Home / Products / Switchyard

beta

Switchyard — Multi-Tenant Reverse Proxy Control Plane

Multi-tenant reverse proxy control plane

Django Python PostgreSQL Redis Celery Nginx Traefik Docker

About

Switchyard is a multi-tenant reverse-proxy, TLS, DNS, and edge-routing control plane for managing Nginx and Traefik instances across multiple nodes, networks, and organizations — an operations-grade dark UI inspired by rail switchboards and signal lights, not a clone of Nginx Proxy Manager. A platform-level Traefik edge proxy fronts all traffic on ports 80/443 and routes by hostname to each organization's own Nginx or Traefik instance, so the control plane itself is never in the path of proxied traffic.

Every organization gets full RBAC with additive Org Groups, per-org OIDC/SSO against any standards-compliant identity provider, reusable route Blueprints, and automated health Signals for every switch, route, and certificate. An append-only audit log — backed by tests proving org A can never read org B's events — sits alongside a platform-wide metrics dashboard and Prometheus scrape endpoint for operators running the whole thing.

Features

  • Multi-tenant RBAC — Owner/Admin/Operator/Viewer roles plus additive Org Groups for per-resource permission overrides
  • Per-org OIDC/SSO — works with Authentik, Keycloak, Okta, Entra ID, Google Workspace, GitLab, or any standards-compliant IdP
  • Provisions and manages Nginx and Traefik proxies via local Docker or remote SSH, with reusable route Blueprints
  • TLS certificate management and DNS zone registry with automatic write-back (Cloudflare, Route 53, ClouDNS)
  • Automated health Signals for every switch, route, and certificate, surfaced on a per-org Signal Board
  • Append-only audit log with proven cross-org isolation, plus a platform-wide metrics dashboard and Prometheus endpoint

Screenshots

Signal Board — per-org health dashboard Routes — list with health indicators and rate-limit badges Blueprints — reusable route templates User Profile — avatar, email verification, theme selection RBAC Org Groups — named groups with additive resource permissions System Settings — platform-wide admin configuration System Metrics Dashboard — host + container health, auto-refreshing

Notes

Claims ports 80 and 443 on its host for the platform edge proxy — do not install alongside another web server or reverse proxy on the same machine; use a dedicated server or VM. TLS is manual PEM upload or self-signed for now; ACME/Let's Encrypt is on the roadmap. Secrets can be sourced from HashiCorp Vault, AWS SSM/Secrets Manager, GCP Secret Manager, Docker Secrets, or a plain .env file.

Interested in Switchyard? Get in touch →