Docs · Wardris Gate

Getting started

Run it

One command, no external database required — the image ships its own MongoDB for trying it out:

docker run -d -p 8080:8080 \
  -e GATEWAY_ADMIN_USERNAME=admin \
  -e GATEWAY_ADMIN_PASSWORD=changeme \
  ghcr.io/wardris/gate

Open http://localhost:8080 and sign in with the admin username/password you set above. That's the whole quickstart — you're on the free Community tier with no license key needed.

Add a license key

Set LICENSE_KEY to unlock a paid tier. Get a key from the Portal once you've picked a plan.

docker run -d -p 8080:8080 \
  -e GATEWAY_ADMIN_USERNAME=admin \
  -e GATEWAY_ADMIN_PASSWORD=changeme \
  -e LICENSE_KEY=WARD-XXXX-XXXX-XXXX-XXXX \
  ghcr.io/wardris/gate

Gate validates the key against the Wardris License Server on startup and every 6 hours. If it's briefly unreachable, Gate keeps running at your last validated tier for 7 days before falling back to Community — a network blip won't downgrade a running gateway.

Environment variables

Variable	Default	What it does
GATEWAY_ADMIN_USERNAME	—	Bootstraps the first admin account on first boot.
GATEWAY_ADMIN_PASSWORD	—	Password for that first admin account.
LICENSE_KEY	unset (Community tier)	Unlocks your licensed tier — validated live against the license server.
LICENSE_TOKEN	unset	For fully air-gapped deployments — a long-lived signed token instead of a live key, verified locally with no network call. Ask us for one.
LICENSE_SERVER_URL	https://portal.wardris.com	Only change this if we ever tell you to.
MONGODB_URI	bundled MongoDB	Point at your own MongoDB instead of the one baked into the image — see "Production setup" below.
GATEWAY_CORS_ALLOWED_ORIGINS	—	Comma-separated origins allowed to call the API cross-origin.
GATEWAY_RATE_LIMIT_BACKEND	in-memory	Set to redis for Enterprise HA/multi-instance rate limiting (needs ha on your license).
GATEWAY_TRAFFIC_LOG_RETENTION_DAYS	7	How long entries in the gateway traffic log (Audit Log → Traffic, Professional+) are kept before Mongo expires them. Change and restart - no migration.
GATEWAY_TRAFFIC_LOG_MAX_BODY_BYTES	8192	Cap for each stored request/response body on routes with body capture enabled (Business+). Secret-bearing fields are always redacted; larger payloads are truncated.
WARDRIS_TLS_CERT / WARDRIS_TLS_KEY	self-signed, generated on first boot	Bring your own certificate for the built-in TLS listener on :8443. Most deployments terminate TLS at a load balancer instead and can ignore this.

Production setup

The all-in-one image above is a trial/quickstart packaging — everything (MongoDB included) in one container. For a real deployment, run a proper external MongoDB and point MONGODB_URI at it, so your data survives a container restart or redeploy independently of the app. Business+ tiers can also run multiple Gate instances behind a shared Redis (GATEWAY_RATE_LIMIT_BACKEND=redis) for HA — see your license's feature list in the Portal.

What Gate does with the license key

The key is validated, never your traffic or data. Gate never sends request/response bodies, downstream service details, or anything about what passes through it back to Wardris — the only outbound call is the periodic license check itself.

Need help?

Questions or something not working as documented: info@wardris.com.