, and token-bucket rate limiters
- Identity by client IP, verified session, or a selected application header
- Counters shared across a policy or separated by path and method
- Request body, request-target, and combined header byte limits
- Violations rejected with
413,414, or431and logged as events
Load balancing & origin health
Multi-origin pools that heal themselves.
- Priority failover, round robin, and smooth weighted round robin
- Session affinity with deterministic client-IP fallback for sessionless requests
- Per-origin health checks, thresholds, and automatic unhealthy-origin removal
- Optional 503 maintenance mode with
Retry-Afterwhen the whole pool is down - Webhook alerts: generic signed JSON, Slack, Discord, and ntfy with a durable retrying outbox
Safe static-asset caching
Bounded, process-memory caching with real safety checks.
- Entries isolated by site, route-policy version, URL query, and accepted encoding
- Per-site/per-route enable, TTL, object-size, and extension overrides
- Cookies, auth headers, range requests, and private responses bypass storage automatically
- Dashboard reports hit ratio, origin requests avoided, top paths, and memory usage
- Scoped purge by site, path prefix, or route policy
TCP & UDP streams
Proxy more than HTTP from the same gateway.
- Native TCP and UDP stream proxying independent of the HTTP path
- Optional incoming TCP TLS termination, or raw passthrough
- Live TCP connection lists and synthetic UDP peer sessions
- Connect, disconnect, and error logs with GeoIP-enriched client country
- Per-stream monitoring retention and bandwidth grouped by IP and port
Monitoring & analytics
Full visibility, exportable to your existing stack.
- Paginated, filterable, sortable traffic, session, route, rule, and site monitoring
- Bandwidth split between client-side and upstream, by site, IP, protocol, and country
- Interactive GeoIP world map for requests and new sessions
- Exact date-time range selection and drag-to-select directly on graphs
- Prometheus and OpenTelemetry Collector export through an OpenMetrics endpoint
Customization
Make BurrowGate's edge responses match your brand.
- Per-site HTML or JSON error responses with escaped, editable templates
- Per-site custom HTML challenge pages
- Request/response header policies with route-level overrides
- Custom responses cover network blocks, rate limits, and origin failures without touching successful traffic
Storage & deployment
Runs on infrastructure you already operate.
- SQLite by default, with PostgreSQL, MySQL, and MariaDB support via Bun.SQL
- Production-ready Docker Compose deployment with an optional GeoIP-updater profile
- Per-site traffic retention from 1 to 365 days with automatic maintenance cleanup
- Certificate and ACME private keys encrypted at rest with AES-256-GCM
Network policy precedence
When more than one rule could apply to a request, BurrowGate resolves it in a fixed, documented order.
Longest matching IP or CIDR rule
The most specific network match always wins first.
Explicit country rule
A configured rule for the request's GeoIP country.
Default country action
The site's fallback action when no explicit country rule matches.
Default IP action
The site's fallback action for unmatched IP addresses.
Route policy
Path and method-based overrides apply last, on top of network policy.
Country policy fails open when the GeoIP database is unavailable - IP rules and the default IP action keep applying. Full precedence rules live in docs/NETWORK_POLICIES.md.
Put BurrowGate in front of your first site
One Docker Compose file and a domain is all it takes to get started.