Documentation

Reference for eggrd — the whole configuration surface, the CLI, and what to point a monitor at. It exists so that answering “what does this key do?” does not require opening the source.

Start here

You do not need any of the reference to get something running. eggrd scaffolds a working config and then tells you what is wrong with it.

$ cargo install eggrd
$ edgeguard init            # writes edgeguard.toml + a Dockerfile
$ edgeguard doctor          # validates it, warns on foot-guns
0 error(s), 2 warning(s)

$ UPSTREAM=http://localhost:3000 edgeguard

Or skip the toolchain. The image is amd64 and arm64, each built on its own native runner.

$ docker run -p 8080:8080 \
    -v ./edgeguard.toml:/etc/edgeguard/edgeguard.toml \
    mancube/eggrd:0.3.1

How the pages differ

Configuration is generated from src/config.rs by a script in the repository. The doc comment on each field is the description, and the Default implementation is the stated default, so the page cannot describe a binary that does not exist. If a field is ever added without a comment, the generator fails rather than emitting a blank row — a reference with silent holes in it looks complete and is not.

CLI and Operations are written by hand, because they carry judgement the source cannot: which of two health endpoints to point a probe at, why the split matters, what a metric is actually good for. Both were checked against the shipped binary rather than recalled.

What is proven, and what is not

The landing page carries a revision block stating which capabilities have been exercised against live infrastructure and how — TLS termination, the shared-store rate limiter, ACME issuance, and the WASM edge worker. It is kept honest deliberately: a row goes green only after something has actually been run, and a capability that cannot be demonstrated is marked as such rather than softened.

The one gap stated plainly: the WASM worker has been run on workerd, the runtime Cloudflare runs in production, but has not been deployed to a Cloudflare account serving public traffic. Routes, custom domains and secret bindings are therefore untested.

Something missing or wrong here is a bug worth reporting — open an issue. If the answer only exists in the source, these pages have failed at their job.