{"repo":"Tomasinjo/gatekeeper","free":true,"listed":false,"github":"https://github.com/Tomasinjo/gatekeeper","clone":"git clone https://github.com/Tomasinjo/gatekeeper.git","description":"A simple network access control system for your self hosted services","language":"Python","stars":17,"topics":[],"license":null,"category":"self-hosted-apps","readme_excerpt":"Gatekeeper Enables selective access from the internet to your self hosted services by whitelisting public IPs that sucessfully authenticated to selected service. Motivation I host multiple services for personal use, and of course want to use them also outside my own LAN. However, I don't like traditional approaches like always-on VPN or external SSO providers. So I decided to expose reverse proxy to the internet and use client certificates for all services, but it turns out that not all clients support it, e.g. NextCloud for Android. The service that actually works good with mTLS is Home Assistant. But then I got the idea: if a client successfully authenticates to Home Assistant using client cert, then I can treat it's IP as trustworthy and allow it to access also all other services that I otherwise wouldn't risk exposing to the internet. I find this approach a great balance between security and usability, however it is worth noting that this is not replacement for authentication, 2FA, hardening and other basic security measures. Keep in mind that whitelisted public IP can also be used by hundreds of other clients behind NAT for example. This can be partially mitigated by setting maximum number of whitelisted IPs to a small number. How it works Traefik is set up to mirror all requests destined to selected service also to another destination - the gatekeeper. Traefik will only mirror client requests after the client certificate was verified. The app will catch all requests of ","default_branch":null,"files":null,"tree":[],"storefront":"/r/Tomasinjo","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Tomasinjo/gatekeeper/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}