@solinkify/gate-proxy

Solinkify Gate reverse proxy — protect any website (PHP/WordPress without a plugin, Ruby, legacy Python, static sites, old CMSes) with the x402-aligned HTTP 402 AI paywall, without touching its code. The decision pipeline is the real @solinkify/gate core (x402-aligned manifest, tiered pricing, bot IP verification, freemium, anti-replay via the backend).

Three modes, one binary:

| Mode | How | Best for | |---|---|---| | Standalone proxy | gate-proxy in front of your upstream | simple VPS, Docker, sites without nginx | | Nginx auth_request | nginx keeps serving; the gate only decides allow/deny | existing nginx setups | | Caddy forward_auth | same, Caddy flavor | Caddy setups |

Install & run

npm i -g @solinkify/gate-proxy

# via config file
solinkify-gate-proxy --config gate.config.json

# or via env
SOLINKIFY_WALLET=<CREATOR_WALLET> SOLINKIFY_PRICE=0.001 \
SOLINKIFY_ENDPOINT_ID=my-site SOLINKIFY_UPSTREAM=http://127.0.0.1:8080 \
solinkify-gate-proxy

gate.config.json accepts EVERY GateConfig field (@solinkify/gate) plus upstream, port (default 8402), host (default 127.0.0.1):

{
  "wallet": "<CREATOR_WALLET>",
  "price": 0.001,
  "endpointId": "my-site",
  "upstream": "http://127.0.0.1:8080",
  "tiers": [{ "pattern": "/premium/*", "endpointId": "premium", "price": 0.01 }]
}

Standalone mode

Point your DNS/load-balancer at gate-proxy; it transparently proxies to upstream. AI scrapers → 402 + manifest; humans & search engines → forwarded; paying, verified agents are forwarded with the X-Solinkify-Verified: true header (your upstream can trust it). /.well-known/solinkify is served automatically.

Nginx mode (examples/nginx.conf)

Run gate-proxy WITHOUT an upstream (pure auth endpoint). nginx calls /_solinkify/auth-nginx per request (204 allow / 403 deny), then error_page 403 serves the 402 manifest from /_solinkify/manifest.

Caddy mode (examples/Caddyfile)

forward_auth to /_solinkify/auth — non-2xx responses (402 + manifest) are copied by Caddy straight to the client.

Control endpoints

| Path | Purpose | |---|---| | /_solinkify/health | Health check | | /_solinkify/auth | Auth subrequest (Caddy): 204 / 402+manifest | | /_solinkify/auth-nginx | Auth subrequest (nginx): 204 / 403 | | /_solinkify/manifest | 402 manifest for X-Original-URI (error_page target) | | /_solinkify/discovery | /.well-known/solinkify discovery document |

Security notes

• Default bind is 127.0.0.1 — don't expose the control endpoints publicly.
• Payment verification, endpoint+amount binding, and anti-replay are enforced by the Solinkify backend, not in the proxy.
• Fail-open: if gate-proxy itself errors, the request is forwarded to the upstream (site availability beats one leaked request).

License

MIT © Solinkify