Hanzo Gateway - API Gateway for Hanzo and Lux Networks

curl https://api.hanzo.ai/v1/chat/completions \
  -H "Authorization: Bearer hk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "zen4-pro",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

cd ~/work/hanzo/gateway

# Build
make build

# Run with hanzo config
./gateway run -c configs/hanzo/gateway.json

# Run with lux config
./gateway run -c configs/lux/gateway.json

# Validate all configs
make validate

# Run tests
make test

# compose.yml
services:
  gateway:
    image: ghcr.io/hanzoai/gateway:latest
    ports:
      - "8080:8080"
      - "9651:9651"
    volumes:
      - ./configs/hanzo/gateway.json:/etc/gateway/gateway.json:ro
    environment:
      AUTH_ENABLED: "true"
      AUTH_JWKS_URL: "https://hanzo.id/.well-known/jwks"
      ZAP_LISTENER_ENABLED: "false"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8080/__health"]
      interval: 10s
      timeout: 3s
      retries: 3
    restart: unless-stopped

# Deploy to hanzo cluster
make deploy-hanzo

# Deploy to lux cluster
make deploy-lux

# Deploy to both
make deploy

# Check status
make status

# Tail logs
make logs-hanzo
make logs-lux

                    Internet
                       |
              +--------+--------+
              |                 |
     Cloudflare (hanzo)   DO LB (lux)
              |                 |
     +--------+---------+  +---+----+
     | Hanzo Ingress    |  | Lux LB |
     | (L7 TLS/routing) |  |        |
     +--------+---------+  +---+----+
              |                 |
     +--------+---------+  +---+--------+
     | Hanzo Gateway    |  | Lux Gateway |
     | 133 endpoints    |  | 14 endpoints|
     +---+----+----+----+  +---+---+----+
         |    |    |            |   |
      Cloud  IAM  Commerce   Luxd  Luxd
      API         API       (main) (test)

Client --> api.hanzo.ai/v1/chat/completions
  |
  Auth middleware (JWT validate or API key passthrough)
  |
  Widget security (skip for non-hz_ tokens)
  |
  Host proxy (api.hanzo.ai matched, /v1/chat → cloud-api rewrite)
  |
  cloud-api.hanzo.svc.cluster.local:8000/api/chat/completions
  |
  Cloud API resolves model → provider (Fireworks, Together, etc.)
  |
  Streaming response back through gateway (no buffering)

{
  "version": 3,
  "name": "Hanzo API Gateway",
  "port": 8080,
  "timeout": "120s",
  "extra_config": {
    "router": { "return_error_msg": true },
    "qos/ratelimit/router": {
      "max_rate": 5000,
      "client_max_rate": 100,
      "strategy": "ip"
    },
    "telemetry/logging": {
      "level": "INFO",
      "prefix": "[GATEWAY]",
      "stdout": true
    }
  },
  "endpoints": [
    {
      "endpoint": "/v1/chat/completions",
      "method": "POST",
      "input_headers": ["*"],
      "output_encoding": "no-op",
      "backend": [{
        "url_pattern": "/api/chat/completions",
        "host": ["http://cloud-api.hanzo.svc.cluster.local:8000"],
        "encoding": "no-op"
      }]
    }
  ]
}

# Auth
AUTH_ENABLED=true              # Set false to disable all auth
AUTH_JWKS_URL=https://hanzo.id/.well-known/jwks
AUTH_ISSUER=https://hanzo.id
AUTH_PUBLIC_PATHS=/__health,/__stats,/.well-known/,/favicon
AUTH_PUBLIC_HOSTS=hanzo.id,lux.id,pars.id,id.bootno.de,id.zoo.network,iam.hanzo.ai
AUTH_REQUIRE=false             # Set true to reject unauthenticated requests

# Billing
AUTH_BILLING_URL=http://commerce.hanzo.svc.cluster.local:8001
COMMERCE_SERVICE_TOKEN=...     # S2S token for Commerce API
BILLING_ENABLED=true           # Set false to skip billing checks

# ZAP
ZAP_LISTENER_ENABLED=true
ZAP_LISTENER_PORT=9651
ZAP_TLS_CERT=/etc/tls/tls.crt
ZAP_TLS_KEY=/etc/tls/tls.key
ZAP_INTERNAL_ADDR=127.0.0.1:9652

"myapp.hanzo.ai": {{prefix: "/", target: mustURL("http://myapp.hanzo.svc.cluster.local:80")}},

"myapp.hanzo.ai": {
    {prefix: "/api", target: mustURL("http://myapp-api.hanzo.svc.cluster.local:8000")},
    {prefix: "/", target: mustURL("http://myapp-ui.hanzo.svc.cluster.local:80")},
},

configs/
  hanzo/
    gateway.json        # Hanzo API Gateway config (133 endpoints, 178KB)
    ingress.json        # Hanzo Ingress sidecar config
  lux/
    gateway.json        # Lux API Gateway config (14 endpoints)
k8s/
  hanzo/                # K8s manifests for hanzo-k8s cluster
    deployment.yaml     # 2 replicas, ports 8080+9651
    service.yaml        # ClusterIP
    ingress.yaml        # Ingress resource for api.hanzo.ai
  hanzo-ingress/        # K8s manifests for ingress sidecar
  lux/                  # K8s manifests for lux-k8s cluster
    deployment.yaml     # 2 replicas
    service.yaml        # LoadBalancer
cmd/
  gateway/              # Gateway binary entry point (main.go)
  gateway-integration/  # Integration test binary
  ingress/              # Ingress sidecar binary
tests/                  # Integration tests

# Core Go files (package gateway)
auth_middleware.go      # JWT validation, billing checks, header injection
auth_middleware_test.go # Auth middleware tests
widget_security.go      # Widget key rate limiting + origin validation
widget_security_test.go # Widget security tests
router_engine.go        # Host-based reverse proxy, gin engine setup
executor.go             # KrakenD executor (wires all components)
backend_factory.go      # Backend factory with CEL, Lua, metrics
handler_factory.go      # Handler factory with JOSE, rate limiting
proxy_factory.go        # Proxy factory with CEL, Lua, rate limiting
plugin.go               # Plugin loader (server, client, modifier)
encoding.go             # Custom encoding registration
zap_backend.go          # ZAP binary protocol backend transport
zap_listener.go         # TLS 1.3+PQ ZAP listener for external clients
sd.go                   # Service discovery registration