Use CEL for a condition, Lua or JavaScript for a header or body rewrite, and Rego for policies your team already maintains. Package reusable hooks as extension bundles. WASM supports compiled response transforms and bundles with a defined ABI.
Start with the hook you need. An expression policy returns a decision; a modifier returns headers; a transform returns a body. The scripting reference lists what each hook receives and what happens if it fails.
Use CEL when the decision fits one expression. Compile-time syntax checks catch errors before a new config starts serving requests.
Regorus evaluates Rego inside the proxy. Reuse a policy module, supply base data separately, and test its decisions with sbproxy rego test.
Each call gets a fresh sandboxed Luau interpreter. A modifier applies the returned set_headers map; lua_json transforms call modify_json on parsed JSON.
Inline JavaScript uses QuickJS with a fresh runtime per invocation. Bundle hooks use named ES module exports and can transpile TypeScript at load time.
The wasm response transform reads the buffered body from stdin and writes a replacement to stdout. Envelope bundles and Proxy-Wasm filters use different contracts.
sbproxy validate compiles declared CEL expressions and checks typed configuration. Inline Lua and JavaScript syntax errors appear when those scripts run, so exercise their request paths before deployment.
Rego policy modules compile at config load; Rego modifiers compile per invocation. Bundle candidates validate source, exports, digests, and runtime contracts before publication.
A failed expression or Rego policy denies the request. A failed header modifier logs the error and proceeds without its headers. Transform behavior follows the configured failure posture.
Bundle action and authentication hooks fail closed. Other supported hook kinds use their resolved failure posture. The scripting reference lists these outcomes by surface.
These configurations come from the runnable examples in the repository. Each tab names the hook contract. Keep request modifiers separate from body transforms when you adapt them to your own origin.
# yaml-language-server: $schema=../../schemas/sb-config.schema.json
# CEL expression policy.
#
# Allows requests only when the `X-Tenant` header equals `acme`. CEL header
# keys are normalized to lowercase with hyphens preserved,
# so `X-Tenant` is read as `request.headers["x-tenant"]`. Anything else
# gets a 403 before test.sbproxy.dev is contacted. This is the path to take for
# custom access control beyond simple IP or key checks.
#
# Run:
# make run CONFIG=examples/cel-policy/sb.yml
#
# Test:
# # 403 - missing or wrong tenant header
# curl -i -H 'Host: cel.local' http://127.0.0.1:8080/get
# curl -i -H 'Host: cel.local' -H 'X-Tenant: other' http://127.0.0.1:8080/get
#
# # 200 - matches the allowed tenant
# curl -i -H 'Host: cel.local' -H 'X-Tenant: acme' http://127.0.0.1:8080/get
proxy:
http_bind_port: 8080
origins:
"cel.local":
action:
type: proxy
url: https://test.sbproxy.dev
policies:
- type: expression
expression: 'request.headers["x-tenant"] == "acme"'
deny_status: 403
deny_message: "tenant not allowed"
Inline Lua and JavaScript start a fresh interpreter on each invocation. For code that needs an outbound request, use a JavaScript bundle hook with a declared destination and a matching operator grant.
A bundle directory contains bundle.yaml and an entry file. JavaScript, TypeScript, Rego, envelope WASM, and Proxy-Wasm each support specific hook kinds. The manifest declares those hooks and their limits; SBproxy checks a complete candidate before making it active.
Git sources require a content digest and a full commit SHA, or a reference whose tag or commit Git can verify. Set digest_scope: bundle_v1 to cover the manifest and entry together. The extension bundle guide documents the exact digest calculation and reload behavior.
The guides below cover configuration, examples, failure behavior, and debugging. Cedar has a separate MCP authorization guide because it evaluates tool calls rather than general HTTP scripting hooks.
The site builds these reference pages from the core repository documentation. The examples link to the configuration and entry files you can run.
Limits differ by runtime and hook. Use the reference for the surface you configure.
The gateway is on GitHub under Apache 2.0 and you can install it right now, so nothing here is gated behind a sales call. Use this form for deployment questions, migration scoping, or anything you would rather not file as a public issue.