# openalice-gateway

> API gateway — auth enforcement, rate limiting, circuit breaking, and HTTP/WS reverse proxy for the OpenAlice microservice ecosystem.

## At a glance
| field | value |
|---|---|
| kind | `infrastructure` |
| priority | `P4` |
| default branch | `mvp` |
| last activity | 2026-06-15T18:59:11+00:00 |
| features catalogued | **5** |
| runtime deps declared | **9** |

## Manifest
`.atlas-deps.yml` — parsed cleanly: **yes**

### Runtime deps
- **`openalice-auth`** · `http` · via `GATEWAY_URL_AUTH` — Validate API keys by calling /auth/me on the auth service (fail-closed)
- **`openalice`** · `http` · via `GATEWAY_URL_ALICE` · _optional_ — Proxy /alice/* requests to the main OpenAlice service (120s timeout for LLM calls)
- **`openalice-a2a`** · `http` · via `GATEWAY_URL_A2A` · _optional_ — Proxy /a2a/* requests to the agent-to-agent service
- **`openalice-ml-gateway`** · `http` · via `GATEWAY_URL_ML` · _optional_ — Proxy /ml/* requests to the ML gateway
- **`openalice-persona`** · `http` · via `GATEWAY_URL_PERSONA` · _optional_ — Proxy /persona/* HTTP and /ws/persona WebSocket requests to the persona backend
- **`openalice-registry`** · `http` · via `GATEWAY_URL_REGISTRY` · _optional_ — Proxy /registry/* requests to the agent registry
- **`openalice-rt`** · `ws` · via `GATEWAY_URL_RT` · _optional_ — Proxy /rt/* HTTP and /ws/rt WebSocket requests to the realtime backend
- **`openalice-social-api`** · `http` · via `GATEWAY_URL_SOCIAL` · _optional_ — Proxy /social/* requests to the social API backend
- **`openalice-voice`** · `http` · via `GATEWAY_URL_VOICE` · _optional_ — Proxy /voice/* HTTP and /ws/voice WebSocket requests to the voice backend

### Consumed env
- `SHARED_JWT_SECRET`
- `GATEWAY_JWT_SECRET`
- `GATEWAY_PORT`
- `GATEWAY_BIND`
- `GATEWAY_RATE_LIMIT`
- `GATEWAY_ANON_RATE_LIMIT`
- `GATEWAY_URL_AUTH`
- `GATEWAY_URL_SOCIAL`
- `GATEWAY_URL_VOICE`
- `GATEWAY_URL_RT`
- `GATEWAY_URL_PERSONA`
- `GATEWAY_URL_A2A`
- `GATEWAY_URL_ML`
- `GATEWAY_URL_ALICE`
- `GATEWAY_URL_REGISTRY`

### Exposes
- `docker_image` — openalice-gateway
- `http_endpoint` — https://alice.blal.pro/api/*

## Env drift

**Manifest declares, code unused (5):**
- `GATEWAY_URL_A2A`
- `GATEWAY_URL_ALICE`
- `GATEWAY_URL_ML`
- `GATEWAY_URL_REGISTRY`
- `GATEWAY_URL_SOCIAL`

## Live reachability
- last probe: **down** · `https://alice.blal.pro` · HTTP 401 · 63ms
- uptime 24h: **0.0%**

## Features (5)

### gateway/auth
- **`gateway.auth.middleware`** · _stable_ · since 0.1.0 — Authenticate via JWT > session > API key, fall through to anonymous; exempt paths bypass.  
  *src/auth.rs:39*

### gateway/proxy
- **`gateway.proxy.forward`** · _stable_ · since 0.1.0 — HTTP reverse proxy with auth, rate-limit, circuit breaker, and prefix-stripped backend forward.  
  *src/proxy.rs:16*
- **`gateway.proxy.ws`** · _stable_ · since 0.1.0 — Bidirectional WebSocket proxies for /ws/rt, /ws/voice, /ws/persona — bridge browser to internal services.  
  *src/ws_proxy.rs:15*

### gateway/ratelimit
- **`gateway.ratelimit.token-bucket`** · _stable_ · since 0.1.0 — Per-user token-bucket rate limiter (separate user/anon caps) using DashMap.  
  *src/ratelimit.rs:5*

### gateway/resilience
- **`gateway.circuit.breaker`** · _stable_ · since 0.1.0 — Per-backend circuit breaker (Closed/Open/HalfOpen) — short-circuit failing services with 503.  
  *src/circuit_breaker.rs:8*

---

*Generated by [openalice-atlas](https://atlas.blal.pro) — single source of truth for the openalicelabs ecosystem.*