Prompt Gate Backend

Prompt Gate Backend is the Go service layer for Prompt Gate. It provides the HTTP API, the LLM proxy, scheduled background jobs, database migrations, OIDC authentication, Redis-backed runtime coordination, provider configuration, MCP configuration, token management, and firewall rule evaluation.

Requirements

• Go 1.25.6
• PostgreSQL
• Redis
• Keycloak or another OIDC-compatible provider for browser login
• Docker, for container builds and release verification

Local Setup

Create a local .env file with the required PROMPTGATE_* values. The Makefile loads .env automatically for run targets, and the Cobra CLI also loads the nearest .env when you run commands directly such as go run . api or go run main.go api. Use --env-file /path/to/file.env to point at a different dotenv file.

make deps
make test
make build

Run the backend services locally:

make migrate
make run-api
make run-proxy
make run-schedule

For a single local process group that runs migrations, the schedule worker, the API, and the proxy:

make run-all

Main Commands

make deps       # download Go modules
make fmt        # format Go files
make vet        # run go vet
make test       # run tests
make build      # build the backend binary into bin/
make clean      # remove local binaries

The Docker image builds one binary:

• /app/promptgate

The binary exposes four subcommands:

promptgate api
promptgate proxy
promptgate migrate
promptgate schedule

The default container command starts /app/promptgate api.

Docker

Build the production image locally:

docker build -t prompt-gate-backend:test .

Run the API from the image:

docker run --rm \
  -p 8080:8080 \
  -e PROMPTGATE_DATABASE_URL=postgres://postgres:postgres@host.docker.internal:5432/promptgate?sslmode=disable \
  -e PROMPTGATE_REDIS_URL=redis://host.docker.internal:6379/0 \
  -e PROMPTGATE_KEYCLOAK_ISSUER_URL=https://keycloak.example.com/realms/promptgate \
  -e PROMPTGATE_KEYCLOAK_JWKS_URL=https://keycloak.example.com/realms/promptgate/protocol/openid-connect/certs \
  -e PROMPTGATE_KEYCLOAK_CLIENT_ID=promptgate-backend \
  -e PROMPTGATE_FRONTEND_BASE_URL=http://localhost:3000 \
  -e PROMPTGATE_BACKEND_BASE_URL=http://localhost:8080 \
  -e PROMPTGATE_JWT_SECRET=change-me-change-me-change-me-32 \
  -e PROMPTGATE_SECRETS_KEY=change-me-change-me-change-me-32 \
  prompt-gate-backend:test

The image exposes ports 8080 for the API and 8081 for the proxy.

Documentation

• Deployment
• Environment variables
• Release process

Continuous Integration

The CI workflow runs on branch pushes and pull requests targeting main. It checks formatting, runs go vet, runs all tests, builds the binaries, and builds the Docker image without publishing it.

The Release workflow runs only when a semver tag matching vX.Y.Z is pushed. It publishes the Docker image to GitHub Container Registry and creates a GitHub Release.

Official image:

ghcr.io/prompt-gate/backend