menecio / django-api-bouncer

Simple Django app to provide API Gateways for micro-services

API Bouncer

API Bouncer is a simple Django app to provide an API Gateway for micro-services.

It's heavily inspired by Kong

Requirements

• Python (3.5, 3.6)
• Django (1.10, 1.11)
• Django Rest Framework (3.6)
• PostgreSQL (9.4+)
• psycopg2 (2.5.4+)

Quick start

Add "api_bouncer" to your INSTALLED_APPS setting like this:

    INSTALLED_APPS = [
        # all other Django apss you have...
        'api_bouncer',
    ]

Activate the key-auth plugin by adding the middleware on your settings.py:

    MIDDLEWARE = [
        # all other middleware...
        'api_bouncer.middleware.bouncer.BouncerMiddleware',  # required
        'api_bouncer.middleware.key_auth.KeyAuthMiddleware',
    ]

Important! Note that you need to include BouncerMiddleware before the rest of plugin middleware. Otherwise it will not work.

Include the api_bouncer URLconf in your project urls.py like this:

    url(r'^', include('api_bouncer.urls', namespace='api_bouncer')),

Run python manage.py migrate to create the api_bouncer models.

Available plugins

Authenticacion

• Key authentication: Add key authentication to your API

Security

• ACL: Control which consumers have access to your API
• IP restriction: Blacklist or whilelist IPs that can access your API

Traffic Control

• Request termination: Terminate all request with a specific response.

Documentation

Documentation can be found in the docs directory or here

django-api-bouncer's Issues

Increase test coverage

Add enough test cases to validate a stable flow, from adding a new api, creating consumers, enabling plugins and handling simple api requests.

Goal: at least 80% of coverage

Generate docs page

Use sphinx to generate detailed docs, publish it on readthedocs.org

Create ACL plugin

Make a plugin that allows to define groups whitelists/blacklists and include consumers into groups

1. An API can have a group whitelist or blacklist, not both
2. Consumers can be added to groups
3. As specified a consumer might or might not have access to an API based on the groups it belongs.

Documentation for plugins

Add a plugins documentation section to describe available plugins and how to use them

Request termination plugin

Allow to terminate incoming requests with a specified status code and message.

• Temporary block an API

• Temporary block a Consumer

Create IP whilelist plugin

Provide a way to declare IPs blacklists/whilelists for specific APIs