Deploy a resilient, server-side validated security agent that filters all ingress traffic. Smart caching and automatic fallback ensure your services stay up, even when the control plane is down.
The CloFix Nano Agent is a lightweight, high-performance security proxy that protects any workload regardless of platform. Deploy it as a Kubernetes DaemonSet, sidecar container, standalone Docker container, systemd service, or integrate directly with your existing reverse proxy.
/metrics endpoint for real-time observability.
Native auth_request module. Sub-request authentication with <5ms overhead.
auth_request /clofix-auth;
mod_auth_request + mod_proxy. Full compatibility with Apache 2.4+.
AuthRequest "/clofix-auth"
ExternalAuth with DaemonSet. Prometheus metrics. Auto-scaling with HPA.
nginx.ingress.kubernetes.io/auth-url
AWS Load Balancer Controller. Target group routing with forward auth.
alb.ingress.kubernetes.io/auth-type: forward
ForwardAuth middleware. Native Kubernetes CRD support.
forwardAuth.address: http://clofix-agent:8080
EnvoyFilter with external auth. Service mesh integration.
CUSTOM action with ext_authz
Forward auth directive. Automatic HTTPS support.
forward_auth http://clofix-agent:8080
Lua-based external authentication. High-performance with <100µs overhead.
http-request lua.clofix-validate
Forever free for personal use, homelabs, learning environments, and non-commercial applications
Each protected domain costs $5/month. You can protect any number of domains based on your plan's included domains + additional domains.
Complete logging & auditing for payment card industry.
Data anonymization and privacy controls.
Audit trails for healthcare data.
Access controls and security monitoring.
Information security management certified.
{
"license_key": "CLOFIX-XXXX",
"plan": "enterprise",
"organization_name": "CloFix-Infotech",
"email": "support@clofix.com",
"allowed_domains": ["example.com", "api.example.com"],
"bypass_others": true
}┌─────────────────────────────────────────────────────────┐
│ Normal Operation (Server UP) │
│ Request → Agent → API Server → Validation → Allow/Block │
└─────────────────────────────────────────────────────────┘
⬇
┌─────────────────────────────────────────────────────────┐
│ Server DOWN (Automatic Fallback) │
│ Request → Agent → Cache → Bypass/Deny → Service Continues│
└─────────────────────────────────────────────────────────┘ ┌─────────────┐
│ Load │
│ Balancer │
└──────┬──────┘
│
┌───────────────┼───────────────┐
│ │ │
┌────▼────┐ ┌─────▼────┐ ┌─────▼────┐
│ Agent 1 │ │ Agent 2 │ │ Agent N │
└────┬────┘ └─────┬────┘ └─────┬────┘
└────────────────┼───────────────┘
│
┌───────▼───────┐
│ API Server │
└───────────────┘| Category | Benefit | Impact |
|---|---|---|
| Security | 99.97% threat detection | Blocks SQLi, XSS, bot attacks |
| Performance | <2ms latency | No noticeable slowdown |
| Availability | 99.99% SLA | Smart fallback when server down |
| Cost | 70-80% reduction | Lower than traditional WAF |
| Pricing | $5/domain | Pay only for what you protect |
# Deploy agent as DaemonSet kubectl apply -f https://clofix.com/k8s/clofix-agent-daemonset.yaml # Configure ingress with auth-url kubectl annotate ingress my-app \ nginx.ingress.kubernetes.io/auth-url="http://clofix-agent:8080/validate"
Achieve complete observability into your CloFix Nano Agent deployment. The pre-built Grafana dashboard delivers real-time visualization of all agent metrics including request throughput, latency distribution, cache hit ratios, security violation patterns, DDoS protection events, license consumption, and API server connectivity status.
Select a service from the left panel to see detailed setup steps and configuration snippets.
upstream clofix_agent { server 127.0.0.1:8080; }\nserver {\n location = /clofix-auth { internal; proxy_pass http://clofix_agent/validate; }\n location / { auth_request /clofix-auth; proxy_pass http://backend; }\n}| Feature | Description |
|---|---|
Server-side validation | Agent forwards request to central API for decision |
Smart caching | 90% cache hit rate, configurable TTL |
Domain filtering | Only configured domains are validated |
Per-domain pricing | $5 per domain – pay only for what you protect |
Fallback modes | bypass / cache_only / deny when server down |
Prometheus metrics | Request counts, latency, cache hit ratio |
# DaemonSet (K8s) kubectl apply -f https://clofix.com/k8s/agent-daemonset.yaml # Docker docker run -d --name clofix-agent -p 8080:8080 clofix/agent:latest # Binary ./clofix-agent --license=YOUR_KEY --api=http://api.clofix.com:8081