# Den-Worker-Proxy Architecture for Cloud Inference in OpenWork

> Discover the den-worker-proxy architecture for cloud inference in OpenWork. This HTTP gateway handles authentication, rate limiting, and traffic routing for efficient inference.

- Repository: [Different AI/openwork](https://github.com/different-ai/openwork)
- Tags: architecture
- Published: 2026-08-17

---

**The den-worker-proxy is a lightweight HTTP gateway that authenticates requests, enforces Redis-backed rate limits, and routes traffic from the OpenWork desktop client to cloud-hosted inference workers while exposing health endpoints and OpenTelemetry observability.**

The den-worker-proxy serves as the critical bridge between OpenWork's desktop interface and scalable cloud inference backends. As implemented in the `different-ai/openwork` repository, this service handles request validation, worker routing, and operational monitoring for the platform's serverless compute architecture.

## Health and Readiness Monitoring

In [`ee/apps/den-worker-proxy/src/app.ts`](https://github.com/different-ai/openwork/blob/main/ee/apps/den-worker-proxy/src/app.ts), the proxy exposes two essential endpoints for orchestration systems. The `/health` endpoint returns a simple JSON payload confirming service availability:

```json
{
  "ok": true,
  "service": "den-worker-proxy"
}

```

The `/ready` endpoint performs deeper dependency validation, specifically probing the database connection before returning status. When the database is unreachable, the endpoint returns a `503` status code with a detailed failure payload:

```json
{
  "ok": false,
  "service": "den-worker-proxy",
  "checks": {
    "database": "error"
  }
}

```

This design enables load balancers to route traffic away from unhealthy instances while providing clear diagnostic information.

## Request Routing and Authentication

The proxy validates JWT tokens extracted from the `Authorization` header to identify users and their target **Den** (the per-organization workspace). After authentication, it constructs a Redis rate-limiting key using the pattern `worker-proxy:${workerId}:${authState}:${method}:${ip}` to prevent abuse and replay attacks.

Once validated, the routing logic forwards requests to the appropriate inference endpoint. The implementation in [`src/app.ts`](https://github.com/different-ai/openwork/blob/main/src/app.ts) proxies the request to the worker's internal address, preserving headers and body while making cloud inference appear seamless to desktop clients:

```typescript
import { Hono } from "hono";

const app = new Hono();

app.post("/proxy/:workerId", async (c) => {
  const { workerId } = c.req.param();
  const token = c.req.header("Authorization")?.split(" ")[1];
  // Verify JWT → user & org
  // Rate-limit via Redis key `worker-proxy:${workerId}:…`
  const resp = await fetch(`http://inference-${workerId}.svc.internal${c.req.path}`, {
    method: c.req.method,
    headers: c.req.headers,
    body: c.req.body,
  });
  return new Response(resp.body, { status: resp.status, headers: resp.headers });
});

```

## Observability and Error Handling

According to [`ee/packages/utils/src/observability.test.ts`](https://github.com/different-ai/openwork/blob/main/ee/packages/utils/src/observability.test.ts), the service registers itself as `den-worker-proxy` with OpenTelemetry instrumentation. This enables distributed tracing across the entire OpenWork stack, from the desktop application through the proxy to the final inference execution.

For graceful degradation, the proxy returns structured error responses when downstream workers are unreachable or authentication fails, ensuring clients receive actionable HTTP status codes rather than connection timeouts.

## Deployment Architecture

The den-worker-proxy operates as an independent npm workspace defined in [`ee/apps/den-worker-proxy/package.json`](https://github.com/different-ai/openwork/blob/main/ee/apps/den-worker-proxy/package.json) under the name `@openwork-ee/den-worker-proxy`. In production environments, it runs alongside `den-web` and `den-api` services as configured in [`packaging/docker/docker-compose.den-dev.yml`](https://github.com/different-ai/openwork/blob/main/packaging/docker/docker-compose.den-dev.yml).

For local development, the `scripts/dev-local.mjs` script (specifically lines 175-232) launches the proxy on a dedicated `workerProxyPort`, enabling full-stack testing of the cloud inference pipeline. As documented in [`docs/memory-bank-architecture.md`](https://github.com/different-ai/openwork/blob/main/docs/memory-bank-architecture.md) (line 154), the proxy facilitates deployment into Daytona sandboxes, providing isolated execution environments for inference tasks.

## Summary

- The den-worker-proxy acts as a secure gateway between OpenWork clients and cloud inference workers, implemented in [`ee/apps/den-worker-proxy/src/app.ts`](https://github.com/different-ai/openwork/blob/main/ee/apps/den-worker-proxy/src/app.ts)
- Health checks include basic liveness (`/health`) and database-dependent readiness (`/ready`) endpoints that return `503` errors when dependencies fail
- Redis-backed rate limiting uses the key pattern `worker-proxy:${workerId}:${authState}:${method}:${ip}` to prevent abuse
- The service integrates with OpenTelemetry for distributed tracing under the service name `den-worker-proxy`, as verified in [`ee/packages/utils/src/observability.test.ts`](https://github.com/different-ai/openwork/blob/main/ee/packages/utils/src/observability.test.ts)
- Deployment utilizes Docker Compose alongside `den-web` and `den-api`, with support for Daytona sandbox environments and local development via `scripts/dev-local.mjs`

## Frequently Asked Questions

### How does the den-worker-proxy handle authentication?

The proxy extracts JWT tokens from incoming request headers, validates them to identify the user and their organization (Den), and verifies permissions before constructing the Redis rate-limit key and forwarding requests to inference workers.

### What happens when the database is unavailable?

When the database connection fails, the `/ready` endpoint returns a `503` status code with a JSON payload indicating `{"database": "error"}`, signaling orchestrators to remove the instance from the load balancer rotation while keeping the service process alive for retries.

### How is the den-worker-proxy deployed in development environments?

The `scripts/dev-local.mjs` script starts the proxy on a dedicated worker proxy port defined by the `workerProxyPort` variable, running it alongside other OpenWork services defined in [`packaging/docker/docker-compose.den-dev.yml`](https://github.com/different-ai/openwork/blob/main/packaging/docker/docker-compose.den-dev.yml) for local integration testing.

### What rate-limiting mechanism does the den-worker-proxy use?

The service implements Redis-based rate limiting using a structured key format `worker-proxy:${workerId}:${authState}:${method}:${ip}` that incorporates the worker ID, authentication state, HTTP method, and client IP address to prevent replay attacks and enforce usage quotas.