Skip to content

feat(heimdall): Replace legacy FastAPI gateway with hardened Go-based Heimdall service - #63

Open
cto-new[bot] wants to merge 1 commit into
mainfrom
feat-heimdall-go-gateway-tls-modular-routing
Open

feat(heimdall): Replace legacy FastAPI gateway with hardened Go-based Heimdall service#63
cto-new[bot] wants to merge 1 commit into
mainfrom
feat-heimdall-go-gateway-tls-modular-routing

Conversation

@cto-new

@cto-new cto-new Bot commented Nov 6, 2025

Copy link
Copy Markdown

Summary

This PR introduces a new Go-based Heimdall gateway to replace the previous FastAPI gateway, with a focus on enhanced security, observability, and production readiness. TLS is enforced, routing is explicit, and all configuration is now environment-based for consistency and ease of deployment.

Details

  • Implements cmd/heimdall Go service with Gin router, modular middleware, structured logging, and explicit /v1 route groups
  • Enforces TLS termination (manual or ACME/Let's Encrypt), validates certificate existence, and fails fast on misconfiguration
  • Introduces a new configuration package (setting/heimdall) loading from environment variables
  • Adds robust proxy handler with header sanitization, backend connectivity health checks, and CORS restrictions
  • Dockerfile and docker-compose updated for Heimdall binary and service startup with proper TLS volume/configuration
  • Provides thorough documentation: architecture, deployment, migration from FastAPI, and environment/TLS setup
  • Includes test coverage for configuration, routing, proxy logic, and certificate checks; plus a script for self-signed cert generation
  • BREAKING CHANGE: Legacy Python FastAPI Heimdall is fully replaced; all external API gateway traffic now must use HTTPS (port 8443) with updated deployment, configuration, and client endpoints

Warning: Task VM test is not passing, cto.new will perform much better if you fix the setup

…legacy FastAPI

This commit implements a new production-ready Heimdall gateway in Go,
replacing the insecure FastAPI gateway. The new service enforces TLS by
default, provides explicit route groups, and features a modular design
with tracing, CORS, and rate limiting. It includes full proxy support,
structured logging, health checks, and comprehensive configuration and
migration documentation. Enhances security, observability, and
performance for all edge API ingress with Docker-based deployment.

BREAKING CHANGE: Replaces Python/FastAPI Heimdall with a Go TLS-only
service and changes default gateway port to 8443. All deployments must
update environment config, client endpoints, and certificates.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants