Reverse proxy
Why Gate One runs behind a front end that terminates TLS, routes and load-balances.
Components
The services that make up a complete Gate One deployment, and how they fit together.
Gate One is one binary. A complete deployment adds a few separate
services around it: a reverse proxy in front, an identity provider, and —
depending on the features you enable — the optional cladone-auth embedded IAM,
a bridge, the token broker and Redis for shared state.
| Component | Role | Required? | Guide |
|---|---|---|---|
| Gate One | The gateway: route policy, session, proxy, MCP, injection | yes | Install |
| Identity provider | Identification and (optionally) authorization claims | yes | IAM and providers |
| Reverse proxy | TLS termination, routing, load balancing | recommended | Reverse proxy |
cladone-auth | Optional embedded IAM / OIDC issuer (IdP federation, grants) | optional | cladone-auth |
| auth-bridge | Reference implementation of the http-bridge contract | optional | auth-bridge |
| Token broker | Per-user delegated credentials for upstream calls | optional | Token broker |
| Redis | Shared session/revocation state for several replicas | only for HA | Redis |
The components that return identity or IAM facts — cladone-auth
and the HTTP bridge contract — are
the ones people confuse. cladone-auth is an OIDC issuer reached with
authProvider.type: "oidc"; the bridge is a request-verification service
reached with http-bridge. See
IAM, IdPs and provider types for the
side-by-side.
cladone-auth (embedded IAM)
The optional embedded IAM and OIDC issuer — what it runs, how to start it and how Gate One reaches it.
auth-bridge
The reference implementation of the http-bridge contract, for adapting SAML, LDAP, mTLS or a legacy session service.
HTTP bridge contract
The contract an external service implements for authProvider.type http-bridge.
Token broker
The optional service behind delegated credentials — endpoints, provider registry, environment and installation.
Redis
The shared session and revocation store required when several Gate One replicas run behind a load balancer.