Skip to main content
Version: 1.8.0

Run DVARA Open Source

DVARA Open Source applies runtime governance to LLM traffic. This quickstart runs the DVARA LLM Gateway locally with the bundled Mock provider, so you can send and verify a governed request without a provider account.

DVARA Open Source is available under the Apache License 2.0.

Prerequisites​

Install Docker and make sure port 8080 is available.

1. Download DVARA​

Pull the 1.8.5 Open Source image:

docker pull ghcr.io/dvarahq/dvara-gateway-oss:1.8.5

2. Generate an API key​

Generate a key for the default workspace:

docker run --rm ghcr.io/dvarahq/dvara-gateway-oss:1.8.5 \
  --generate-key --name quickstart --workspace default

The command prints a gw_... key used by applications calling DVARA and a key_hash block for gateway.yaml.

Save the plaintext key in your shell. DVARA prints it only once.

export DVARA_API_KEY='gw_<the-key-printed-by-keygen>'

3. Create gateway.yaml​

Create gateway.yaml in your current working directory. Replace the example hash with the key_hash printed in the previous step.

providers:
  - type: mock

workspaces:
  - id: default
    metadata:
      pii.action: REDACT
      guardrail.action: BLOCK

routes:
  - id: local-mock
    model: "mock*"
    provider: mock

api_keys:
  - key_hash: sha256:<the-hash-printed-by-keygen>
    name: quickstart
    workspace: default

policies:
  - id: approved-models-only
    workspace: default
    status: ACTIVE
    dsl: |
      version: "1"
      rules:
        - id: deny-unapproved
          conditions:
            model:
              denylist: [mock/unapproved]
          action: DENY
          deny_message: "mock/unapproved is not an approved model"

This configuration enables the Mock provider, applies PII and guardrail controls to the workspace, and denies one model so you can see a policy decision without calling a real provider.

4. Start DVARA​

Start the gateway and write its audit records to a file inside the container:

docker run --rm --name dvara -p 8080:8080 \
  -v "$PWD/gateway.yaml:/app/gateway.yaml:ro" \
  -e DVARA_AUDIT_FILE_PATH=/tmp/audit.log \
  -e DVARA_AUDIT_HMAC_SECRET="$(openssl rand -base64 32)" \
  ghcr.io/dvarahq/dvara-gateway-oss:1.8.5

Wait until the gateway reports that it has started. Leave this terminal open.

5. Send a model request​

In a second terminal, send a request through DVARA:

curl -s http://localhost:8080/v1/chat/completions \
  -H "Authorization: Bearer $DVARA_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "mock/test-model",
    "messages": [
      {"role": "user", "content": "Why does runtime AI governance matter?"}
    ]
  }'

The Mock provider returns an OpenAI-compatible response without sending data to an external model provider:

{
  "id": "mock-6d0d5f08d3dd4aa5b536ba765cb0be63",
  "object": "chat.completion",
  "model": "mock/test-model",
  "choices": [
    {
      "index": 0,
      "message": {
        "role": "assistant",
        "content": "This is a mock response"
      },
      "finish_reason": "stop"
    }
  ]
}

Identifiers and usage values vary between requests.

6. Verify a policy decision​

Send the model name denied by the policy in gateway.yaml:

curl -s -w '\nHTTP %{http_code}\n' \
  http://localhost:8080/v1/chat/completions \
  -H "Authorization: Bearer $DVARA_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "model": "mock/unapproved",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

DVARA refuses the request before it reaches the provider:

{
  "error": {
    "message": "mock/unapproved is not an approved model",
    "type": "policy_violation",
    "code": "policy_denied",
    "trace_id": "99115c790f614434b3d5bda41eecacc1"
  }
}
HTTP 403

The trace identifier changes on each request.

7. Check the audit record​

Read the policy and response events written by the gateway:

docker exec dvara cat /tmp/audit.log \
  | grep -E '"eventType":"(POLICY_DENIED|GATEWAY_RESPONSE)"'

The audit records identify the workspace, decision, response status, sequence, previous hash, and HMAC. They do not include the prompt or response text unless you separately configure that retention.

Connect a model provider​

Replace the Mock provider and route with a provider you use. For example:

providers:
  - type: openai
    api_key: ${OPENAI_API_KEY}

routes:
  - id: openai-models
    model: "gpt*"
    provider: openai

Pass OPENAI_API_KEY to the container and restart DVARA. Keep provider credentials in environment variables rather than writing them into gateway.yaml.

Run the JAR instead​

If you prefer a Java process, install JDK 25 and download the runnable JAR:

curl -fLO https://repo1.maven.org/maven2/com/dvarahq/dvara-gateway-server/1.8.5/dvara-gateway-server-1.8.5-app.jar

DVARA_AUDIT_FILE_PATH="$PWD/audit.jsonl" \
DVARA_AUDIT_HMAC_SECRET="$(openssl rand -base64 32)" \
java -jar dvara-gateway-server-1.8.5-app.jar

The Java process reads gateway.yaml from its working directory.

Next steps​