Hoverfly - API Simulation and Service Virtualization

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Hoverfly is a lightweight, open source API simulation and service virtualization proxy used by development teams worldwide. It sits between your application and the APIs it depends on, capturing real traffic, replaying it as fast deterministic simulations, spying on requests, or modifying responses, so your teams can develop and test against slow, flaky, rate limited, or unavailable third party APIs without ever calling the real service.

This AMI delivers Hoverfly fully installed as a single self contained Go binary under systemd, with the hoverctl command line tool, an nginx reverse proxy in front of the admin API, and JWT authentication enabled. Your API simulator is serving within minutes of launch with no manual wiring required.

## Why This AMI vs. Running Hoverfly Yourself

• Secure by default, not an open proxy: Hoverfly's admin API is unauthenticated out of the box and a forward proxy is an abuse magnet. This image enables JWT authentication, binds both the admin API and the proxy to loopback only, fronts the admin API with nginx, and requires proxy authentication, so your instance can never be abused as an open relay.
• Unique credentials on every launch: Many images ship with a published default password. This image generates a unique admin password and a unique JWT signing secret on every launch, stored only in a root only file. No shared or default credential ever exists.
• No database to manage: Hoverfly needs only portable simulation JSON files and a small embedded store, so there is no database server to provision, tune, patch or back up. You eliminate an entire failure domain and reduce monthly cost.
• Production ready in minutes: A shipped demo simulation proves the round trip immediately after boot. You go from launch to first simulated response without writing configuration.

## Application Stack

Hoverfly runs as an unprivileged systemd service and imports a demo simulation at startup, so the proxy is virtualizing traffic the moment the instance boots. nginx answers on port 80 and reverse proxies the loopback bound admin API on port 8888, gated by Hoverfly's JWT authentication. The proxy port 8500 is bound to loopback only and protected by proxy authentication. hoverctl manages simulations: capture live traffic, export it to JSON, and import it to replay as a virtual service.

## Security and Hardening

• JWT authentication is enabled on the admin API, with a unique admin password and JWT signing secret generated on first boot and stored only in a root only file
• The admin API and the proxy are both bound to loopback only; nginx fronts the admin API on port 80, and the proxy requires authentication so it is never an open relay
• The image ships with no usable or default credential; every instance mints its own on first boot
• The security group opens only SSH on port 22 and the nginx fronted admin API on port 80; the proxy is kept loopback only until you deliberately expose it to trusted clients
• TLS termination is recommended via an AWS Application Load Balancer or your own certificate on the instance

## Use Cases

• Development and QA teams replacing slow, flaky, rate limited or unavailable APIs with fast, deterministic virtual services, so tests run reliably and in isolation.
• CI and CD pipelines running integration and contract tests against captured API simulations instead of live dependencies, removing external flakiness and network cost from the build.
• Platform and microservices teams simulating fault, latency and edge case responses to prove how services behave when a dependency is degraded, before it happens in production.

## Getting Started

1. Launch the AMI from the AWS Marketplace listing.

2. SSH into the instance and retrieve the generated admin password from the root only credentials file.

3. Obtain a JWT token from the admin API via nginx on port 80.

4. Point any HTTP client's proxy setting at Hoverfly to replay the shipped demo simulation.

5. Use hoverctl to capture live traffic, export it to JSON, and import your own simulations.

The shipped demo simulation proves the full round trip immediately after launch. A step by step deployment guide is published at https://www.cloudimg.co.uk/guides/hoverfly-aws/.

## Evaluate at Low Cost

Hoverfly is comfortable on small instance types, so you can evaluate the product on a small instance, run your tests, and terminate at any time. There is no lock in or minimum commitment.

Hoverfly is developed by SpectoLabs Ltd and licensed under Apache-2.0. This product is not affiliated with or endorsed by SpectoLabs. This is a repackaged open source software product with additional charges for cloudimg support services. All product and company names are trademarks or registered trademarks of their respective holders.

## cloudimg Support