To protect self-hosted web services behind a unified single sign-on portal without deploying complex enterprise identity suites, Tinyauth acts as an OpenID Certified authentication server and reverse proxy middleware. Homelab operators and infrastructure teams place it in front of internal dashboards, media servers, and administrative tools routed through Traefik, Caddy, Nginx, Nginx Proxy Manager, or LinuxServer SWAG. Users can sign in with local bcrypt-hashed credentials, scan QR codes to enroll time-based one-time password authenticators for two-factor verification, or authenticate through external OAuth providers like GitHub, Google, and Pocket ID. Organizations running centralized directories can bind Tinyauth directly to an LDAP server such as LLDAP or OpenLDAP and automatically synchronize group memberships for role-based authorization. Fine-grained access control rules configured via dynamic Docker container labels or environment variables let administrators whitelist or block specific usernames, OAuth email regex patterns, OIDC groups, client IP CIDR ranges, and URL path prefixes per subdomain. For applications that support native federated login, the built-in OpenID Connect 1.0 discovery endpoint, authorization code flow, and userinfo API allow seamless single sign-on with optional consent skipping for trusted clients. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

For developers who want a complete visual backend without stitching together separate database, auth, and storage services, Bknd delivers an all-in-one self-hosted Backend-as-a-Service platform with a built-in administrative dashboard. Data schemas evolve visually. Authentication strategies plug in cleanly. Media uploads route straight to object storage. Inside the interactive Admin UI, you can create relational entities, define field validation rules, inspect records, and test generated REST and OpenAPI endpoints on the fly. User management comes ready out of the box with configurable password and OAuth authentication flows, role-based access permissions, and row-level security policies for multi-tenant SaaS products. A unified media manager connects local filesystems, S3 buckets, Cloudflare R2, MinIO, or Cloudinary so applications can handle user avatars, document attachments, and galleries without custom upload pipelines. Visual workflow automation lets you chain triggers, HTTP tasks, and data mutations into repeatable backend flows, while an integrated Model Context Protocol server allows AI agents to query and manage application state directly. You can operate entirely through the visual dashboard, lock down production schemas in code-only or hybrid modes, and connect frontend interfaces using pre-configured login and upload elements. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.