Install it, configure it, run it

Full-access admin automation, live OpenAPI 3.2 JSON, and isolated read-only monitoring credentials.

Identify, verify, analyze, and block bot categories or individual agents per site and route.

Use one BurrowGate login across a separate frontend and API with signed assertions and backend verification.

Global users, Argon2id passwords, two-factor authentication, and signed identity headers.

TOTP and WebAuthn security keys, enrollment flow, per-site key scoping, and reset behavior.

OIDC single sign-on setup, enforcement, and back-channel logout.

IP, CIDR, ASN, and country rules, default actions, per-route overrides, and precedence order.

Opt-in Tor exit-node and dynamic ASN category detection (VPN, datacenter, ISP, and more) with monitor and block modes.

Per-path access modes, rate limits, header policies, and caching.

Per-site/per-route CORS policy that answers preflight requests directly, ahead of verification and access-list sign-in.

Site-wide Strict-Transport-Security with optional includeSubDomains and preload.

Optional request/response body capture with size limits, content-type filtering, and expiration.

Optional request/response header capture with default Authorization/Cookie redaction and expiration.

Replay any captured request from the dashboard, with editable headers/body and redirect following.

Managed WAF rules, monitor/block modes, and versioned rule metadata.

How the challenge provider registry works, for building your own.

Customizing the HTML a visitor sees during a browser challenge.

Custom HTML or JSON responses for blocks, limits, and origin failures.

Let's Encrypt automation via HTTP-01 or DNS-01, uploaded certificates, and key encryption.

Per-origin client certificates and BurrowGate-issued origin server certificates, usable independently or together.

Serve a folder directly from disk (no backend process) with clean URLs, SPA fallback, and range support.

TCP/UDP proxying, incoming and outgoing PROXY protocol, TLS termination, origin health checks, and host networking.

PROXY protocol v1 and v2 for HTTP, HTTPS, and TCP Streams, with trusted load balancer settings and direct connections.

Defer listener-affecting Site and Stream edits to a chosen time instead of applying them immediately.

Origin, connectivity, and IP-ban webhooks to ntfy, Slack, Discord, or signed JSON, with durable ordered delivery.

Act as a CrowdSec remediation component, enforcing Local API decisions per site, route, and Stream, with optional AppSec (WAF) inspection and captcha decisions served by the challenge chain.

Push auto-banned IPs to a UniFi controller, local nftables, OVH's edge firewall, or an AWS VPC Network ACL, with a never-ban whitelist and oldest-first eviction.

Client vs. upstream bandwidth counters and aggregation.

Live status and historical graphs for host/container CPU, memory, disk, and network usage, plus alert thresholds - all on the dashboard's Host page.

MaxMind country and ASN database setup and the optional auto-updater profile.

Prometheus and OpenTelemetry Collector export reference.

How the dashboard checks GitHub Releases and shows an update badge with release notes.

Clustering, replication, automatic failover, and split-brain protection across multiple BurrowGate nodes.