- 
+
- Self-hosted Envoy gateway with AI threat analysis, TLS automation, and a real-time security dashboard. + Self-hosted Envoy gateway · AI threat analysis · TLS automation · Real-time dashboard
+ Aegis sits between the internet and your services — one container that controls Envoy Proxy in real time, blocks threats automatically, manages TLS certificates, and lets you chat with your gateway through an AI assistant. +
+ +--- + + --- ## Quick start -### 1. Download the starter files - -Create a directory and download the required files: - -```bash -mkdir aegis && cd aegis - -# Download docker-compose config -curl -O https://raw.githubusercontent.com/axieyangb/aegis/main/docker-compose.yml - -# Download Envoy static bootstrap config -mkdir envoy -curl -o envoy/envoy.yaml https://raw.githubusercontent.com/axieyangb/aegis/main/envoy/envoy.yaml - -# Download baseline database configuration (for real production users) -mkdir configs -curl -o configs/starter.json https://raw.githubusercontent.com/axieyangb/aegis/main/configs/starter.json -``` - -### 2. Start the gateway - ```bash mkdir aegis && cd aegis curl -O https://raw.githubusercontent.com/axieyangb/aegis/main/docker-compose.yml mkdir envoy curl -o envoy/envoy.yaml https://raw.githubusercontent.com/axieyangb/aegis/main/envoy/envoy.yaml -``` -Edit `docker-compose.yml` and change `ADMIN_PASSWORD=changeme` to something secure, then: - -```bash docker compose up -d ``` -Open **`http://localhost:8765`** — default login: `admin` / `changeme` (or the password you set). +Open **`http://localhost:8765`** — default login: `admin` / `changeme`. -On first boot, Aegis automatically seeds a working gateway baseline — HTTP listener (port 10080) and HTTPS listener (port 10443) — ready to accept filter chains. No file import required. +> Edit `docker-compose.yml` and set `ADMIN_PASSWORD` before exposing to the network. ---- - -## Features in Action - -### Live Traffic Dashboard - -Real-time request feed, top-IP leaderboard, world traffic map, and live blocking activity — all in one view. - ---- - -### Owl AI Assistant - -Ask your gateway anything in plain English. Owl analyses current traffic, surfaces threats, and recommends exactly what to tighten — no dashboards to dig through. - ---- - -### IP Intelligence - -Every IP automatically profiled: geolocation, ASN, VPN/Tor detection, AbuseIPDB reputation score, and full request history. Click any IP to deep-dive, then ask Owl to triage it in context. - ---- - -### Gateway Control Plane - -Full Envoy xDS control — live topology view, listeners, filter chains, clusters, and extensions. See exactly which clusters are in use and by how many chains. No YAML editing required. - ---- - -### TLS Certificate Automation - -ACME auto-renewal via Let's Encrypt or ZeroSSL, delivered straight to Envoy SDS. Stuck on HTTP-01 prerequisites? Ask Owl to walk you through it step by step. - ---- - -### AI Patrol Sweeps - -Scheduled AI sweeps monitor your traffic around the clock. Threats get triaged automatically and pushed to your notification channels — Telegram, Discord, Slack, or webhook. - ---- - -### Mobile: Owl on the Go - -Open the dashboard on your phone, ask Owl what happened in the last two hours, and watch it triage the threats, block the bad IPs, and confirm the blocks — all from a single chat. +On first boot Aegis seeds a working gateway baseline — HTTP (port 10080) and HTTPS (port 10443) listeners ready to accept filter chains. --- ## Features -| | Feature | Description | -|---|---|---| -| 🛡 | **Envoy xDS Control Plane** | Visual editor for listeners, clusters, filter chains — pushed live via gRPC | -| 📊 | **Real-time Analytics** | Live request feed, top IPs, world map, device + status breakdown | -| 🤖 | **AI Threat Analysis** | Background IP classification using Gemini / Claude / GPT / Ollama. Auto-blocks attackers | -| 🦉 | **Owl AI Assistant** | Chat with your gateway — ask about traffic, threats, config, anything | -| 🔒 | **TLS Automation** | ACME (Let's Encrypt, ZeroSSL), HTTP-01 & DNS-01, auto-renewal via Envoy SDS. Built-in Local CA for internal services — no domain or open ports required | -| 🔔 | **Notifications** | Telegram, Discord, Slack webhooks — alert on blocks, anomalies, daily digest | -| 🌍 | **Geo Analytics** | Country-level traffic breakdown, remote or local MaxMind GeoIP | -| 🔑 | **Auth & SSO** | Built-in login + optional OIDC/SSO (Google, Authentik, Keycloak, etc.) | -| 🔍 | **IP Intelligence** | Per-IP profiles with ASN, ISP, VPN/Tor detection, AbuseIPDB reputation | -| 📱 | **Mobile-ready** | Full dashboard + Owl chat from any device — no native app required | +| + +**🦉 Owl AI Assistant** + + + +Chat with your gateway in plain English. Owl analyses traffic, surfaces threats, and can configure your gateway end-to-end — clusters, certs, filter chains — from a single prompt. + + | ++ +**🛡 Envoy Gateway Control** + + + +Visual editor for listeners, filter chains, and clusters. Changes are validated and pushed live to Envoy via xDS — no restarts, no YAML files. + + | +
| + +**🔍 IP Intelligence** + + + +Every IP auto-profiled: geolocation, ASN, VPN/Tor detection, AbuseIPDB score, and full request history. AI patrol sweeps run in the background and auto-block threats. + + | ++ +**🔒 TLS Automation** + + + +ACME auto-renewal (Let's Encrypt, ZeroSSL), HTTP-01 & DNS-01 challenges, and a built-in Local CA for internal services — all pushed directly to Envoy SDS. + + | +
| + +**🔔 AI Patrol & Alerts** + + + +Scheduled AI sweeps classify traffic around the clock. Blocks and anomalies are pushed to Telegram, Discord, Slack, or webhook. + + | ++ +**📱 Mobile-ready** + + + +Full dashboard and Owl chat from any device. Ask Owl what happened in the last two hours — it triages threats, blocks IPs, and confirms — all from your phone. + + | +