Tiyi

v3.8.0 · 2026-09-22: review the release notes before upgrading. This release requires fresh state.

English · 中文 · Website

One executable to protect your websites and APIs. Tiyi includes a reverse proxy, automatic TLS, web application firewall, API request validation, and a management console. Runs on Linux amd64/arm64. The built-in local node is free and fully featured, with no Docker, external database, or source build required.

Tiyi in 76 seconds

Install one binary, route an upstream, publish a site, block SQL injection, and inspect the evidence — one complete operator path.

https://github.com/user-attachments/assets/9d5b2eed-3956-41e6-bc39-b8c7048b7f44

_{Native GitHub player · 1 min 16 sec · no audio}
Guided web demo · 1080p MP4 · 1440p MP4

The original recording shows the getting-started workflow; see the quickstart for the current UI.

Get running

On a fresh host, install and start the signed release. Save the one-time administrator password printed in the terminal.

curl -fsSL https://www.tiyisec.com/install.sh | bash && sudo tiyi install --now

Open http://SERVER_IP:8080 in your browser, replacing SERVER_IP with the Tiyi host's IP address. Tiyi listens on 0.0.0.0:8080 by default. Follow the quickstart from login to a normal 200 response and a SQL-injection 403.

For mainland China, download the script from https://gitee.com/tiyisec/tiyi/raw/main/install.sh and set TIYI_MIRROR=gitee when running it. Existing installation? v3.8.0 cannot reuse v3.7.2-or-earlier state. Read upgrade and migration before installing.

The default is a systemd service enabled at boot, with website ports 80/443 and management on 8080. HTTPS needs a site and certificate. Choose manual steps, custom ports, or offline installation; then follow practice and advanced use. The default downloads the latest stable release; check tiyi --version.

Continue with your task

English documentation hub · 中文文档 · v3.8.0 notes.

Capabilities

Protect against common SQL injection/XSS; tune CRS, precise exceptions, and virtual patches per site; manage request/upload limits, rate controls, IP/country access, and Bot verification. Discover APIs, import OpenAPI/Swagger, learn JSON structure, and validate individual endpoints. Operate multiple origins, path routes, certificates, and renewal. Investigate traffic/evidence and integrate alerts, SIEM, and Prometheus. Manage access with RBAC, LDAP/AD, RADIUS, OIDC, SAML, and TOTP. Optional AI Copilot is off by default and remains advisory.

Remote Agents require signed licensed capacity; local features remain complete. There is one writable Controller; remote Agents keep serving their last accepted configuration during its outage. This repository distributes the installer, public key, user docs, and skill. Signed binaries are attached to GitHub Releases and Gitee Releases. Tiyi uses Caddy, Coraza, OWASP CRS 4, and SQLite.

AI Agent Skill

The public tiyi-operator skill helps an AI install, publish sites, configure API protection, and troubleshoot through supported UI/CLI/API interfaces. It serves installed-product users and needs no private source tree or release tools.

Codex personal installation:

TIYI_SKILL_DIR="${CODEX_HOME:-$HOME/.codex}/skills/tiyi-operator"
mkdir -p "$TIYI_SKILL_DIR/agents"
curl -fsSL https://raw.githubusercontent.com/zzmzm/tiyi/main/skills/tiyi-operator/SKILL.md \
  -o "$TIYI_SKILL_DIR/SKILL.md"
curl -fsSL https://raw.githubusercontent.com/zzmzm/tiyi/main/skills/tiyi-operator/agents/openai.yaml \
  -o "$TIYI_SKILL_DIR/agents/openai.yaml"

For Claude Code use $HOME/.claude/skills/tiyi-operator/ and download the same SKILL.md. For mainland China, substitute https://gitee.com/tiyisec/tiyi/raw/main as the URL prefix. Example request: “Use tiyi-operator to connect app.example.com to my existing origin; show the change preview first.”

Support and license

EULA · Third-party notices · Security reporting. For other problems, open an issue with the version, symptoms, and sanitized logs.