Every server, embedded board, and edge gateway you manage becomes reachable through one SSH address in ShellHub, even when it sits behind NAT with no public IP and no open inbound port. A small agent on each device dials out to your server, so a box on a customer LAN or a cellular link needs nothing beyond outbound web access. Connect with the stock ssh client by typing [email protected]@server, or open a terminal in the browser, and scp, sftp, rsync, and port forwarding work unchanged. SSH identities tie every key to a named team member, so removing someone ends their access on every device at once. Default-deny access policies grant or block members, roles, users, or API keys by device tag, Linux login, and source address, and can require a fresh browser confirmation before a session opens. Provisioning keys enroll whole fleets through automatic, manual, webhook, or allowlist acceptance, with usage limits, expiry dates, and tags. The Sessions page records who connected to which device, as which login, and from where, and browser terminals can be recorded and replayed. A Docker connector turns containers into devices that policies can grant one by one. Four member roles shape what each person can change, and the HTTP API, API keys, and an MCP server let scripts and AI assistants list devices and review sessions. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

To protect self-hosted web services behind a unified single sign-on portal without deploying complex enterprise identity suites, Tinyauth acts as an OpenID Certified authentication server and reverse proxy middleware. Homelab operators and infrastructure teams place it in front of internal dashboards, media servers, and administrative tools routed through Traefik, Caddy, Nginx, Nginx Proxy Manager, or LinuxServer SWAG. Users can sign in with local bcrypt-hashed credentials, scan QR codes to enroll time-based one-time password authenticators for two-factor verification, or authenticate through external OAuth providers like GitHub, Google, and Pocket ID. Organizations running centralized directories can bind Tinyauth directly to an LDAP server such as LLDAP or OpenLDAP and automatically synchronize group memberships for role-based authorization. Fine-grained access control rules configured via dynamic Docker container labels or environment variables let administrators whitelist or block specific usernames, OAuth email regex patterns, OIDC groups, client IP CIDR ranges, and URL path prefixes per subdomain. For applications that support native federated login, the built-in OpenID Connect 1.0 discovery endpoint, authorization code flow, and userinfo API allow seamless single sign-on with optional consent skipping for trusted clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Wag is an authentication gateway for WireGuard that lets each device reach only the routes it should, and asks for a second factor before the sensitive ones open. Admins write access policies for everyone, groups, or single users, marking subnets, hosts, ports, and protocols as MFA-required, always allowed, or denied, and the most specific prefix wins, so one allowed address can sit inside a protected range. Devices join with a registration token, and the public endpoint answers with a finished WireGuard profile. Users then confirm a TOTP code, a WebAuthn security key, an OIDC single sign-on login that maps identity provider groups into Wag groups, or a PAM prompt, and repeated failures lock the account. Session lifetime and idle timeouts decide when they must prove themselves again. The browser portal lists users, devices, rules, registration tokens, and webhooks with real-time notifications, while a command line locks devices, resets MFA, and manages administrators. Webhooks turn JSON from an HR or identity system into new tokens or removed users and devices, and clients can fetch the list of guarded routes from a small API. Remote staff, contractors limited to one host, and homelabs are typical uses. When a server fails, the VPN remains reachable through clustering with witness nodes or an external etcd, and certificates arrive through ACME with HTTP-01 or Cloudflare DNS-01. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.