DigitalFrontier GatewayPreview

Public gateways, described once and shipped to every region

Define how your services reach the internet in one declarative file — per-port routing, edge policy, governed egress and automatic TLS across every region.

Request early access→See the technology

deploy.sh

bash

# Static-validate the spec (schema + placement rules)
core validate gateway.yaml

# See the full plan and a cost estimate — nothing is provisioned yet
core plan gateway.yaml
core cost gateway.yaml

# Apply it
core apply gateway.yaml

# Check status of the running gateway
core status gateway.yaml

Describe your gateway once

A single declarative file defines the workload, the regions it runs in, per-port routing and TLS. One CLI validates the spec, shows the full plan and a cost estimate before anything is provisioned, then applies it — no separate tooling to stitch together.

core validate gateway.yaml
core plan gateway.yaml && core cost gateway.yaml
core apply gateway.yaml

Per-port edge policy

Attach path prefixing and rewrites, rate limiting, response caching, a managed web application firewall and custom request/response header injection to each exposed port — declared inline with the service and enforced at the gateway.

public_gateway:
  path_prefix: /api
  rate_limit:
    requests_per_second: 1000
  waf: { enabled: true, mode: strict }

Governed egress

Lock down outbound traffic with a default-deny posture: pin egress through a named NAT pool, restrict it to the deployment country, allow or deny specific ports, and verify egress before and after the fact with the option to block on any violation.

egress:
  nat_pool: eu-central
  lock_country: true
  default_policy: deny

TLS terminated at the edge

Serve HTTPS with automatically issued certificates and redirect plain HTTP to HTTPS, so the services behind the gateway never manage certificates themselves.

expose:
  - port: 8080
    protocol: https   # gateway terminates TLS

Multi-region ingress

Enable the gateway per region, each with a configurable health-check path and a platform-managed static IP, so every region you deploy to gets a stable public entry point described in the same manifest.

public_gateway:
  enabled: true
  static_ip: auto
  health_check_path: /healthz

Optional voice add-on

Bring SIP signalling and RTP media behind the same gateway with encrypted signalling, optional SRTP media encryption, replicated call state for mid-call failover, SIP-aware autoscaling and built-in anti-fraud controls like rate limits and premium-rate or geo blocking. Preview.

Get early access to Gateway.

Tell us about your workload and we'll get you into the preview.

Request early access→All products