Productify

Appearance

Productify Proxy ​

The proxy component for the Productify Framework provides reverse proxy and authentication using a custom Caddy build with Productify plugins.

Overview ​

Productify Proxy is a Caddy-based reverse proxy with custom authentication and authorization plugins that integrate with the Productify Manager for credential validation, tenant selection, and per-application monitoring.

One proxy for every application and tenant (Wave 3)

Since the Wave 3 release train, one proxy instance serves every application and tenant without hand edits. Per-application vhost blocks render from Manager data (deployment domains and upstreams) and push to the running proxy through Caddy's admin API; the install-level prelude renders from install.yaml. Onboarding an application or domain is a Manager operation, not a config edit. The Caddyfile examples below are reference output — the shape the renderer produces — not files you author. See Generated Artifacts.

Key Features ​

OAuth2 Authentication ​

  • Identity provider integration - Generic OAuth2/OIDC support
  • Authentication portal - Centralized login handling
  • Token management - Automatic token lifecycle

Authorization ​

  • Policy-based access control - Fine-grained authorization rules
  • Role-based access - Role assignment and validation
  • Bearer token validation - API authentication support
  • Header injection - Claims forwarding to backends

Productify Integration ​

  • Manager API integration - Credential validation via the Manager API
  • Manager-rendered configuration - Vhosts render from deployment data and hot-reload via the admin API, with drift detection (pfy proxy diff|sync) — see Generated Artifacts
  • Tenant switching - A hosted selector for multi-tenant users, an HMAC-signed selection cookie with membership re-validated against the Manager, and applications reading available_tenants from window.__PRODUCTIFY__ — see Multi-tenancy → Tenant Switching
  • Machine user validation - Token-based authentication for automated clients (ESB routes)
  • Application-specific middleware - Per-application authentication, monitoring, and configuration injection

TLS/SSL Support ​

  • Automatic HTTPS with Let's Encrypt
  • Certificate management - Automatic renewal
  • Custom certificates - Support for bring-your-own certificates

Architecture ​

┌──────────────┐
│   Internet   │
└──────┬───────┘
       │ HTTPS (443)
       ▼
┌─────────────────────────────────────┐
│       Productify Proxy (Caddy)      │
│  - OAuth2 Authentication            │
│  - Authorization Policies           │
│  - TLS Termination                  │
│  - Custom Productify Plugins        │
└─────────────────────────────────────┘
       │
       │ Validates with
       ▼
┌─────────────────────────────────────┐
│         Productify Manager          │
│  - PAT validation                   │
│  - Machine user validation          │
│  - Frontend configuration           │
└─────────────────────────────────────┘
       │
       │ Routes to
       ▼
┌─────────────────────────────────────┐
│         Backend Services            │
│  - Application instances            │
│  - Manager API/UI                   │
│  - Identity provider                │
└─────────────────────────────────────┘

How It Works ​

1. Authentication Flow ​

User accesses protected route:

nginx
route /* {
  authorize with pocketpolicy
  productify with 123
  reverse_proxy backend:8080
}

2. OAuth2 Login ​

Caddy redirects to identity provider:

nginx
security {
  oauth identity provider generic {
    realm generic
    driver generic
    client_id ab098fe1-9bc0-4780-81c6-2ea17f49a3cb
    client_secret pU3ZrOyPTtd4A3ex16dBzBTlDrlxqfpU
    scopes openid email profile
    base_auth_url http://pocketid.localhost
  }
}

3. Manager Integration ​

Productify plugin communicates with Manager:

nginx
productify {
  manager http://172.17.0.1:8080
  token supersecrettoken
}

The token is sent as a bearer token on the proxy's calls to the Manager API.

4. Application Routing ​

Route to application after validation:

nginx
route /* {
  authorize with pocketpolicy
  productify with 123  # Application ID
  file_server {
    root /usr/share/caddy
  }
}

Use Cases ​

Multi-Tenant SaaS ​

Route traffic based on authentication and application ID:

nginx
http://app.localhost {
  route /* {
    authorize with pocketpolicy
    productify with 123
    reverse_proxy backend:8080
  }
}

Manager UI/API ​

Protect Manager interface with authentication:

nginx
http://manager.localhost {
  @auth {
    path /auth/*
  }

  route @auth {
    authenticate with pocketportal
  }

  route /* {
    authorize with pocketpolicy
    reverse_proxy 172.17.0.1:8080
  }
}

Machine User Authentication ​

ESB routes accept machine user credentials only, validated against the Manager:

nginx
http://app.localhost {
  vars app_id 64e163af-2f6b-4b2c-9a84-ec3c8dfbbe67

  handle /esb/* {
    route {
      productify_esb_auth with {vars.app_id}
      productify with {vars.app_id}
      uri strip_prefix /esb
      reverse_proxy manager:8080 {
        rewrite /esb/{vars.app_id}{uri}
      }
    }
  }
}

Machine users authenticate with Authorization: Bearer <token> or Authorization: Basic <credentials>; PAT and OAuth credentials are rejected on ESB routes.

Benefits ​

Authentication & Authorization ​

  • OAuth2/OIDC - Standard protocol support
  • Policy-based access - Fine-grained control
  • Token validation - Bearer token support for APIs
  • Claims injection - Forward user context to backends

Manager Integration ​

  • Credential validation - PATs and machine users are validated via the Manager API
  • Machine users - Automated client authentication
  • Centralized identity - User and tenant context resolved by the Manager

Security ​

  • TLS 1.3 support by default
  • OCSP stapling for certificate validation
  • Security headers - configurable via Caddy's header directive
  • Token-based authentication

Monitoring ​

  • Prometheus metrics - Built-in metrics endpoint on :2112
  • Custom metrics - Application-specific tracking
  • Access logs - Detailed request logging with source, user, and target system
  • Request/Response metrics - Optional size and performance tracking

Requirements ​

  • Caddy 2.10 (bundled in the custom build)
  • Productify Manager instance for credential validation
  • Identity Provider (OAuth2/OIDC compatible)
  • DNS pointing to proxy instance(s)

Next Steps ​

  1. Follow the Quick Start guide
  2. Configure your Caddyfile
  3. Deploy to production