This service is meant to serve as a proxy for a subset of functionalities of defguard core which require public access. It provides a public REST API and communicates with core over gRPC.

To learn more about the system see our documentation.

Quick start

If you already have your defguard instance running you can set up a proxy by following our deployment guide.

Documentation

See the documentation for more information.

Community and Support

Find us on Matrix: #defguard:teonite.com

Contribution

Please review the Contributing guide for information on how to get started contributing to the project. You might also find our environment setup guide handy.

Development

Clone repository:

[email protected]:DefGuard/client.git

Initialize proto submodule:

git submodule update --init --recursive

To run API server:

cargo run

To run webapp dev server:

cd web/
pnpm install
pnpm run dev

Verifiability of releases

We provide following ways to verify the authenticity and integrity of official releases:

Docker Image Verification with Cosign

All official Docker images are signed using Cosign. To verify a Docker image:

1. Install cosign CLI

2. Verify the image signature (replace <IMAGE_TAG> with the tag you want to verify):

   cosign verify --certificate-identity-regexp="https://github.com/DefGuard/proxy" \
     --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
     ghcr.io/defguard/defguard:<IMAGE_TAG>

Release Asset Verification

All release assets (binaries, packages, etc.) include SHA256 checksums that are automatically generated and published with each GitHub release:

1. Download the release asset and copy its corresponding checksum from the releases page

2. Verify the checksum:

   # Linux/macOS
   echo known_sha256_checksum_of_the_file path/to/file | sha256sum --check