First scenarios

Task-oriented entry points for common operator goals. Each scenario names the config blocks and guide pages you need and points at a minimal shape to start from. Read Concepts and taxonomy first if the vocabulary is new.

For runnable, end-to-end demonstrations of these scenarios in Docker, see the OSS quickstart demo (single gateway, every OSS feature) and the Enterprise quickstart demo (CP/DP split fleet).

Protect a public API

Goal: expose an internal service to the internet with rate limiting, attack filtering, and JWT authentication.

What you need:

• A listener with TLS termination.
• A route matching the public path, proxying to the internal service.
• A policy with rate_limits (GCRA, stacked windows) and a waf block for SQLi/XSS/traversal filtering.
• A consumer with a JWT/JWKS credential.
• An authorization rule restricting access to the consumer or group.

Guides: Traffic policy, WAF-lite, Security, Authorization.

Proxy to LLM providers

Goal: expose one OpenAI-shaped chat-completions endpoint that translates to OpenAI, Anthropic, or Gemini, with token budgets and guardrails.

What you need:

• An ai block with one or more providers (OpenAI, Anthropic, Gemini, or OpenAI-compatible).
• A model alias mapping the client's model value to a provider and provider-side model id.
• A route with the ai action pointing at the alias.
• A token budget policy for per-consumer caps.
• Optional guardrails for prompt-injection, PII, and banned-content enforcement.

Guides: AI gateway, Token budgets, Guardrails, Semantic caching.

Migrate from NGINX, Kong, or Envoy

Goal: import an existing gateway config and diff it against a native Dwara config before cutover.

What you need:

• The config import tool: dwara import reads NGINX, Kong, or Envoy config and emits a Dwara YAML draft.
• dwara diff to compare the imported draft against your hand-tuned config.
• dwara validate and dwara lint to check the result.

Guides: Config import, CLI.

Run on Kubernetes

Goal: translate Kubernetes Gateway API and Ingress resources into Dwara config and run the controller beside your cluster.

What you need:

• The Kubernetes Gateway API translator, which reads Gateway, HTTPRoute, and Ingress resources.
• The controller running as a cluster workload, pushing config generations to the gateway.

Guides: Kubernetes Gateway API, Deployment.

Operate a fleet

Goal: coordinate many gateway instances as one system -- shared rate-limit budgets, config that converges, a control plane pushing generations to edges.

What you need (enterprise edition):

• CP/DP split: a leader-elected dwara-controller compiling config and pushing it to dwara-edge instances over gRPC.
• Distributed rate limiting: shared Redis GCRA buckets.
• Config convergence: fleet-wide consistent config state.
• Workspaces: multi-tenant config partitioning with RBAC and an audit trail.

Guides: Enterprise and fleet, Editions.

Add a custom rate-limit backend

Goal: replace the local GCRA rate limiter with a custom or distributed backend.

What you need:

• An implementation of the RateLimiter extension trait; see Extension traits.
• The enterprise Redis-backed implementation is available with the ent feature and a redis_rate_limiter license claim; see Distributed Redis rate limiter.

Guides: Extension traits, Redis rate limiter.

Where to go next

• Getting started - run a gateway locally in under a minute.
• Configuration - the YAML shape and the config pipeline.
• Concepts and taxonomy - the vocabulary every other guide assumes.