Aegis

Self-hosted Envoy gateway · AI threat analysis · TLS automation · Real-time dashboard

Aegis sits between the internet and your services — one container that controls Envoy Proxy in real time, blocks threats automatically, manages TLS certificates, and lets you chat with your gateway through an AI assistant.

Quick start

mkdir aegis && cd aegis

curl -O https://raw.githubusercontent.com/axieyangb/aegis/main/docker-compose.yml
mkdir envoy
curl -o envoy/envoy.yaml https://raw.githubusercontent.com/axieyangb/aegis/main/envoy/envoy.yaml

docker compose up -d

Open http://localhost:8765 — default login: admin / changeme.

Edit docker-compose.yml and set ADMIN_PASSWORD before exposing to the network.

On first boot Aegis seeds a working gateway baseline — HTTP (port 10080) and HTTPS (port 10443) listeners ready to accept filter chains.

Features

🦉 Owl AI Assistant Chat with your gateway in plain English. Owl analyses traffic, surfaces threats, and can configure your gateway end-to-end — clusters, certs, filter chains — from a single prompt.	🛡 Envoy Gateway Control Visual editor for listeners, filter chains, and clusters. Changes are validated and pushed live to Envoy via xDS — no restarts, no YAML files.
🔍 IP Intelligence Every IP auto-profiled: geolocation, ASN, VPN/Tor detection, AbuseIPDB score, and full request history. AI patrol sweeps run in the background and auto-block threats.	🔒 TLS Automation ACME auto-renewal (Let's Encrypt, ZeroSSL), HTTP-01 & DNS-01 challenges, and a built-in Local CA for internal services — all pushed directly to Envoy SDS.
🔔 AI Patrol & Alerts Scheduled AI sweeps classify traffic around the clock. Blocks and anomalies are pushed to Telegram, Discord, Slack, or webhook.	📱 Mobile-ready Full dashboard and Owl chat from any device. Ask Owl what happened in the last two hours — it triages threats, blocks IPs, and confirms — all from your phone.

Architecture

Internet ──▶ Envoy Proxy ──▶ Your services
                  │
          gRPC xDS (port 18000)
                  │
             ┌────▼─────┐
             │  Aegis   │  port 8765
             │          │
             │ xDS CP   │  controls Envoy live
             │ Analytics│  reads Envoy ALS logs
             │ AI Engine│  classifies IPs
             │ Cert Mgr │  ACME + Local CA → Envoy SDS
             │ Dashboard│  web UI + REST API
             └──────────┘

linux/amd64 and linux/arm64 — runs on x86 servers, Raspberry Pi, Synology NAS, and Apple Silicon.

Configuration

Data is persisted at /data/aegis.db (SQLite). Mount a volume to keep data across container updates.

Docs & Tutorials

• Getting started
• Envoy configuration
• AI setup — Owl chat + threat analysis
• Notifications — Telegram, Discord, webhooks

Tutorial series: Exposing a service with Aegis

License

Distributed as a compiled binary. Source code is proprietary. See LICENSE.

Community tier is free forever. Pro unlocks unlimited notification channels, longer log retention, and unlimited AI patrol sweeps.

About

Built by Jerry Xie — formerly network security at Palo Alto Networks, now Senior Software Engineer specialising in identity, distributed cloud, Kubernetes, and AI. Aegis started as a home lab project and grew into a product.

Issues & feature requests: GitHub Issues
Enterprise / custom integrations: yyangxie@gmail.com