Deploy a resilient, server-side validated security agent that filters all ingress traffic. Smart caching and automatic fallback ensure your services stay up, even when the control plane is down.
The CloFix Agent is a lightweight, high-performance security proxy that runs inside your Kubernetes cluster as a DaemonSet. It intercepts all incoming traffic and validates each request against a central CloFix API Server.
Native auth_request module. Sub-request authentication with <5ms overhead.
auth_request /clofix-auth;
mod_auth_request + mod_proxy. Full compatibility with Apache 2.4+.
AuthRequest "/clofix-auth"
ExternalAuth with DaemonSet. Prometheus metrics. Auto-scaling with HPA.
nginx.ingress.kubernetes.io/auth-url
AWS Load Balancer Controller. Target group routing with forward auth.
alb.ingress.kubernetes.io/auth-type: forward
ForwardAuth middleware. Native Kubernetes CRD support.
forwardAuth.address: http://clofix-agent:8080
EnvoyFilter with external auth. Service mesh integration.
CUSTOM action with ext_authz
Forward auth directive. Automatic HTTPS support.
forward_auth http://clofix-agent:8080
Lua-based external authentication. High-performance with <100µs overhead.
http-request lua.clofix-validate
Forever free for open source projects, homelabs, and learning
Each protected domain costs $5/month. You can protect any number of domains based on your plan's included domains + additional domains.
Complete logging & auditing for payment card industry.
Data anonymization and privacy controls.
Audit trails for healthcare data.
Access controls and security monitoring.
Information security management certified.
{"license_key": "CLOFIX-XXXX", "allowed_domains": ["example.com", "api.example.com"], "bypass_others": true}┌─────────────────────────────────────────────────────────┐
│ Normal Operation (Server UP) │
│ Request → Agent → API Server → Validation → Allow/Block │
└─────────────────────────────────────────────────────────┘
⬇
┌─────────────────────────────────────────────────────────┐
│ Server DOWN (Automatic Fallback) │
│ Request → Agent → Cache → Bypass/Deny → Service Continues│
└─────────────────────────────────────────────────────────┘ ┌─────────────┐
│ Load │
│ Balancer │
└──────┬──────┘
│
┌───────────────┼───────────────┐
│ │ │
┌────▼────┐ ┌─────▼────┐ ┌─────▼────┐
│ Agent 1 │ │ Agent 2 │ │ Agent N │
└────┬────┘ └─────┬────┘ └─────┬────┘
└────────────────┼───────────────┘
│
┌───────▼───────┐
│ API Server │
└───────────────┘| Category | Benefit | Impact |
|---|---|---|
| Security | 99.97% threat detection | Blocks SQLi, XSS, bot attacks |
| Performance | <2ms latency | No noticeable slowdown |
| Availability | 99.99% SLA | Smart fallback when server down |
| Cost | 70-80% reduction | Lower than traditional WAF |
| Pricing | $5/domain | Pay only for what you protect |
# Deploy agent as DaemonSet kubectl apply -f https://clofix.com/k8s/clofix-agent-daemonset.yaml # Configure ingress with auth-url kubectl annotate ingress my-app \ nginx.ingress.kubernetes.io/auth-url="http://clofix-agent:8080/validate"
Select a service from the left panel to see detailed setup steps and configuration snippets.
upstream clofix_agent { server 127.0.0.1:8080; }\nserver {\n location = /clofix-auth { internal; proxy_pass http://clofix_agent/validate; }\n location / { auth_request /clofix-auth; proxy_pass http://backend; }\n}| Feature | Description |
|---|---|
Server-side validation | Agent forwards request to central API for decision |
Smart caching | 90% cache hit rate, configurable TTL |
Domain filtering | Only configured domains are validated |
Per-domain pricing | $5 per domain – pay only for what you protect |
Fallback modes | bypass / cache_only / deny when server down |
Prometheus metrics | Request counts, latency, cache hit ratio |
# DaemonSet (K8s) kubectl apply -f https://clofix.com/k8s/agent-daemonset.yaml # Docker docker run -d --name clofix-agent -p 8080:8080 clofix/agent:latest # Binary ./clofix-agent --license=YOUR_KEY --api=http://api.clofix.com:8081