For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
Serve the UI on a gateway
Give the UI a gateway of its own so that UI traffic and proxy traffic do not share a port.
About
A generated configuration attaches the UI to the same default gateway that serves your proxy traffic. Giving the UI a gateway of its own keeps UI traffic and proxy traffic on separate ports. Separate ports let you publish the proxy port while the UI port stays internal, and they let you apply different authentication policies to each.
A gateway of its own is also the prerequisite for the next two guides, because an authentication policy in ui.policies applies to the gateway that serves the UI, and a TLS certificate is configured on that gateway.
Before you begin
- Install standalone agentgateway.
- Launch the UI so that you know where agentgateway serves it today.
Serve the UI on its own gateway
Note
The UI gateway is an addition, not a replacement. Agentgateway still serves a copy of the UI on the admin interface, which is loopback-only and which you do not need to change. Adding this gateway does not put the admin interface’s debugging endpoints on it. For more information, see The UI and the admin interface are not the same thing.
Next steps
- Secure the UI with an OIDC login on the gateway that you created.
- Expose the UI on your own HTTPS hostname.
