The gateway on a laptop

The gateway is one process. It serves every gateway of the hub it is connected to, checks each call’s network, client certificate, subscription and limits, and terminates TLS itself when it serves HTTPS. On a laptop it runs alone on plain HTTP, with no front server and no certificate, and it runs the same code a hub and a site run.

Start it#

The gateway needs the hub’s message server and its own instance credential, apim-1.creds, which weikio-backend init writes into the keys directory. With a hub running from source on the laptop, start it beside the backend:

$ WEIKIO_APIM_INSTANCE=1 \
  WEIKIO_HOME=$HOME/.weikio-apim \
  Weikio__Keys__Dir=/path/to/the/keys/directory \
  Weikio__Nats__Urls__0=nats://127.0.0.1:4222 \
  dotnet run --project src/Apim/Weikio.Apim

The gateway accepts calls on http://localhost:8080, or on the addresses --urls sets, and every one of them is the entrance public. WEIKIO_HOME is where it keeps a copy of the route tables it last received, which it serves when it starts while the message server is away.

Call an API with no first step#

weikio-backend init --dev seeds environment devtest with its gateway devtest: the environment’s default, on the entrance public, open to every caller, with the hostname localhost. A deploy and a subscription need no gateway named, and the call goes straight to the local port:

$ weikio apply -f ./hello-api.yaml
$ weikio api deploy sandbox/hello@v1 --env devtest
$ weikio subscription create sandbox/me --env devtest --api hello --type apikey
$ curl -H "X-Api-Key: <the key it printed>" http://localhost:8080/hello/v1/world

The seeded localhost answers on any local port, and no certificate is ordered for it. When the hub’s own address is localhost, which no gateway may take, init seeds the gateway with no hostname and prints the one command that adds the name you call it by.

weikio init hello --kind api --project sandbox writes hello/hello.yaml with the API and a proxy version to start from.

The edit loop#

A deployment serves the definition it pinned when it was deployed. After you edit a version with weikio apply or in the admin UI’s editor, weikio apply prints each environment that serves an older definition, with the line that deploys it:

sandbox/hello@v1 in devtest serves an older definition. Deploy it with: weikio api deploy sandbox/hello@v1 --env devtest

Run that line, or press Deploy on the API’s page, and the gateway serves the edit from its next route table, within seconds. A repository that applies the version together with its devtest api-deployment, written without a definition, deploys the current definition on every apply, so the loop is one command. Values and secrets aren’t pinned, so a changed value reaches the gateway at once.

Try the rules#

Every rule a hub gateway enforces works on the laptop, because the gateway enforces them itself.

Who may connect. The gateway admits a caller by the address the connection comes from. Linux answers on all of 127.0.0.0/8, so a gateway created with --networks 127.0.0.1/32 refuses curl --interface 127.0.0.2 ... and serves curl from 127.0.0.1. A refused caller gets the reply of a name that doesn’t exist.

TLS and client certificates. Start the gateway with an HTTPS address, such as --urls https://localhost:8443, create a second gateway that asks for client certificates, and upload a test certificate for its name:

$ weikio gateway create partner-local --env devtest --hostname partner.localhost --networks 127.0.0.0/8 \
    --client-certificate required --authority test=test-ca.pem --server-certificate local=partner.localhost.pem,partner.localhost.key
$ weikio subscription create sandbox/partner --env devtest --gateway partner-local --api hello --type certificate \
    --certificate-authority test --certificate-name partner.example
$ curl --cacert test-ca.pem --cert partner.pem --key partner.key --resolve partner.localhost:8443:127.0.0.1 \
    https://partner.localhost:8443/hello/v1/world

With two gateways in devtest and only devtest marked default, deploy the API onto the second one by name with weikio api deploy sandbox/hello@v1 --env devtest --gateways devtest,partner-local. A certificate revoked with weikio gateway set partner-local --revoke-certificate test=partner.pem is refused from the next route table on.

An internal entrance. An entrance is a listener of its own. Give the hub the entrance at install with weikio-backend init --dev --apim-entrance internal=127.0.0.1:8444, and start the gateway with both listeners. A gateway created with --entrance internal then answers on 8444 only, and a gateway of the entrance public on its own port only.

Limits across instances. Start a second gateway process with WEIKIO_APIM_INSTANCE=2, its own WEIKIO_HOME and another port, against the same message server. A subscription’s limit applies across both, and when you stop one, the other keeps counting the same window.

A site gateway. A site’s gateway instance is one more gateway process, started from the gateway.env of a site bundle against the site’s message server on the laptop.