Documentation on Gate One

Components and installation

Mon, 01 Jan 0001 00:00:00 +0000

Gate One is one binary in front of your applications. Everything else — an identity provider, the optional broker, the token broker, Redis — is a separate component you choose to run. See Components for a page per component.

The components

Component Role Shipped as Required?

Component	Role	Shipped as	Required?
Gate One	The gateway: route policy, session, proxy, MCP, injection	Signed release binary `gate-one`	yes
Identity provider	Identification and (optionally) authorization claims	External (Keycloak, Entra ID, Auth0, …)	yes
Reverse proxy	TLS termination, routing, load balancing	External (Traefik, nginx, Caddy, …)	recommended
`cladone-auth`	Optional embedded IAM / OIDC issuer (IdP federation, grants)	Signed release binary `cladone-auth`	optional
auth-bridge	Reference implementation of the `http-bridge` contract	Source `services/auth-bridge`	optional
Token broker	Per-user delegated credentials for upstream calls	Source `services/token-broker`	optional
Redis	Shared session/revocation state for several replicas	External (Sentinel)	only for HA

Gate One

The gateway: route policy, session, proxy, MCP, injection

Signed release binary gate-one

yes

Identity provider

Identification and (optionally) authorization claims

External (Keycloak, Entra ID, Auth0, …)

yes

Reverse proxy

TLS termination, routing, load balancing

External (Traefik, nginx, Caddy, …)

recommended

cladone-auth

Optional embedded IAM / OIDC issuer (IdP federation, grants)

Signed release binary cladone-auth

optional

auth-bridge

Reference implementation of the http-bridge contract

Source services/auth-bridge

optional

Token broker

Per-user delegated credentials for upstream calls

Source services/token-broker

optional

Redis

Shared session/revocation state for several replicas

External (Sentinel)

only for HA

All releases attach a single services_<version>_src.tar.gz containing the auth-bridge and token broker sources. They are not part of the gate-one binary: each runs as its own container.

IAM, IdPs and provider types

Mon, 01 Jan 0001 00:00:00 +0000

IAM services cover authorization and configure the identity providers (IdPs) they trust.

Gate One sits between the user, an IAM/authorization source and an IdP. The schema’s authProvider.type is a provider type: it selects who Gate One asks to verify a request and obtain identity/authorization claims. It is not an IAM by itself.

Architecture

Mon, 01 Jan 0001 00:00:00 +0000

Gate One is a reverse proxy at the edge. It authenticates the request, applies route policy, optionally injects UX, then forwards the request to the existing application. The application keeps its own URL, stack and deployment; it does not need an SDK.

Licence

Mon, 01 Jan 0001 00:00:00 +0000

Gate One runs from an offline signed licence: an Ed25519 token that the gateway verifies locally. It never calls home and needs no network. Without a valid token the gateway keeps serving in evaluation mode — a licence changes the badge and the host coverage, never the availability of the service.