A fresh install should be predictable: a demo can be handed over without
reading a password off a terminal, and the documented quickstart and the
one-liner installer now agree on the same value rather than diverging the
moment the installer generated a random one.
The trade is deliberate and worth naming. This hub provisions hardware and
runs commands as root on every node it manages, and this file publishes 80
and 443 — so a known default is fine on a laptop or a lab network and is not
fine on anything reachable. The installer now says so in its closing output,
where it will actually be read, rather than only in the docs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UC1bwEPiq5ytX7VXap8cDK
The installer asks about a dozen settings and there was nowhere to read what
any of them mean. docs/configuration.md documents every one — installer
prompts, hub environment variables and ports — with defaults, what breaks if
the value is wrong, and worked examples. The installer now links to it, both
before the first question and after the install finishes.
The compose file also shipped AGENT_HOST, which the hub renamed to
HUB_EXTERNAL_HOST: still honoured, but it logs a deprecation on every boot, so
the file everyone copies was teaching the old name and guaranteeing the warning.
Both names are documented; the installer writes whichever key the compose file
actually contains, so an older file or a pinned fork keeps working.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UC1bwEPiq5ytX7VXap8cDK
Committed by accident in the previous commit via 'git add -A'. macOS writes
these into every directory it browses; they have no business in a repo that
strangers clone.
The README was written when Aegis was a monitoring and gateway tool, and it has
been describing that product for three months while the thing itself grew into a
platform. The headline still read "Self-hosted Envoy gateway · AI threat
analysis · TLS automation · Real-time dashboard" — all true, all now one
subsystem of several, and none of it the reason someone would choose this.
README now leads with what it is: one control plane from the bare metal up,
air-gapped by default, with the customer's model weights staying on the
customer's storage. The gateway keeps its place; it just stops being the whole
story. A note records the scope change rather than pretending the old framing
never existed.
ROADMAP is rewritten, not amended. It listed a container manager, a Docker
registry, an embedded DNS server and AI-driven deployment orchestration as
future phases — all four shipped. A roadmap that describes delivered features as
upcoming undersells the product to exactly the reader who bothered to open it.
It is now built / next / then, matching the private status doc so the two cannot
drift.
CHANGELOG gains 1.3, covering three months: bare-metal provisioning, the
Kubernetes lifecycle with air-gapped installs validated live, Depot with
pluggable storage backends and reference-only artifacts, GPU-aware workloads,
Owl's risk-classified tool surface, and the auth middleware rewrite that
replaced a method-blind public-route match.
FIXED A BROKEN QUICKSTART, which is the part that mattered most. The published
docker-compose.yml exposes only 8765, while agents dial in on 8766 and the
overlay needs 3478/udp and 51820/udp. Anyone following the new one-line
enrolment instructions would have watched the installer succeed and the node
never appear. Both ports are now published with comments explaining when they
are needed, and AGENT_HOST is present with a note that it must be set to
something the nodes can actually resolve before enrolling any.
Every internal link in README and ROADMAP verified to resolve; compose file
validated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B9dzsPuPpFbdgCuUDgsG8L
- Add step-by-step GIFs for all 7 tutorial steps
- Update Step 5 to show both UI download and curl options for CA cert
- Assets in docs/assets/
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rename aegis-gateway back to aegis — envoy.yaml connects to hostname
'aegis', renaming broke xDS entirely (Envoy got zero dynamic config)
- Add DNS Lookup Family V4_ONLY to tutorial cluster step — host.docker.internal
resolves IPv6-first on Mac/Docker Desktop, causing connection failures
to IPv4-only containers
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Runs whoami independently with a published port (8081:80) instead of
adding it to the Aegis docker-compose.yml. Envoy reaches it via
host.docker.internal:8081 — matches real-world usage where services
are not in the same Docker network as the gateway.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
No override file, no separate directory needed. User already has aegis
+ envoy running from getting-started — whoami just joins the same
Compose network by being in the same file.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
cat >> appended after the volumes: block, producing invalid YAML.
Override file is the correct pattern — Docker merges it automatically
without touching the original docker-compose.yml.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Getting started now covers only bootstrap (download → set password → start).
Configuration (clusters, TLS, filter chains) is deferred to the tutorial
and envoy-config.md so the onboarding path stays linear.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove starter.json (no longer needed — gateway auto-bootstraps on first boot)
- Add envoy/envoy.yaml static bootstrap config
- Fix docker-compose.yml to use envoy.yaml instead of starter.json
- Update README: fix quick start flow, add Local CA section, add tutorial link
- Rewrite getting-started.md: auto-bootstrap, Local CA, bring-your-own-CA
- Update envoy-config.md: replace import section with auto-bootstrap explanation
- Add docs/tutorial-whoami-local-https.md: end-to-end local HTTPS with whoami
- Add configs/README.md: clarify configs dir purpose
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Trimmed each clip to 12-20s highlight, converted to 10fps 800px GIF.
Mobile clip converted to 400px GIF (5.5s full clip).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
7 MP4 demos covering dashboard, Owl AI chat, IP intelligence, gateway
topology, TLS automation, AI patrol, and mobile Owl interaction.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Self-hosted Envoy gateway with AI threat analysis, TLS automation,
and real-time security dashboard.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Jerry Xie