Nginx and OpenResty

Before you start

A firewall integration enforces the signed policy bundle of your site in front of your origin: block, redirect, challenge and token-gated routes. It fetches the bundle from GET /v1/policies/<site key>, verifies its signature offline and decides every request the same way in every language. It does not replace verifying tokens in your own code. A request that reaches your origin another way (a direct IP, another hostname, a path the integration was not installed on) is never evaluated, so let only the integration reach the origin. See firewall policies.

The secret key (rgsk_...) is needed only for requireToken rules. Without it such a rule applies its onError setting.

Install and mount

A Lua port of the core for access_by_lua, tested against the shared policy vectors. Copy lib/resty/revokegpt/ onto lua_package_path; it needs lua-resty-openssl (Ed25519) and lua-resty-http. configure raises on a bad configuration, so calling it from init_by_lua stops nginx from starting. Use proxy_pass without a URI part so the raw target is forwarded unchanged.

nginx.conf

lua_shared_dict rg_bundle 1m;
init_by_lua_block        { rg = require("resty.revokegpt"); rg.configure({ site_key = "rgpk_...", secret_key = "rgsk_..." }) }
init_worker_by_lua_block { rg.init_worker() }
location / {
    access_by_lua_block        { rg.access() }
    header_filter_by_lua_block { rg.header_filter() }
    proxy_pass http://origin;            # no URI part: the raw target is forwarded unchanged
    proxy_set_header Host $http_host;
}

Not published yet

This integration package is built and tested in the repository but not published to its registry yet. Install it from a checkout until the first release.

Keep routing case-sensitive

Firewall rules match paths case-sensitively, so /ADMIN is not /admin. If your origin routes case-insensitively (IIS, a case-folding proxy or framework), /ADMIN can reach the /admin handler while a rule on /admin never sees it. Make the origin case-sensitive, or write a rule for each spelling it serves.