Docs / dflux EdgeGuard
ContactGet started

Deploying dflux EdgeGuard

dflux EdgeGuard ships as a single statically linked Go binary plus an admin CLI. This guide covers the file layout, a systemd unit, a container image, and how to wire persistence so configuration survives restarts.

The binaries

  • d3x-edge — the daemon. Reads a config file and serves SBI / Diameter / admin.
  • d3x-edgectl — the admin client. Talks to the daemon's EdgeControl gRPC admin surface (default -addr 127.0.0.1:9091).

Install the binaries

Download the release archive with the link dflux gave you, verify it, and install both binaries onto your PATH:

Bash

Recommended file layout

text

A systemd unit

ini
Why CAP_NET_BIND_SERVICE
Required if you bind below 1024 (e.g. :443 for SBI or :3868 for Diameter). Drop it if you bind to higher ports.

Then:

Bash

Container image

The proxy is a single prebuilt binary, so the image just copies it into a slim base — no build stage. Drop the unpacked d3x-edge (and d3x-edgectl) next to this Dockerfile:

dockerfile

Run:

Bash

Persistence

The proxy keeps one persistent store: the control-plane store. It holds policy rules, rate-limit rules, transformation rules, routing rules, producer configs, and NRF profiles. It defaults to an in-memory SQLite database, so rules vanish on restart unless you point it at a file or a database. Wire it up with a file-backed SQLite DSN:

YAML

You can set the same values from the CLI overlay instead of the config file:

Bash

PostgreSQL is identical except for the driver and DSN, and is required when multiple instances of the proxy share state. See Using PostgreSQL.

Secrets

Any field that holds a secret has a sibling _file: variant that reads the value from a file. Use the file variant in production so secrets don't appear in your config repo or in the daemon's process listing.

YAML

Or interpolate from env with default-or-fail syntax:

YAML

Env / CLI overlay

The CLI overlay layer accepts a handful of flags that override the loaded config — useful for one-off invocations (debugging, print-config). Precedence is:

Code

The flags that overlay are documented in d3x-edge CLI.

Before pushing a new config, dump what the proxy will actually use after env interpolation, _file: dereferencing, and overlay:

Bash

Secrets are redacted in the output. Run it before you restart the daemon onto a new file.

Health checks

  • Liveness: GET /health on the SBI listener (or on observability.metrics_listen when that is set). A TCP probe on the listen address is enough if you only need "the process is up".
  • Readiness: GET /ready on the same HTTP listeners — it flips to draining (503) on SIGTERM so a load balancer can stop sending. For a deeper check of producers, the control-plane store, and Diameter, run d3x-edgectl health-deep rather than probing the admin gRPC port with HTTP.