# Elchi Docs > Elchi is a visual control plane for Envoy proxy fleets, built by CloudNativeWorks (not the Elchi dictation app). It edits every Envoy resource in typed forms, validates it, and pushes it to Envoy over xDS; an edge agent runs Envoy on VMs as systemd services; Shield adds API security (WAF with the OWASP Core Rule Set, auth, rate limiting, DLP) through ext_proc; API Discovery builds an API inventory from Envoy access logs; GSLB steers DNS to healthy edges. Product site: https://www.elchi.io/ · Plans: https://www.elchi.io/plans.html · Contact: https://www.elchi.io/contact.html · OpenAPI (public automation API): https://www.elchi.io/docs/openapi/elchi-public-v1.yaml ## Start here - [Elchi Docs: Guides & Reference for Envoy Fleets](https://www.elchi.io/docs/): Elchi docs: install and operate the Elchi Envoy control plane, configure listeners and clusters over xDS, and add WAF, API discovery and GSLB. - [Changelog & Releases](https://www.elchi.io/docs/changelog): Where to find release notes for every Elchi component (UI, backend, client, Shield, collector) and how the components and Envoy versions are versioned together. - [GSLB](https://www.elchi.io/docs/gslb): Global Server Load Balancing: DNS-based traffic steering with health checks. ## Getting Started - [Elchi Architecture: Processes, Ports, Data Flows](https://www.elchi.io/docs/getting-started/architecture): The map of the Elchi stack: the three backend processes, datastores and observability tier, the edge node, and every connection with its port and auth. - [Elchi Core Concepts: Processes, Agent, Config Flow](https://www.elchi.io/docs/getting-started/concepts): How Elchi splits work across the registry, controller and control plane plus the edge agent, and how a configuration change flows to Envoy. - [The Elchi Dashboard](https://www.elchi.io/docs/getting-started/dashboard): The first screen after login: a per-project widget overview of Envoy resource counts, service errors, traffic and security health, linking into every area. - [What Is Elchi? Envoy Control Plane Introduction](https://www.elchi.io/docs/getting-started/introduction): Elchi is a visual control plane for Envoy proxy fleets: typed config validated and pushed over xDS, edge agents on VMs, WAF, API discovery and GSLB. - [Network & Firewall Access for Elchi](https://www.elchi.io/docs/getting-started/network-access): Firewall checklist for Elchi: what the platform exposes, what it must reach, what edge hosts running elchi-client, Envoy and Shield need, and optional ports. - [Elchi Quick Start on Kubernetes with Helm](https://www.elchi.io/docs/getting-started/quickstart): Run the full Elchi stack on any Kubernetes cluster with one Helm command, with bundled MongoDB, VictoriaMetrics and ClickHouse, then connect your first edge. - [Global Search Across Envoy Config](https://www.elchi.io/docs/getting-started/search): Find every place a domain or IP appears in your Envoy config (virtual hosts, routes, filters, endpoints, clusters, listeners) and jump straight to the resource. ## Installation - [elchi-stack Operator Helper Reference](https://www.elchi.io/docs/installation/bare-metal/elchi-stack-helper): Reference for elchi-stack, the helper on every bare-metal Elchi node: status, logs, add-node, MongoDB and ClickHouse checks, secrets, TLS info and verify. - [Production hardening (kernel + systemd)](https://www.elchi.io/docs/installation/bare-metal/hardening): The kernel sysctl baseline, MongoDB systemd drop-in, per-service systemd hardening set, and preflight RAM/swap checks applied by every install. - [install.sh — full flag reference](https://www.elchi.io/docs/installation/bare-metal/install-sh): Complete reference for every install.sh flag — topology, SSH, versioning, TLS, MongoDB, VictoriaMetrics, Grafana, GSLB, backend, and op-mode. - [Bare-Metal Install: Elchi on VMs with systemd](https://www.elchi.io/docs/installation/bare-metal/overview): How the standalone installer brings up the whole Elchi stack as systemd services on 1, 2 or 3+ Linux VMs, with no Docker and no Kubernetes required. - [Bare-Metal Port Atlas](https://www.elchi.io/docs/installation/bare-metal/port-atlas): Every port the bare-metal Elchi stack listens on, per service and per node role, and whether it binds loopback or all interfaces, for your firewall rules. - [Bare-Metal Install Prerequisites](https://www.elchi.io/docs/installation/bare-metal/prerequisites): OS, hardware, network and SSH requirements for the bare-metal Elchi installer, checked before it brings the stack up as systemd services on your VMs. - [Bare-Metal Quick Start](https://www.elchi.io/docs/installation/bare-metal/quickstart): One-command bare-metal Elchi installs: a single all-in-one VM or a 3-VM cluster, with key-based or interactively bootstrapped SSH between the nodes. - [Bare-Metal Supported Distros & Idempotency](https://www.elchi.io/docs/installation/bare-metal/supported-distros): The Linux distributions the bare-metal Elchi installer supports, why older releases are dropped, and how hash-based reconcile makes reruns idempotent. - [Topology](https://www.elchi.io/docs/installation/bare-metal/topology): How components distribute across 1, 2, and 3+ VM clusters — Mongo RS, per-node OTel and collector, ClickHouse replication, and the M1 storage tier. - [uninstall.sh — remove the stack](https://www.elchi.io/docs/installation/bare-metal/uninstall-sh): Non-destructive uninstall by default, cluster-wide fan-out from M1, and opt-in purge flags for data, packages, and secrets. - [upgrade.sh — version-diff upgrade](https://www.elchi.io/docs/installation/bare-metal/upgrade-sh): Version-diff upgrades with hash-based reconcile, additive or declarative variant changes, health gate, and per-binary rollback. - [/etc/elchi/validate.sh — per-node post-install audit](https://www.elchi.io/docs/installation/bare-metal/validate-sh): Read-only per-node audit script that checks systemd, ports, service health, Envoy admin, config integrity, and system tuning. - [Elchi Client Configuration](https://www.elchi.io/docs/installation/client/configuration): Configure the Elchi Client edge agent: point it at your Elchi server in /etc/elchi/config.yaml, set its registration token, and restart the service. - [Install the Elchi Client (Envoy Edge Agent)](https://www.elchi.io/docs/installation/client/installation): Install the Elchi Client edge agent on a Linux host with the installer script or by placing the binary, then register it so it can run Envoy listeners. - [Elchi Client Overview and Requirements](https://www.elchi.io/docs/installation/client/overview): The Elchi Client is the edge agent that runs Envoy for your control plane. Supported OS (Ubuntu 24.04, amd64), downloads, and what it installs on a host. - [The Bundled Shield Sidecar](https://www.elchi.io/docs/installation/client/shield-sidecar): How the elchi-client installer installs and configures elchi-shield by default, its sink config, and how to skip or pin it. - [Standalone Collector](https://www.elchi.io/docs/installation/collector-standalone): Deploy elchi-collector as a standalone Deployment against your existing MongoDB and ClickHouse, separate from the full platform. - [Discovery Agent Helm Values Reference](https://www.elchi.io/docs/installation/discovery-agent/configuration): Every Helm value of the elchi-discovery chart with its default: API endpoint, token, cluster name, interval, logging, RBAC, resources and pod security. - [Install the Kubernetes Discovery Agent](https://www.elchi.io/docs/installation/discovery-agent/installation): Install the Elchi Discovery agent with Helm: generate a discovery token, set the API endpoint and cluster name, then confirm the cluster appears in Elchi. - [Kubernetes Discovery Agent Overview](https://www.elchi.io/docs/installation/discovery-agent/overview): The Elchi Discovery agent reports a Kubernetes cluster's nodes to Elchi, which keeps Envoy endpoints in sync with node IPs. How it works and what you need. - [Using K8s Discovery](https://www.elchi.io/docs/installation/discovery-agent/using-discovery): The in-UI workflow after installing the discovery agent: browse imported clusters, link endpoints to them, check which endpoints use a cluster, remove one. - [Docker Swarm: Installer Flags](https://www.elchi.io/docs/installation/docker-swarm/flags): The full flag reference for the Docker Swarm installer — core, versions, TLS, features, datastores, multi-node, offline and paths. - [Docker Swarm: High Availability](https://www.elchi.io/docs/installation/docker-swarm/high-availability): Multi-node Docker Swarm — SSH fan-out, the auto-formed MongoDB replica set and ClickHouse Keeper cluster, and the required Swarm ports. - [Docker Swarm: Offline / Air-Gapped](https://www.elchi.io/docs/installation/docker-swarm/offline-airgap): Install the Elchi control plane on an air-gapped host — save the image set with save-images.sh, copy the tarball, and install with --offline. - [Docker Swarm Install Overview](https://www.elchi.io/docs/installation/docker-swarm/overview): What the Elchi Docker Swarm installer deploys, its prebuilt-image model, single-node vs HA and air-gapped modes, and how it compares with bare-metal and Helm. - [Docker Swarm: Quick Start](https://www.elchi.io/docs/installation/docker-swarm/quickstart): Bring the Elchi control plane up on Docker Swarm with one command — the bootstrap one-liner, what it does, and how to inspect a dry run. - [Docker Swarm: Upgrade & Uninstall](https://www.elchi.io/docs/installation/docker-swarm/upgrade-and-uninstall): Upgrade the Elchi Docker Swarm stack with a version bump and rolling update, edit live configs in place, and tear the stack down. - [Helm Chart Configuration Values](https://www.elchi.io/docs/installation/helm-platform/configuration): elchi-stack Helm chart values for the Elchi platform: global parameters, the required main address, credentials, and external MongoDB and VictoriaMetrics. - [Helm Platform Installation](https://www.elchi.io/docs/installation/helm-platform/installation): Install the Elchi platform on Kubernetes with the elchi-stack Helm chart: add the repo, install with defaults or a custom values file, then sign in. - [Helm Platform Overview](https://www.elchi.io/docs/installation/helm-platform/overview): The components the elchi-stack Helm chart deploys on Kubernetes (controller, control plane, registry, UI and datastores) and the role each plays. - [Helm Platform Prerequisites](https://www.elchi.io/docs/installation/helm-platform/prerequisites): What you need before installing the elchi-stack Helm chart: Kubernetes 1.21+, Helm 3, CPU, memory and storage, a NodePort or load balancer, and a main address. - [Helm Production Setup and HA](https://www.elchi.io/docs/installation/helm-platform/production): A reference production values file for the elchi-stack Helm chart and high-availability guidance for running the Elchi platform on Kubernetes. - [Helm Platform Security Hardening](https://www.elchi.io/docs/installation/helm-platform/security): Harden an Elchi Helm install: generated credentials and JWT secret, TLS with your own certificate, admin password, CORS, Envoy admin, NetworkPolicies. - [Helm Storage Options](https://www.elchi.io/docs/installation/helm-platform/storage): Configure built-in or external MongoDB, ClickHouse and VictoriaMetrics storage for the Elchi Helm platform, with persistent volume sizing guidance. - [Helm Values Profiles](https://www.elchi.io/docs/installation/helm-platform/values-profiles) - [Single-Host Install with kind and Helm](https://www.elchi.io/docs/installation/kind-quickstart): Evaluate the full Elchi stack on one Ubuntu 24.04 VM: the installer provisions Docker, kind, kubectl and Helm and deploys the elchi-stack chart for you. - [Install Shield Standalone (without the Client)](https://www.elchi.io/docs/installation/shield-standalone): Install elchi-shield as its own hardened systemd service on an edge host that runs Envoy without elchi-client, and wire it to Envoy over ext_proc. ## Elchi OS Appliance - [Elchi OS Appliance Tab](https://www.elchi.io/docs/elchi-os/appliance-tab): The Appliance tab of an Elchi OS client in the UI: release and boot slots, health, upgrades, firewall, network confirm, CIS check and support bundle downloads. - [Elchi OS Console Reference](https://www.elchi.io/docs/elchi-os/console): The Elchi OS management console: show, set and apply, network changes with commit-confirm, firewall, system, config, logs and diagnostics, with exact syntax. - [Install the Elchi OS Edge Appliance](https://www.elchi.io/docs/elchi-os/installation): Download and verify the Elchi OS image, deploy it from ISO, OVA or qcow2, and register it with the setup wizard or unattended with setup.yaml or cloud-init. - [Elchi OS Overview](https://www.elchi.io/docs/elchi-os/overview): Elchi OS is an edge appliance image bundling the Elchi agent and Shield WAF: what it includes, image formats, platforms, sizing, and when to use it. - [Elchi OS Security & Networking](https://www.elchi.io/docs/elchi-os/security-and-networking): The Elchi OS host firewall, open ports and who may reach them, outbound requirements, SSH and accounts, kernel settings, the CIS check and the support bundle. - [Elchi OS Upgrades and Rollback](https://www.elchi.io/docs/elchi-os/upgrades): Upgrade Elchi OS in place with A/B root slots, a health-gated trial boot and automatic rollback; update elchi-client or Shield alone; HA pair upgrade order. ## Configuring - [Resources & the Config Model](https://www.elchi.io/docs/envoy-configuration/config-model): How Elchi models every Envoy configuration object as a typed, validated resource — from listeners to secrets — and publishes changes safely. - [Dependency Graph, Route Map & Snapshot Dump](https://www.elchi.io/docs/envoy-configuration/dependency-graph): Three tools to debug Envoy config in Elchi: see how resources reference each other, trace request routing, and dump the live xDS snapshot Envoy is served. - [Resource Editor Tools: Regex, Certs, Secrets](https://www.elchi.io/docs/envoy-configuration/form-tools): Helpers in the Elchi resource editor: the RE2 regex tester, certificate inspector, secret and session ticket key generators, and the Basic Auth hash generator. - [Resource Types](https://www.elchi.io/docs/envoy-configuration/resources): Per-resource guides for every Envoy resource Elchi manages: listeners, routes, clusters, endpoints, secrets, filters, and more. - [Bootstrap](https://www.elchi.io/docs/envoy-configuration/resources/bootstrap): The Envoy bootstrap config Elchi generates for each proxy — node identity, admin, static resources, and the ADS connection back to the control-plane. - [Clusters](https://www.elchi.io/docs/envoy-configuration/resources/clusters): How Elchi models Envoy clusters (CDS) — discovery type, load balancing, health checks, circuit breakers, and outlier detection. - [Endpoints](https://www.elchi.io/docs/envoy-configuration/resources/endpoints): How Elchi models Envoy endpoints (EDS) — the ClusterLoadAssignment, localities, priorities, weights, and their link to clusters. - [Envoy Extensions (typed_config) in Elchi](https://www.elchi.io/docs/envoy-configuration/resources/extensions): How Elchi manages Envoy typed_config extensions as reusable, separately versioned configs that listeners, filters and clusters reference instead of inlining. - [Filters](https://www.elchi.io/docs/envoy-configuration/resources/filters): How Elchi models Envoy filters — the listener, network, HTTP, and UDP filter categories the UI exposes, and where Shield's ext_proc filter fits. - [Listeners](https://www.elchi.io/docs/envoy-configuration/resources/listeners): How Elchi models Envoy listeners (LDS) — bind addresses, filter chains, the HTTP Connection Manager, and TLS termination. - [Envoy Routes (RDS) in Elchi](https://www.elchi.io/docs/envoy-configuration/resources/routes): How Elchi models Envoy route configurations (RDS): virtual hosts, match, route and redirect rules, and header manipulation, served to Envoy over xDS. - [Secrets & TLS](https://www.elchi.io/docs/envoy-configuration/resources/secrets): How Elchi models Envoy secrets (SDS) — TLS certificates, validation contexts, and the link to ACME-managed certificates. - [Transport Sockets](https://www.elchi.io/docs/envoy-configuration/resources/transport-sockets): How Elchi models Envoy transport sockets — downstream vs upstream TLS/mTLS on listeners and clusters, plus QUIC and Proxy Protocol. - [Virtual Hosts](https://www.elchi.io/docs/envoy-configuration/resources/virtual-hosts): How Elchi models Envoy virtual hosts inside a route configuration — domains, per-vhost routes, retries, and header rules. - [Route Map](https://www.elchi.io/docs/envoy-configuration/route-map): Trace how an incoming request flows through a listener's virtual hosts, routes, and match conditions to the upstream cluster that ultimately serves it. - [Scenario Workflows](https://www.elchi.io/docs/envoy-configuration/scenario-workflows): The guided Scenario wizard: generate multi-resource Envoy configs step by step. - [Execute and Validate a Scenario](https://www.elchi.io/docs/envoy-configuration/scenario-workflows/execute-and-validate): Turn a saved Elchi scenario into live Envoy resources: validate components, pick a version, fill execution-time values and apply, with automatic rollback. - [Import and Export](https://www.elchi.io/docs/envoy-configuration/scenario-workflows/import-export): Share and reuse scenarios across projects and installations — the export bundle format, importing into another project, and how naming conflicts are resolved. - [Scenario Wizard Overview](https://www.elchi.io/docs/envoy-configuration/scenario-workflows/overview): The Elchi Scenario wizard is a guided, catalog-driven generator that builds several related Envoy resources at once. What it does and when to use it. - [Scenario Wizard Walkthrough](https://www.elchi.io/docs/envoy-configuration/scenario-workflows/wizard-walkthrough): Step through the Scenario Quick Start hub and the three-step create wizard (basic info, components and fields, review) and see what the wizard generates. - [Snapshot Dump](https://www.elchi.io/docs/envoy-configuration/snapshot-dump): Inspect the exact xDS snapshot the control-plane is serving a live Envoy node — the ground truth of what shipped — and clear a stale snapshot to force a resync. - [Envoy Config Templates & Snippets](https://www.elchi.io/docs/envoy-configuration/templates-snippets): Reusable Envoy config building blocks in Elchi: per-type resource templates for consistent starting points and searchable field-level snippets, in batches. - [Envoy Versions & Zero-Downtime Upgrades](https://www.elchi.io/docs/envoy-configuration/versions-and-upgrades): How Elchi serves several Envoy versions side by side, routes each proxy to its version's control plane, and moves listeners to a new version by hot restart. ## API Security (Shield) - [Anomaly Scoring](https://www.elchi.io/docs/shield/anomaly-scoring): Combine weak signals from multiple engines into one collaborative per-request score and block only when the total crosses a policy threshold. - [Deploying Policies to Edges](https://www.elchi.io/docs/shield/deployment): How a Shield policy travels from the UI to every edge — the merged bundle, the SHIELD_DEPLOY job, elchi-client's atomic file sync, and reload confirmation. - [Security Engines](https://www.elchi.io/docs/shield/engines): Every Shield security engine: what it protects against, full configuration, and verification. - [Shield API Key Authentication](https://www.elchi.io/docs/shield/engines/api-key): Shield's API key engine: SHA-256-hashed keys from a header or query parameter, per-key scopes and scope-to-path bindings, enforced at the Envoy edge. - [Bot Detection](https://www.elchi.io/docs/shield/engines/bot-detection): The layered bot/scanner scorer — verified-crawler checks, User-Agent rules, JA3/JA4 TLS fingerprints, and header-anomaly heuristics. - [Coraza WAF (OWASP CRS)](https://www.elchi.io/docs/shield/engines/coraza-waf): The embedded ModSecurity-style WAF engine — OWASP Core Rule Set, paranoia levels, anomaly thresholds, and custom SecLang directives. - [GraphQL Guard](https://www.elchi.io/docs/shield/engines/graphql): Query-shape DoS protection for GraphQL — depth, alias, field, and batch limits, introspection blocking, and always-on complexity backstops. - [HMAC Signing](https://www.elchi.io/docs/shield/engines/hmac-signing): Native HMAC request signing with a timestamp window, nonce replay protection, key-id rotation, and optional body-digest binding. - [HTTP Message Signatures](https://www.elchi.io/docs/shield/engines/http-signature): RFC 9421 HTTP Message Signature verification (hmac-sha256) with covered-component control, content-digest body binding, and freshness enforcement. - [Shield IP Reputation, Threat Feeds & GeoIP](https://www.elchi.io/docs/shield/engines/ip-reputation): Block source IPs at the Envoy edge with Shield: CIDR allow and deny lists, threat-intelligence feeds from disk, and GeoIP country and ASN rules. - [JWKS](https://www.elchi.io/docs/shield/engines/jwks): Bearer JWT validation against a JWK Set (local file or remote URL) with key rotation, background refresh, and no request-path network I/O. - [Shield JWT Validation](https://www.elchi.io/docs/shield/engines/jwt): Shield's JWT engine validates bearer tokens with static keys at the Envoy edge: a strict algorithm allow-list, mandatory expiry and required claims. - [mTLS Identity (XFCC)](https://www.elchi.io/docs/shield/engines/mtls-xfcc): Authenticate by the mTLS client-certificate identity Envoy forwards in x-forwarded-client-cert — SPIFFE/DNS SANs, subjects, or fingerprints. - [Shield OpenAPI Request Validation](https://www.elchi.io/docs/shield/engines/openapi-validation): Positive security at the Envoy edge: Shield validates every request against an OpenAPI 3.x contract and blocks anything the spec does not declare. - [Rate Limiting](https://www.elchi.io/docs/shield/engines/rate-limit): The sharded token-bucket rate limiter — per-IP, per-host, or per-header keys, burst control, and 429 responses with Retry-After. - [Wiring Shield into Envoy](https://www.elchi.io/docs/shield/envoy-wiring): The ext_proc cluster and filter configuration that connects Envoy to the Shield sidecar, plus the Envoy settings Shield's engines depend on. - [Get Started with Shield](https://www.elchi.io/docs/shield/getting-started): Write, deploy and verify your first Elchi Shield policy in about ten minutes, starting safely in detect mode before you switch the policy to block. - [How Shield Works](https://www.elchi.io/docs/shield/how-it-works): The request pipeline, header vs body phases, the five engine rules, always-on body protections, the source-IP trust model, and atomic hot reload. - [Metrics, Audit & Health](https://www.elchi.io/docs/shield/observability): Shield's full Prometheus metric set, the ClickHouse audit sink and its schema, metric delivery (scrape or OTLP push), and the loopback health endpoints. - [Shield: API Security Overview](https://www.elchi.io/docs/shield/overview): Elchi Shield is an Envoy ext_proc API-security and WAF sidecar: 12 security engines enforced on the edge host, configured by files and hot-reloaded. - [Shield Body Inspection & Limits](https://www.elchi.io/docs/shield/policies/body-inspection): Enable request and response body buffering in Shield, set size and time limits, and rely on the always-on truncation guard, decoding and body budget. - [Built-in Checks & Pipeline Order](https://www.elchi.io/docs/shield/policies/checks): The built-in header and body checks, skip_checks exemptions, custom pipeline stage ordering, audit sampling, and per-policy log level. - [Data Loss Prevention (DLP)](https://www.elchi.io/docs/shield/policies/dlp): Block hard secrets and redact PII in request or response bodies — kinds, block vs redact precedence, and how in-place redaction works mechanically. - [Modes & Fail Postures](https://www.elchi.io/docs/shield/policies/modes-and-postures): What block, detect, shadow, and off actually do to a request; fail_open vs fail_close; and the recommended detect → shadow → block rollout. - [The SecurityPolicy Model](https://www.elchi.io/docs/shield/policies/policy-model): The Elchi Shield policy file format — envelope, domains, routes, match predicates, inheritance, and multi-file merge semantics. - [CLI & Configuration Reference](https://www.elchi.io/docs/shield/reference): Every elchi-shield command-line flag with its default and purpose, the ELCHI_SHIELD_* environment variables, the validate subcommand, and on-disk paths. - [Overview Dashboard](https://www.elchi.io/docs/shield/ui/overview-dashboard): The live Shield metrics dashboard — traffic, latency, findings, audit pipeline, sidecar health, and per-edge config rollout, fed by VictoriaMetrics. - [Policy Editor](https://www.elchi.io/docs/shield/ui/policy-editor): Build, test, and deploy Shield policies from the Elchi UI — the Builder, YAML, Data Files, and Test tabs, templates, and Import from Discovery. - [Shield Security Events Feed](https://www.elchi.io/docs/shield/ui/security-events): The per-event feed of what Shield blocks and detects across a project's Envoy edges, stored in ClickHouse: filters, facets and the redaction model. ## API Discovery - [Collector Configuration](https://www.elchi.io/docs/api-discovery/collector-configuration): The elchi-collector runtime config: header policy, ingest exclusions, path normalization, PII switches, TLS proxies, GraphQL and detector thresholds. - [Collector Reference](https://www.elchi.io/docs/api-discovery/collector-reference): Complete reference for the elchi-collector — bootstrap environment variables, ports, Prometheus metrics, ClickHouse and MongoDB schema, and Envoy ALS wiring. - [Consumers & Enumeration](https://www.elchi.io/docs/api-discovery/consumers-and-enumeration): Per-consumer API behaviour in API Discovery: machine vs human callers, new consumers, enumeration, scraping and auth-failure signals, BOLA and BFLA detectors. - [API Discovery Dashboards](https://www.elchi.io/docs/api-discovery/dashboards): The API Discovery dashboards: listeners, new APIs, auth coverage, bots, PII, zombie APIs, risk, security score, errors, drift, consumers, specs and teams. - [API Drift & Daily Snapshots](https://www.elchi.io/docs/api-discovery/drift): Daily snapshots of your confirmed API surface and the change feed against them: new and removed operations, auth downgrades, new PII, risk rises and zombies. - [Exploring Discovered API Endpoints](https://www.elchi.io/docs/api-discovery/endpoints): The per-listener endpoints view in API Discovery: confirmed vs attack surface, path grouping, GraphQL operations, filters, two-axis risk scores and CSV export. - [OpenAPI Export](https://www.elchi.io/docs/api-discovery/openapi-export): Turn the traffic-derived API inventory into an OpenAPI 3.x document — and feed it into Shield's positive-security enforcement. - [API Discovery Overview](https://www.elchi.io/docs/api-discovery/overview): Elchi API Discovery builds an API inventory from Envoy access logs: confirmed endpoints, risk, PII and auth detection, spec coverage, drift and OpenAPI export. - [API Ownership & Teams](https://www.elchi.io/docs/api-discovery/ownership-and-teams): Assign teams, owners, criticality, data classes and tags to discovered API endpoints with ordered rules and overrides, and see per-team risk on the Teams tab. - [API Path Normalization and Templating](https://www.elchi.io/docs/api-discovery/path-normalization): How API Discovery turns high-cardinality request paths into stable operations: built-in detectors, learned templating, the merge job and operator rules. - [PII, Auth & Consumers](https://www.elchi.io/docs/api-discovery/pii-and-auth): How API Discovery detects PII in paths and query strings, infers auth schemes and consumers, and keeps a metadata-only privacy model with per-detector switches. - [API Risk Flags Reference](https://www.elchi.io/docs/api-discovery/risk-flags-reference): Every API Discovery risk flag by class, with severity, risk axis, OWASP API Top 10 mapping, meaning and remediation, and how active and historical flags work. - [Risk Scoring: Threat vs Exposure](https://www.elchi.io/docs/api-discovery/risk-scoring): The API Discovery two-axis risk model: threat vs exposure, severity weights, active vs lifetime scores, the 0-100 Security Score and how to prioritize fixes. - [OpenAPI Specs & Coverage](https://www.elchi.io/docs/api-discovery/specs-and-coverage): Import OpenAPI or Swagger specs, scope them to listeners and paths, and compare them with observed traffic: undocumented, unused, deprecated-in-use and drift. - [Suggest a Shield Policy](https://www.elchi.io/docs/api-discovery/suggest-policy): Turn a discovered API inventory into a draft Shield SecurityPolicy, the bridge from Elchi API Discovery to API security enforcement at the Envoy edge. - [Threat Intel & GeoIP in API Discovery](https://www.elchi.io/docs/api-discovery/threat-intel-geoip): How the elchi-collector enriches API Discovery events: GeoIP country and ASN tags, User-Agent classification and threat-intel blocklist matches. ## GSLB - [GSLB Health Model and Probes](https://www.elchi.io/docs/gslb/health-model): The Elchi GSLB health model: HTTP, HTTPS and TCP probes, the passing, warning, critical and recovery states, anti-flapping, backoff, and which IPs DNS serves. - [GSLB Nodes & CoreDNS Plugin](https://www.elchi.io/docs/gslb/nodes-coredns): The elchi-coredns GSLB nodes: how CoreDNS reads the zone-authenticated DNS snapshot API, node tracking and cleanup, and single-node vs broadcast notify. - [GSLB Overview](https://www.elchi.io/docs/gslb/overview): Elchi GSLB is DNS-based global load balancing: active health probes, a four-state health model, and a CoreDNS plugin that serves only healthy edge IPs. - [GSLB Records & IPs](https://www.elchi.io/docs/gslb/records-and-ips): Manage GSLB DNS records and their IPs: create and update records, bulk enable or disable, add and remove IPs, assign regions and override health state. - [GSLB Statistics](https://www.elchi.io/docs/gslb/statistics): The GSLB Statistics dashboard: probe success rate, IP health distribution, errors, latency and success timelines, and worker internals per controller. ## Certificates - [ACME](https://www.elchi.io/docs/traffic-and-certificates/acme): Automated TLS certificates via ACME DNS-01: CA providers, DNS credentials, and renewal. - [CA Providers & EAB](https://www.elchi.io/docs/traffic-and-certificates/acme/ca-providers-eab): Choosing a Certificate Authority, listing supported CA providers and environments, and supplying External Account Binding (EAB) credentials. - [DNS Credentials](https://www.elchi.io/docs/traffic-and-certificates/acme/dns-credentials): Storing DNS provider API tokens that authorize the ACME DNS-01 challenge — supported providers, creating, testing, and rotating credentials. - [Multi-Version Secrets](https://www.elchi.io/docs/traffic-and-certificates/acme/multi-version-secrets): The version-scoped certificate model — how one ACME certificate is written to per-Envoy-version secrets, adding versions, and duplicating. - [ACME Overview](https://www.elchi.io/docs/traffic-and-certificates/acme/overview): Automated TLS certificate issuance and renewal via ACME DNS-01 — CA providers, ACME accounts, DNS credentials, and version-scoped Envoy secrets. - [Renewal & Troubleshooting](https://www.elchi.io/docs/traffic-and-certificates/acme/renewal): DNS-01 verification, manual verify and retry, manual and automatic renewal, changing the DNS credential, and diagnosing stuck verifications. ## Operations - [Clients](https://www.elchi.io/docs/operations/clients): The Clients console — connected edge nodes, remote command dispatch, host statistics and logs, and OpenStack interface/IP lookups. - [Cluster Endpoints](https://www.elchi.io/docs/operations/cluster-endpoints): Point an EDS cluster at another endpoints resource (backend-blue to backend-green, and back) for a blue/green release, from the elchi UI. - [Endpoint Control](https://www.elchi.io/docs/operations/endpoint-control): Take an upstream endpoint (an IP or a hostname) out of rotation everywhere it is used in a project, and put it back, from the elchi UI. - [IP Address Management (IPAM)](https://www.elchi.io/docs/operations/ip-addresses): Track a project's public and private IP blocks and addresses in Elchi, see which ones services hold and which are free, and pick one when deploying. - [Edge Client Network & BGP](https://www.elchi.io/docs/operations/network-and-bgp): An Elchi client's Network tab: netplan editing with rollback, static routes, routing policies and tables, and FRR/BGP with BFD, including VIP announcement. - [Edge Network Topologies](https://www.elchi.io/docs/operations/network-topologies): How an Envoy edge host routes with one, two or three NICs: where listener VIPs live, reply and upstream paths, the default route, policy rules and BGP uplinks. - [Fleet Operations](https://www.elchi.io/docs/operations/overview): The management console for a running Elchi fleet — deployed Envoy services, connected edge clients, and how the controller drives them. - [Services](https://www.elchi.io/docs/operations/services): The Services console — view deployed Envoy services, drill into a running Envoy, track configuration errors, and recover GSLB records. ## Edge HA Pairs - [HA Pairs API](https://www.elchi.io/docs/ha-pairs/api): REST reference for HA pairs — list, create, update, delete, add a member, failover, maintenance, push, sync — and the HA client commands. - [HA Pair Appliance Commands](https://www.elchi.io/docs/ha-pairs/appliance-commands): Inspect and operate an Elchi OS HA pair on the appliance: show ha, system ha commands, elchi-client ha, the elchi-ha service, its files and the support bundle. - [Deploying Services to a Pair](https://www.elchi.io/docs/ha-pairs/deploying-services): Deploy services on an Elchi OS HA pair: one VIP for both members, on-link vs routed VIPs, floating next-hops, BGP and BFD, and standby-first changes. - [HA Pair Failover & Maintenance](https://www.elchi.io/docs/ha-pairs/failover-and-maintenance): How HA pair members elect and take over, planned and forced failover, maintenance mode, flap suspension, replacing a member and upgrading a serving pair. - [Monitoring a Pair](https://www.elchi.io/docs/ha-pairs/monitoring): Pair statuses, member roles, alarms, heartbeat and data-plane indicators, and where HA state appears across the Elchi UI, audit log and metrics. - [HA Pairs Overview](https://www.elchi.io/docs/ha-pairs/overview): Active/passive pairs of Elchi OS edge appliances that share virtual IPs — how a pair elects its active member, fails over, and keeps services up without BGP. - [Set Up an Elchi OS HA Pair](https://www.elchi.io/docs/ha-pairs/setup): Start an Elchi OS appliance in HA mode, create a pair from one or two clients, add or replace the second member, and tune heartbeat, fencing and next-hops. ## Observability - [Recommended Alerts for Elchi (PromQL)](https://www.elchi.io/docs/observability/alerting): Tiered PromQL alerting rules for an Elchi platform: config health, Shield safety, collector backpressure and backend health, with starting thresholds. - [Audit Log and Syslog (SIEM) Forwarding](https://www.elchi.io/docs/observability/audit-and-syslog): Elchi records every user action and config change in an audit trail and can forward each entry to a SIEM as RFC5424 syslog over UDP, TCP or TCP with TLS. - [Background Jobs](https://www.elchi.io/docs/observability/background-jobs): Track asynchronous work — snapshots, Shield policy deploys, ACME verification, and resource upgrades — with live logs and retry. - [Live Traffic View for Envoy Listeners](https://www.elchi.io/docs/observability/live-traffic): Watch an Envoy listener live: sampled requests flow through connection managers, domains, routes and clusters to endpoints, with rates, p99 and 5xx origin. - [Metrics & Logs](https://www.elchi.io/docs/observability/metrics-and-logs): The platform telemetry pipeline — where every signal goes — plus the built-in metric dashboards, Grafana, the log viewer, and Kubernetes endpoint discovery. - [Project Reports: Traffic, Certs, Security](https://www.elchi.io/docs/observability/reports): Project-wide Elchi reports: problems first, then traffic map, domains, certificates, security per filter chain, unused resources and changes, as CSV or JSON. - [Envoy Service Logs Search](https://www.elchi.io/docs/observability/service-logs): Search an Envoy listener's logs and access logs by time range with a histogram, field sidebar and query syntax, with totals and paging evaluated on the host. ## Administration - [AI-Powered Analysis](https://www.elchi.io/docs/administration/ai-analysis): Bring your own OpenRouter key to analyze Envoy configurations and logs with the model of your choice — with full token, cost, and quota tracking. - [Authentication & Access](https://www.elchi.io/docs/administration/auth-and-access): Elchi access control: Owner, Admin, Editor and Viewer roles, project scoping, API and discovery tokens, LDAP/AD login, and TOTP two-factor authentication. - [Backup & Restore](https://www.elchi.io/docs/administration/backup-restore): Export and re-import an Elchi project's platform state, validate a backup before applying it, inspect its metadata, and clean up a retired Envoy version. - [Cloud & OpenStack](https://www.elchi.io/docs/administration/cloud-openstack): Register an OpenStack cloud, discover a VM's network interfaces and subnets, and bind an edge Envoy node's downstream IP to an OpenStack port. - [Licensing: Activate and Manage License Keys](https://www.elchi.io/docs/administration/licensing): View, activate, re-validate and remove Elchi license keys, the free tier (Elchi Core with one managed client), and the access the license API needs. - [Production Checklist & DR](https://www.elchi.io/docs/administration/production-checklist): Elchi go-live checklist: TLS, HA, persistent datastores, hardening, monitoring, backups and Shield source-IP trust, plus a disaster-recovery runbook. - [Your Profile](https://www.elchi.io/docs/administration/profile): Self-service account management in Elchi — change your email and password, and enable or manage two-factor authentication for your own account. - [Registry & Control Plane High Availability](https://www.elchi.io/docs/administration/registry-and-ha): The Elchi registry: live topology of controllers, control planes and clients, leader election, and running several controllers for high availability. - [Security Model](https://www.elchi.io/docs/administration/security-overview): Elchi's security posture in one place — identities and secrets, per-wire trust, RBAC and audit as controls, hardening, and what is encrypted or at rest. - [Settings & the General Tab](https://www.elchi.io/docs/administration/settings-overview): A map of Elchi's Settings area with links to each feature's doc, and the General tab: installed versions, the Envoy versions list and live storage usage. - [Sizing & Capacity](https://www.elchi.io/docs/administration/sizing-and-capacity): Size an Elchi platform: CPU, memory and storage for the control plane, MongoDB, ClickHouse, VictoriaMetrics, the collector and Shield, and what grows. - [Threat Intel & GeoIP Settings](https://www.elchi.io/docs/administration/threat-intel-geoip): Load threat-intel blocklists and GeoIP MMDB databases under Settings → API Discovery so API Discovery can tag traffic with reputation, country and ASN. ## Automation API - [Cluster Switch API: Blue/Green for Envoy EDS](https://www.elchi.io/docs/automation-api/clusters): Point an Envoy EDS cluster at another endpoints resource (backend-blue to backend-green and back) with the Elchi automation API; every listener gets it at once. - [Endpoint Disable API: Drain an Upstream IP](https://www.elchi.io/docs/automation-api/endpoints): Take an upstream IP or hostname (all ports or some) out of rotation everywhere it is used in an Elchi project, and put it back, with the automation API. - [Automation API Errors and Codes](https://www.elchi.io/docs/automation-api/errors): Every Elchi automation API error code: HTTP status, meaning, whether to retry and what to do, plus the conflict reasons and the problem+json body. - [Automation API Overview](https://www.elchi.io/docs/automation-api/overview): Elchi's public REST automation API: versioned base URL, project API tokens, problem+json errors, idempotent writes, long-running operations and rate limits. - [Automation API Tokens and Scopes](https://www.elchi.io/docs/automation-api/tokens): Project API tokens for the Elchi automation API: who can create them, scopes, expiry, how each request is checked, and how to revoke a token. ## Troubleshooting - [Troubleshooting](https://www.elchi.io/docs/troubleshooting/common-issues): Fixes for common issues across the platform — control-plane config delivery, Shield ext_proc, API Discovery, certificates, GSLB, and edge resource pressure. - [Elchi FAQ](https://www.elchi.io/docs/troubleshooting/faq): Answers about Elchi: what it is, how config reaches Envoy edges, where the WAF runs, API Discovery privacy, deployment options and where data lives. ## How-to Guides - [Add an OWASP CRS WAF to Envoy with ext_proc](https://www.elchi.io/docs/guides/add-waf-to-envoy-ext-proc): Add a WAF to Envoy: run the Elchi Shield sidecar over ext_proc, enable Coraza with the OWASP Core Rule Set, start in detect mode, then switch to block. - [Envoy Blue/Green with EDS and Endpoint Draining](https://www.elchi.io/docs/guides/blue-green-envoy-eds): Blue/green behind Envoy: switch an EDS cluster's service_name between two endpoint sets, or drain one upstream IP with the Elchi automation API. - [Find Shadow APIs from Envoy Access Logs](https://www.elchi.io/docs/guides/find-shadow-apis-envoy-access-logs): Find shadow and undocumented APIs: stream Envoy ALS access logs to the Elchi collector, build a live API inventory and compare it with your OpenAPI specs. - [GSLB and DNS Failover for Envoy with CoreDNS](https://www.elchi.io/docs/guides/gslb-dns-failover-envoy): DNS failover for Envoy edges: an Elchi GSLB record health-checks every edge IP, and elchi-coredns answers with only the healthy ones or a failover name. - [Manage Envoy Without Hand-Writing xDS or YAML](https://www.elchi.io/docs/guides/manage-envoy-without-yaml): Manage Envoy without hand-written xDS or YAML: edit typed forms generated from Envoy's protobufs, validate twice and push over ADS without a restart. - [Run Multiple Envoy Versions, Zero-Downtime Upgrades](https://www.elchi.io/docs/guides/run-multiple-envoy-versions): Run several Envoy versions side by side with one Elchi control plane per version, then upgrade listeners by hot restart without dropping connections. ## Tutorials - [Tutorial: Build an API Inventory in a Day](https://www.elchi.io/docs/tutorials/api-inventory-in-one-day): Enable API Discovery on a listener, let it observe real traffic, triage risk across the dashboards, and export an OpenAPI spec of the confirmed catalog. - [Tutorial: Secure an API with Shield](https://www.elchi.io/docs/tutorials/secure-an-api-with-shield): End to end: observe an API with Discovery, review its risk, generate a Shield policy, roll it out from detect to block, and verify enforcement with curl. - [Tutorial: From Install to First Listener](https://www.elchi.io/docs/tutorials/zero-to-envoy): The hello-world of Elchi — install the platform, connect an edge client, build a listener → route → cluster → endpoint, publish it, and verify traffic flows. ## Blog - [What Is an Envoy Control Plane? xDS Explained](https://www.elchi.io/docs/blog/what-is-an-envoy-control-plane): An Envoy control plane serves configuration over the xDS APIs. Learn LDS, RDS, CDS, EDS, SDS, ADS ordering, delta xDS, ACK/NACK and snapshot caches. - [Adding the OWASP Core Rule Set to Envoy with ext_proc](https://www.elchi.io/docs/blog/owasp-crs-waf-envoy-ext-proc): Run the OWASP CRS as an Envoy ext_proc sidecar: UDS wiring, per-route body buffering, the HTTP-method trap, and a detect, shadow, block rollout. - [Running Envoy on VMs Without Kubernetes](https://www.elchi.io/docs/blog/envoy-on-vms-without-kubernetes): Envoy runs well on plain VMs if you cover bootstrap, xDS, process supervision, upgrades and telemetry. Here is what each needs and how Elchi automates it. - [Running an Envoy Fleet Without Hand-Writing xDS](https://www.elchi.io/docs/blog/envoy-fleet-without-xds): Hand-written xDS breaks on references, validation and versions, not syntax. What an Envoy control plane must do, and how Elchi handles each part. - [Elchi Blog: Envoy Control Plane Engineering](https://www.elchi.io/docs/blog): Engineering notes from the team that builds Elchi: Envoy control planes, xDS, running Envoy on VMs, and WAF/API security with ext_proc.