Self-hosted security & reliability
Harden what
you expose.
TLS, intrusion detection, secret scanning, vulnerability scanning and identity - running on your hardware. A working Docker Compose stack, pinned and documented, instead of twelve READMEs and a false sense of safety.
The stack
Fix the failures that actually happen.
Exposed ports, no TLS, leaked secrets, unpatched images, services with no login. Every component is MIT, Apache-2.0, BSD-3-Clause or MPL-2.0.
Edge
Reverse proxy with automatic HTTPS
Cloud-native edge router with auto-discovery
Monitoring
Uptime and service monitoring
Observability data pipeline
Detection
Collaborative intrusion prevention
Secret scanning before commit
Vulnerability scanning for images
Template-based exposure scanning
Identity
Authentication portal with 2FA
Full identity and access management
Policy as code
Network
Self-hosted mesh VPN control server
Pricing
Start with the edge. Add as you harden.
One-time purchase, instant delivery, free updates. Each tier ships its own bundle and its own course.
Edge Starter
A real front door and a watchful eye.
- 2 components: Caddy, Uptime Kuma
- Working docker-compose.yml
- verify.sh health check
- RUNBOOK.md
- Pinned source fetch
Security Pack
Adds intrusion detection and secret scanning.
- 4 components: adds CrowdSec, Gitleaks
- Everything in Starter
- Pre-commit hook setup
- Attack-pattern detection
Hardening Toolkit
Scan your stack, then lock the door.
- 7 components: adds Trivy, Nuclei, Authelia
- Everything in Security Pack
- Vulnerability scanning workflow
- Authentication portal
Pro + Support
Full identity, policy as code, log pipelines.
- 10 components: adds Keycloak, OPA, Vector
- Everything in Hardening
- IAM and policy design
- 30 days priority support
Complete + Onboarding
All twelve, plus a 1:1 session.
- All 12 components
- Everything in Pro
- 1:1 onboarding session
- Lifetime updates
What's inside
The integration layer, done properly.
docker-compose.ymlThe stack, wired and health-checked.env.examplePinned image tags for reproducible deploysverify.shProves each service is serving, not just runningRUNBOOK.mdTroubleshooting, backups, scanning recipesATTRIBUTION.mdEvery licence and pinned commitfetch-sources.shUpstream source at exact commitsdocs/One page per componentStop hoping nothing is exposed.
Put a real edge on your services, watch them, and scan what you run.
Get the stackFAQ
Straight answers.
Isn't this all free anyway?
Yes. Every component is open source and freely available upstream. What you're buying is the integration: a stack that comes up, the runbook, the scanning recipes, and the knowledge of which identity layer to use. Assembling that from twelve READMEs is the part that costs weekends.
Why not Vaultwarden, Authentik, SigNoz, Wazuh, Teleport?
Licence. Those are AGPL or source-available, so they can't be redistributed in a paid bundle. Every component here is MIT, Apache-2.0, BSD-3-Clause or MPL-2.0, verified by SPDX id. ATTRIBUTION.md lists each one.
Are the scanning tools dangerous?
Only if you point them at systems you don't own. Nuclei and Trivy are for checking your own infrastructure. Using them against third parties is both ineffective and illegal, and the documentation says so plainly.
What hardware do I need?
Docker Engine 24+ with the Compose v2 plugin. 2 GB RAM for the edge tier, 4 GB with detection, 8 GB once Keycloak is involved. Running everything wants 16 GB.
Do I need all twelve?
No. Caddy plus Uptime Kuma fixes the most common problems immediately. Add CrowdSec and Gitleaks next. Most setups never need Keycloak.
Will this make me secure?
It removes the common failures: no TLS, no monitoring, leaked secrets, unpatched images, services with no login. That is most of what actually goes wrong. It is not a guarantee, and the docs don't pretend otherwise.