Own the edge between your users and your origin.
NetGoat is a self-hosted control plane for reverse proxy routes, DNS, automatic TLS, a readable WAF and live traffic analytics. One deployment you run, one panel you own.
The whole edge in one panel.
Everything between DNS and your origin, wired together: routes, certificates, rules and the traffic they produce.
Routes you can reason about
Match on path, host or header and send the request to a pool. When an upstream goes quiet, the next one in the pool takes the connection.
- /api/*api-pool2 upstreams
- /assets/*static-cachecache 1h
- default10.0.0.4:8080fallback
TLS that renews itself
Certificates are issued and rotated at the edge. The panel shows what is live, what it covers and when it turns over.
Traffic you can watch
Requests, blocked share and bandwidth per domain, fed by the edge. Spikes become alerts on the activity timeline.
A WAF with readable rules
Match method, path, header or address, then block, challenge or log. Rules stream to the edge with the next snapshot.
Personal or team
Start alone, add teammates when it matters. Every write in the workspace is guarded and recorded in the activity timeline.
- you@example.comOwner
- sre@example.comAdmin
- ops@example.comMember
Invite a teammate by email
DNS you can read back
Records written from the panel, listed with their TTL, proxied flag and live status. Verification for a new domain is one TXT record.
Three steps between a hostname and your origin.
Step 1
Add the domain
Create it in the panel and NetGoat hands you one TXT record. When DNS answers, the domain flips to verified on its own.
Step 2
Point it at an origin
An address like 10.0.0.4:8080 is enough to start. Add a pool for failover, then split traffic with routes and subdomains.
Step 3
Watch it hold
The edge issues TLS, applies WAF rules with the next snapshot, and reports requests, blocked share and bandwidth back to the panel.
Self-host
Run it on hardware you already pay for.
The whole stack ships as one compose file: control plane, panel and the Mongo it writes to. Secrets are generated on your machine, not handed to you by someone else's dashboard.
The database is yours
Domains, routes, rules and analytics live in your own MongoDB. Nothing is mirrored to us because there is no us in the request path.
Origins stay private
Edge agents dial out to the panel and pick up snapshots, so origins behind NAT, a tunnel or a tailnet never need an inbound port.
It keeps serving without the panel
Each agent holds its last known-good configuration and its local routes. If the control plane goes away, traffic keeps flowing on the rules it already has.
Docker and Docker Compose are the only requirements beyond the checkout.
git clone https://github.com/netgoat-xyz/netgoatcd netgoat && cp .env.example .env./scripts/generate-secrets.sh >> .envdocker compose up --buildKeep the rest of your stack.
NetGoat sits in front of what you already run. These are the integrations wired into the panel today.
Cloudflare
Mirror a zone and move traffic over gradually.
Tailscale
Reach origins on your tailnet, no public ports.
AWS
Put ALB and CloudFront origins behind the rules.
Google Cloud
Front Cloud Run services with the same pipeline.
Sentry
Forward edge errors with route context attached.
Grafana
Scrape request, cache and WAF metrics.
ngrok
Give a local tunnel a stable hostname.
Didn't see yours?
Anything that speaks HTTP sits behind NetGoat. The agent is open source under AGPL-3.0, so wire up the rest yourself.
He protecc, He attacc.
Bring up the stack, add a domain and watch the first request land in the panel. It takes about as long as reading this page.
AGPL-3.0 · self-hosted · no telemetry