Sentinel

API gateway written from scratch in Go. Standard library, a handful of dependencies, no frameworks.

• Reverse proxy with path and host routing, prefix stripping, header injection, X-Forwarded-* headers
• JWT authentication (HS256, RS256), JWKS key discovery with rotation on cache miss, alg:none rejected
• API key auth with SHA-256 hashed storage, constant-time comparison via crypto/subtle
• Role-based access control from JWT claims, claim-to-header injection for upstreams
• Token bucket rate limiter with lazy refill, pluggable key extraction (IP, API key, user ID)
• Redis rate limiter using atomic Lua scripts, automatic fallback to local limiter when Redis is down
• Circuit breaker (Closed/Open/Half-Open) with ring buffer sliding window, per-service isolation
• Weighted round-robin (Nginx-style) and consistent hashing with 150 virtual nodes
• Active health checks with consecutive-failure thresholds and automatic backend removal/recovery
• Retry with exponential backoff and full jitter, idempotency-key awareness for safe POST retries
• OpenTelemetry tracing (W3C propagation), Prometheus metrics (RED method), structured JSON logging
• SIGHUP hot reload via sync/atomic.Value, invalid configs are rejected gracefully

make build
./bin/sentinel -config configs/sentinel.yaml

Full stack with Redis, Jaeger, and Prometheus:

cd deployments && docker compose up -d

• Gateway: http://localhost:8080
• Jaeger UI: http://localhost:16686
• Prometheus: http://localhost:9090
• Metrics: http://localhost:8080/metrics
• Health: http://localhost:8080/healthz

cmd/sentinel/              entrypoint, wiring
internal/
├── config/                YAML loading, validation, SIGHUP reload
├── proxy/                 reverse proxy, routing, director
├── middleware/
│   ├── auth/              JWT (HS256, RS256, JWKS), API keys, RBAC
│   ├── ratelimit/         token bucket, Redis Lua, fallback, middleware
│   └── circuitbreaker/    state machine, registry, Prometheus metrics
├── loadbalancer/          round-robin, consistent hashing, health checks
├── retry/                 backoff, jitter, idempotency
└── observability/         OTel tracing, Prometheus metrics, middleware
configs/                   example YAML
deployments/               docker-compose, Prometheus config

See configs/sentinel.yaml. Reload at runtime with kill -HUP <pid>.

MIT