Support server

The support server is a second, internal HTTP server that runs next to the gateway listener. It is not part of the traffic path: it exists for operators, probes and monitoring.

It binds to --sHost:--sPort (default 127.0.0.1:8081).

Do not expose it publicly

Keep it on loopback, or on a private network or a container port you don’t publish. See the flags.

Endpoint	Purpose	Guarded by token
GET /healthz	Liveness probe	no
GET /readyz	Readiness probe	no
GET /metrics	Prometheus metrics	no
POST /api/v1/gateway/config/swap	Replace the running config without a restart	yes
POST /api/v1/gateway/testing/config	Load a config for testing	yes
DELETE /api/v1/gateway/testing/config	Release the testing config	yes

Health and readiness

• GET /healthz answers 200 whenever the process is up. Use it as a liveness probe.
• GET /readyz answers 200 with ok once the config is loaded. It answers 503 with not ready while starting and once shutdown has begun, so load balancers and orchestrators stop sending traffic before the gateway drains. Use it as a readiness probe.

Metrics

GET /metrics serves Prometheus metrics. It exists only when --sPrometheusEnabled is true, and exposes the families chosen with --sPrometheusMetrics. See Prometheus metrics.

Live config API

The /api/v1/gateway/* routes let you change the configuration of a running gateway locally, without a restart and without any external service. They are meant to be called from the same host or private network, for example by your own deploy scripts.

Early API

These routes are early and will be documented in full later. This page describes what they are for, details such as the request format may change.

Swap the config

POST /api/v1/gateway/config/swap

Replaces the running config with the one in the request body. The body is the same structure as the config file, encoded as JSON. The new config is validated first, using the same checks as nocleye check:

• If it has errors, nothing changes and the response is 400 with the list of errors.
• If it is valid, it becomes the live config and the response is 200. Requests already in progress finish with the config they started with.

Testing config

POST /api/v1/gateway/testing/config loads a config, validated like above, as a testing config next to the live one, and DELETE /api/v1/gateway/testing/config releases it. Only one testing config can be loaded at a time, loading a second returns 400.

Protecting the live config API

Set --sToken (or SUPPORT_TOKEN) and every call to /api/v1/gateway/* must send it as a bearer token, otherwise the response is 401:

curl -X POST http://127.0.0.1:8081/api/v1/gateway/config/swap \
  -H "Authorization: Bearer $SUPPORT_TOKEN" \
  -H "Content-Type: application/json" \
  --data @config.json

With no token set the live config API is open to anyone who can reach the support server. If you bind the support server to anything but loopback, always set a token, nocleye check warns about it. The token is never written to the logs. /healthz, /readyz and /metrics don’t use it.