@solinkify/gate-proxy

@solinkify/gate-proxy

Solinkify Gate reverse proxy — protect any website (PHP/WordPress without a plugin, Ruby, legacy Python, static sites, old CMSes) with the x402-aligned HTTP 402 AI paywall, without touching its code. The decision pipeline is the real @solinkify/gate core (x402-aligned manifest, tiered pricing, bot IP verification, freemium, anti-replay via the backend).

Three modes, one binary:

Mode	How	Best for
Standalone proxy	gate-proxy in front of your upstream	simple VPS, Docker, sites without nginx
Nginx auth_request	nginx keeps serving; the gate only decides allow/deny	existing nginx setups
Caddy forward_auth	same, Caddy flavor	Caddy setups

Install & run

npm i -g @solinkify/gate-proxy

# via config file
solinkify-gate-proxy --config gate.config.json

# or via env
SOLINKIFY_WALLET=<CREATOR_WALLET> SOLINKIFY_PRICE=0.001 \
SOLINKIFY_ENDPOINT_ID=my-site SOLINKIFY_UPSTREAM=http://127.0.0.1:8080 \
solinkify-gate-proxy

gate.config.json accepts EVERY GateConfig field (@solinkify/gate) plus upstream, port (default 8402), host (default 127.0.0.1):

{
  "wallet": "<CREATOR_WALLET>",
  "price": 0.001,
  "endpointId": "my-site",
  "upstream": "http://127.0.0.1:8080",
  "tiers": [{ "pattern": "/premium/*", "endpointId": "premium", "price": 0.01 }]
}

Standalone mode

Point your DNS/load-balancer at gate-proxy; it transparently proxies to upstream. AI scrapers → 402 + manifest; humans & search engines → forwarded; paying, verified agents are forwarded with the X-Solinkify-Verified: true header (your upstream can trust it). /.well-known/solinkify is served automatically.

Nginx mode (examples/nginx.conf)

Run gate-proxy WITHOUT an upstream (pure auth endpoint). nginx calls /_solinkify/auth-nginx per request (204 allow / 403 deny), then error_page 403 serves the 402 manifest from /_solinkify/manifest.

Caddy mode (examples/Caddyfile)

forward_auth to /_solinkify/auth — non-2xx responses (402 + manifest) are copied by Caddy straight to the client.

Control endpoints

Path	Purpose
/_solinkify/health	Health check
/_solinkify/auth	Auth subrequest (Caddy): 204 / 402+manifest
/_solinkify/auth-nginx	Auth subrequest (nginx): 204 / 403
/_solinkify/manifest	402 manifest for X-Original-URI (error_page target)
/_solinkify/discovery	/.well-known/solinkify discovery document

Security notes

• Default bind is 127.0.0.1 — don't expose the control endpoints publicly.
• Payment verification, endpoint+amount binding, and anti-replay are enforced by the Solinkify backend, not in the proxy.
• Fail-open: if gate-proxy itself errors, the request is forwarded to the upstream (site availability beats one leaked request).

License

MIT Solinkify