Docs / dflux EdgeGuard
ContactGet started

Quickstart

Install dflux EdgeGuard from the prebuilt binary, activate your license, run it against the minimal config, and exercise the admin API. About 10 minutes start to finish.

What dflux gives you
dflux EdgeGuard ships as prebuilt binaries. You'll have received a download link and a license file for the edgeguard product from d3x — keep both handy. The download link is time-limited; the license file is yours to keep.

Prerequisites

  • A Linux host (amd64 or arm64). The SBI proxy runs over HTTP/2 on any host, but the Diameter relay uses kernel SCTP, which is Linux-only — so a Linux host covers both surfaces.
  • The download link and edgeguard license file dflux gave you.
  • That's it — SQLite is embedded; no external dependencies for the minimal run.

Step 1 — Download and install

Download the release archive using the link dflux gave you, then verify and unpack it:

Bash

The archive contains the d3x-edge (daemon) and d3x-edgectl (admin client) binaries plus an examples/ directory. Install the binaries onto your PATH:

Bash

Confirm the daemon runs:

Bash

Step 2 — Activate your license

Drop the license file dflux gave you at the product path, /etc/dflux/edgeguard.lic (or a compound /etc/dflux/d3x.lic that grants edgeguard among other products):

Bash

On a successful start the daemon logs who it's licensed to and when the license expires. A missing or invalid license is fail-closed — the process refuses to start.

License location
Resolution order: D3X_LICENSE_FILE if set, else $HOME/.dflux/d3x.lic, $HOME/.dflux/edgeguard.lic, /etc/dflux/d3x.lic, then /etc/dflux/edgeguard.lic. Verification is fully offline; nothing phones home. After a successful start, expiry is re-checked daily and only warns — it never tears down a running data plane. See Licensing for the full picture.

Step 3 — Run with the minimal config

The shipped examples/edge-minimal.yaml is a one-page config. Everything outside it falls back to safe defaults: admin.default_action: deny, an in-memory shared-cache SQLite control-plane store, 30 s read timeout, and a 1 MiB request body cap. The example binds SBI on :8090 and EdgeControl gRPC on 127.0.0.1:9091, with a loopback admin / admin user.

Bash

You should see startup logs that look something like this:

text
Where is the admin listener?
Configure the admin control surface with admin.grpc_listen (commonly :9091 or 127.0.0.1:9091). Cleartext gRPC requires admin.allow_insecure: true — fine for local dev; use admin.tls and credentials before exposing the admin port. d3x-edgectl defaults to 127.0.0.1:9091. See Securing the admin API.

Check status with d3x-edgectl

d3x-edgectl talks gRPC to admin.grpc_listen (default -addr 127.0.0.1:9091) and authenticates with -key / D3X_EDGE_ADMIN_KEY or -token. The shipped example has no API key — it ships an admin / admin user for the Login RPC, and d3x-edgectl has no login command. For this walkthrough, add a loopback API key under admin.auth (leave the existing users roster in place) and restart:

YAML

From another shell:

Bash

You'll get JSON like:

JSON

Exercise the policy gate

By default the policy gate denies unknown traffic. List the seeded rules:

Bash

Add a permissive rule so a test SBI call reaches the producer pool (this is a smoke rule — refine it before production). Save it to allow-smoke.json:

JSON
Bash

Send a request

Send a request through the SBI listener — even one that 404s because no producer is registered — and the proxy emits the decision as a structured JSON log line on its own stdout:

Bash

Decisions are emitted only as structured JSON logs (request ID, the allow/deny outcome, status code, and duration), ready to ship to your log pipeline or SIEM. For aggregate signal, scrape the metrics endpoint below.

Scrape Prometheus

The proxy exposes Prometheus metrics on the SBI listener (and on observability.metrics_listen when that is set — the admin gRPC port does not serve /metrics):

Bash

See Metrics for the full list of exported series.

Where to go next