Overview
dflux EdgeGuard is a high-performance signaling proxy for telecom networks. It sits between NF consumers and producers — enforcing policy, transforming traffic, routing on content, and emitting decision logs and metrics across both 5G SBI (HTTP/2) and 4G Diameter — all from a single Go binary.
The proxy runs in front of the NFs you operate. Every request a consumer makes to a producer flows through the same pipeline: authenticate, allow or deny, rate-limit, transform, route, forward. Both protocol planes — HTTP/2 SBI and Diameter over TCP/SCTP — share that pipeline, so a single policy can govern both.
What dflux EdgeGuard does
- SBI reverse proxy — HTTP/2 (with h2c) for 5G service-based interfaces. NRF registration, heartbeat, and dynamic producer discovery.
- Diameter relay — RFC 6733 base protocol over TCP or SCTP, with S6a, Gx, and Rx application filters.
- Policy engine — allow/deny rules by NF type, HTTP method, path, SUPI/GPSI/DNN/S-NSSAI, or AVP. OAuth2 / JWT verification with scope enforcement.
- Transformation engine — header injection, removal, rewriting; body field masking and redaction; regex-based matching and substitution. Runs in a request phase before forwarding and a response phase before the answer reaches the consumer.
- Content-based routing — path / method / NF-type matching, SUPI-range routing, time-window routing, sticky sessions (consistent hashing by SUPI), and weighted targets for canary or blue/green.
- Rate limiting — per-consumer and per-SUPI token buckets.
- Observability — Prometheus
/metrics, deep health, OTLP tracing, structured decision logs, runtime log-level changes. - Hot reload — policy, rate limits, transforms, routes, and producer weights swap atomically without dropping connections.
How dflux EdgeGuard runs
Two binaries:
d3x-edge— the daemon. Reads a YAML or JSON config, opens one or both protocol listeners, and serves the EdgeControl gRPC admin surface onadmin.grpc_listen.d3x-edgectl— the admin CLI. Talks to the daemon over gRPC for policy CRUD, transformation rules, routing, peer ops, validation, and health.
State lives in the control-plane store (rules, transformation rules, routes), backed by SQLite (default) or PostgreSQL.
Where to go next
- Why dflux EdgeGuard — when to pick the proxy, and when not to.
- Quickstart — install, run, and exercise the proxy in ~10 minutes.
- Architecture — the model behind the proxy.
- Request pipeline — what each filter does and the order they run in.
- Config schema — every YAML field.