all projects
project · 01

FlowProxy.

Self-hosted reverse proxy and API gateway built in Go. Production-grade observability, security-hardened containers, and zero-downtime config reload.

shippedInfraGo · Redis · PostgreSQL · Docker Compose · Prometheus · Grafana · Trivy

Self-hosted reverse proxy and API gateway with per-client rate limiting, real-time analytics, and anomaly alerting. Sits in front of any HTTP service and enforces traffic policies without touching application code.

what it does

FlowProxy sits in front of any HTTP service and enforces traffic policies without touching your application code:

  • Per-client, per-route rate limiting - Redis sliding window (sorted sets + atomic Lua script)
  • Dynamic config - rate limits stored in Postgres, hot-reloaded every 30s without restart
  • Async request logging - buffered channel -> batch insert to Postgres (zero latency impact)
  • Anomaly detection - background worker fires Slack alerts on traffic spikes, error surges, abuse
  • Prometheus metrics - /metrics endpoint with 7 metrics, pre-built Grafana dashboard
  • Graceful shutdown - drains in-flight requests, flushes log buffer, exits cleanly on SIGTERM

architecture

Every request passes through this middleware chain in order:

Client -> :8080 -> [Logger -> RateLimit -> Metrics -> ReverseProxy] -> Upstream
                      |          |          |
                   Postgres    Redis    Prometheus -> Grafana
                   (logs)   (counters)  (metrics)
                      ^
                  Alert Worker (polls anomalies -> Slack)

security

  • Non-root containers - distroless runtime, USER nonroot:nonroot
  • Read-only filesystem - read_only: true on all Go services
  • No secrets in images - all credentials via .env (git-ignored)
  • Network isolation - Postgres and Redis have no published ports
  • Resource limits - CPU and memory caps on every service
  • CVE scanning - GitHub Actions runs Trivy on every push

observability

Full Prometheus metrics exposed at /metrics: flowproxy_requests_total, flowproxy_rate_limited_total, flowproxy_upstream_latency_seconds, flowproxy_active_connections. Grafana dashboards show:

  • Requests/sec
  • Rate Limit Hits/sec
  • Active Connections
  • Upstream Latency (p50/p95/p99)
  • Error Rate %
  • Top Rate-Limited Clients

key decision

Chose atomic Lua scripts over Redis transactions for rate limiting - single round-trip, no watch/multi/exec overhead, guaranteed atomicity under concurrent requests from the same client.

stack

GoRedisPostgreSQLDocker ComposePrometheusGrafanaTrivy
source