A self-hosted front door for apps that live on home labs, office LANs, and private clusters, Wiredoor publishes them to the internet without opening a single inbound port on the private side. The Wiredoor CLI on each remote machine dials out to the server over an encrypted WireGuard tunnel. Web apps and APIs are routed by domain and path, WebSocket traffic included, while TCP and UDP services such as SSH or Redis get a public port of their own. Public domains receive Let's Encrypt certificates, internal names fall back to self-signed ones, and Cloudflare or GoDaddy credentials let the server create DNS records itself. Any web route can demand OAuth2 sign-in with an email allow list and a few open paths, and every protocol accepts IP allow lists. Gateway nodes stretch one tunnel across a Docker network, Kubernetes cluster, or private subnet, so a single link serves many backends. Services can be switched off or given an expiry such as 30 minutes, 2 hours, or 1 day. The dashboard shows which nodes are connected and whether their services are enabled, while the CLI creates, enables, and disables services from a terminal. Optional Prometheus and Grafana views chart traffic and tunnel peers, and CrowdSec can block abusive addresses. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Hand-editing nginx configuration files to run a firewall is nobody's idea of a good afternoon, and Nginx-Love turns that chore into a dashboard. You manage domains, load balancing upstreams, and HTTPS backends through forms instead of config syntax, and the platform writes and reloads the underlying configuration for you. A ModSecurity firewall with the OWASP Core Rule Set inspects traffic to your sites, and you tune its rules from the interface rather than a text editor. Certificates arrive two ways: automated through Let's Encrypt, or uploaded manually when you bring your own. A Bot Manager fingerprints visitors with JA4 signals so you can welcome good crawlers, challenge suspicious automation, and block hostile bots by policy. Access lists filter by IP address, geography, and user agent, and multi-user roles let administrators, moderators, and viewers each see the controls appropriate to their job. Monitoring watches performance and attack patterns, sending alerts by email or Telegram when something needs attention. Configuration exports back up your setup, restores bring it back, and multi-node sync keeps a cluster of servers enforcing the same policy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Usulnet packs container management, Trivy security scanning, Nginx reverse proxy, scheduled backups, WireGuard VPN, firewall rules, and multi-node orchestration into a single 70MB Go binary with zero external runtime dependencies. Every module ships in one download with no paid tiers, no telemetry, and no edition gating. Container lifecycle management covers creation, start, stop, restart, pause, kill, and removal with bulk operations, real-time resource statistics, filesystem browsing, and settings editing. Trivy integration scans images and running containers for CVEs with severity scoring, generates SBOMs, and validates CIS benchmarks. The multi-node architecture supports standalone, master, or agent modes where agents connect over NATS JetStream with mTLS encryption, enabling remote Docker host management from a central dashboard. Reverse proxy configuration handles Nginx with automatic Let's Encrypt certificates, TCP/UDP stream proxying, access lists, and dead host detection. Backup operations capture container volumes and Compose stacks on configurable schedules with retention policies and full restore capabilities. A built-in application catalog provides 60+ one-click templates for common services. JWT license validation uses an RSA-4096 public key embedded in the binary, requiring no call-home and working entirely offline. For teams tired of maintaining separate tools for each infrastructure concern, Usulnet collapses the entire stack into a single point of management with Docker Compose deployment alongside PostgreSQL, Redis, and NATS.

CLIProxyAPI turns AI coding subscriptions you already hold into one standard API endpoint that any OpenAI, Gemini, or Claude compatible client can call. Connect Codex, Claude Code, Grok Build, and Gemini accounts through simple OAuth sign in flows, then point your editor, agent, or script at a single base URL instead of juggling separate tools. Add several accounts per provider and the proxy spreads requests across them with round robin load balancing, so a busy team can pool capacity instead of pressing against one account's limits. Streaming, non streaming, and WebSocket responses are supported where the provider allows them, which keeps interactive coding sessions responsive. Function calling and tool use pass through, so agents can still run commands, edit files, and call external tools through the unified endpoint. Multimodal requests combine text and images, covering screenshot driven debugging and visual questions. Gemini API keys, AI Studio accounts, and hosted Gemini access sit alongside subscription accounts, and OpenAI compatible upstreams such as OpenRouter can be added in configuration. A management API exposes control endpoints for companion dashboards, while a reusable Go SDK lets developers embed the proxy inside their own services. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Anubis is a self-hosted web firewall that stands in front of your website and makes suspicious visitors complete a lightweight challenge before their requests are allowed through. Place it between your load balancer or TLS terminator and the application it protects, with one instance guarding each service. Requests that look like scraper bots are weighed and challenged, which raises the cost of mass crawling so automated harvesting stops being free. Requests that pass are forwarded straight to your target service over TCP or a Unix domain socket, so legitimate visitors reach the real site. You define the bot policy: allowlist known good bots and crawlers you want to keep, challenge the ones you are unsure about, and turn away the rest. Challenge difficulty and weight thresholds tune how hard visitors must work, letting you balance protection against friction for real readers. The server listens on port 8923 by default and exposes Prometheus metrics on port 9090, so request and challenge rates show up in your existing monitoring. Deployment is a single Docker image or native package with minimal resource needs, and configuration arrives through environment variables plus the policy file. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Most proxies ask the operating system nicely for a socket; paqet skips the conversation, building its own TCP packets byte by byte to tunnel traffic between your machine and your server. The server end listens on a port you choose and speaks only in raw packets it crafts and captures itself through pcap, before the kernel's connection tracking ever sees them. On your machine, the client presents an ordinary SOCKS5 proxy on localhost plus optional port forwards, so browsers and command-line tools connect exactly as they would to any proxy. Between the two ends, KCP with smux multiplexing turns a stream of self-contained packets into fast, reliable, encrypted sessions, with AES or lighter modes selected per deployment. TCP flag cycling varies how packets present themselves on the wire, giving operators control over the traffic pattern the tunnel produces. Built-in utilities generate the shared secret, ping the server with a single test packet, and dump live traffic decoded, so a silent tunnel gets diagnosed in minutes rather than by packet-capture archaeology. One YAML file per side declares the role, network interface, gateway MAC, and keys, and the same binary runs both ends. It suits security research, hostile networks, and anyone whose ordinary proxies keep getting reset. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.