Skip to main content

API Gateway

api-gateway (VMID 117, 10.0.0.17) routes and authenticates requests to the synthesis, recognition, and Fotheidil backends on behalf of public API consumers.

Configured by ansible/hetzner-main/setup-api-gateway.yml, with non-secret upstream configuration in ansible/hetzner-main/vars/api-gateway.yml.

What's running​

A Docker Compose stack:

  • api-gateway — the main gateway/proxy service, routing to Supabase, the synthesis API, the recognition API (on Amergin), and Fotheidil.
  • api-authentication — a separate internal auth service the gateway calls out to.
  • api-gateway-docs — a Next.js docs site for the gateway's public API.
  • redis — internal cache, not exposed outside the stack's own Docker network.

Configuration (in vars/api-gateway.yml) includes per-backend upstream URLs, a configurable rate limiter and daily anonymous-IP credit limit, and a circuit breaker flag (currently disabled).

Grafana Alloy tails the gateway's log file and scrapes both app services' /metrics endpoints, shipping both to observability.

Firewall​

Only the webserver VM may reach the gateway's ports; everything else is denied inbound by default.