Running it

Part of the Paladin docs.

What to set before Paladin carries production traffic, and how to tell it is actually enforcing.

Where it listens

By default the proxy listens on every interface, in plaintext, on port 8080. The admin plane is separate and binds loopback on 9090.

That default suits a laptop. On any shared network, bind the proxy to loopback and put TLS on it:

paladin up --listen 127.0.0.1:8080 --tls-cert cert.pem --tls-key key.pem

Check that it is enforcing

The paladin up command runs in the foreground. If that process exits, install-hooks leaves the hook wired into your agent, but there is no daemon behind it. When the hook cannot reach the daemon it allows the call, prints a warning on stderr, and exits zero.

That means a stopped daemon does not block your agents. It stops checking them. Run Paladin under whatever keeps your other services up, and check readiness before you trust a run:

curl -fsS http://127.0.0.1:9090/readyz

It returns non-zero when the daemon is down. Wire that into your service manager, or into the same check that starts your agents.

Supported platforms

Wheels are published for macOS on Intel and Apple silicon, Linux x86_64 (glibc), and Windows x86_64. There is no wheel for ARM Linux or for musl-based distributions such as Alpine yet. On those, pip reports that no matching distribution was found.