Guides

AdGuard Home is a network-wide DNS sinkhole that blocks ads and trackers for every device on your network at the DNS level, with optional DNS-over-HTTPS/TLS and DHCP server features.

Authelia is a self-hosted authentication and authorization server that adds single sign-on and two-factor auth in front of a reverse proxy like Traefik or Nginx.

Authentik is a flexible identity provider supporting OAuth2/OIDC, SAML, LDAP, and proxy-based SSO, officially deployed via a single downloadable Docker Compose file.

Configure unattended-upgrades so security patches install automatically without manual intervention -- reduces the window a known vulnerability stays unpatched on a server nobody logs into daily.

CrowdSec is a collaborative, behavior-based intrusion detection engine that parses logs for attack patterns and shares anonymized threat signals across its community, then relies on separate 'bouncer' components to actually block traffic.

Fail2ban watches service log files for repeated authentication failures and automatically bans offending IPs via firewall rules, using per-service 'jails' you enable in jail.local.

FreeIPA bundles LDAP, Kerberos, DNS, and a certificate authority into a single integrated identity management domain controller for Linux environments.

Headscale is an open-source, self-hosted implementation of the Tailscale coordination server, letting you run your own private WireGuard-based mesh network without Tailscale's SaaS control plane.

Open-source identity and access management — single sign-on (SSO), OAuth2/OIDC, and user federation for your other self-hosted apps.

MISP is a threat intelligence platform for storing, correlating, and sharing indicators of compromise between organizations and analysts, distributed as an official production-ready Docker Compose stack.

Web UI for managing nginx reverse proxies and free Let's Encrypt certificates — no nginx config file editing required.

Put Nginx in front of a service running on a local port, and issue it a free, auto-renewing TLS certificate via Certbot -- the standard way to expose a self-hosted app over HTTPS.

OpenLDAP is the reference open-source LDAP directory server; the project's own admin guide documents installing it by compiling slapd from source rather than via a packaged installer.

Passbolt is an open-source password manager built for teams, with OpenPGP-based encryption, officially deployed via a documented Docker Compose file including the database and TLS setup.

Network-wide ad and tracker blocking at the DNS level — one install protects every device on your network.

A free, open-source network-wide DNS sinkhole that blocks ads and trackers for every device on your network at the DNS level -- no per-device app or browser extension needed.

RadiusDesk is an open-source, web-based management front end for FreeRADIUS, used to run hotspots and manage network access for routers/APs (MikroTik, CoovaChilli, and more) from one dashboard.

Switch a Linux server from password SSH login to key-based authentication only -- removes the single most common attack surface (brute-forced passwords) on any internet-facing server.

Technitium DNS Server is a self-hosted, cross-platform authoritative and recursive DNS server with a built-in web console, DNS-over-HTTPS/TLS support, and ad/tracker blocking.

TheHive is a scalable security incident response platform for case and alert management, officially shipped as a Docker Compose bundle backed by Cassandra and Elasticsearch.

Lock down an Ubuntu server to only the ports it actually needs, using UFW (Uncomplicated Firewall) -- a friendly frontend for iptables that ships with Ubuntu.

Lightweight, self-hosted password manager server, compatible with official Bitwarden apps and browser extensions.

Open-source security monitoring — intrusion detection, log analysis, and compliance across your whole infrastructure.

WireGuard is a minimal, high-performance VPN protocol and kernel module that establishes encrypted point-to-point tunnels using static public-key pairs instead of certificates.

Full-featured open-source firewall and router platform, based on FreeBSD — replaces commercial firewall appliances.