Gatekeeper
Puts one password in front of any app on the LAN, answering Traefik forwardAuth with a signed session cookie so the protected app stays untouched.
- Started
- 2026
- Stack
- TypeScript, Node.js, Traefik, Docker
- Kind
- Pet
- Source
- Private
Why I built it
Protecting LAN apps with basic auth forces an unwanted username, caches credentials with no real session, and gives no way to expire or revoke a login.
What it does
- Answers Traefik forwardAuth: 200 with a valid cookie, 302 to a login page without one
- Holds all state in one signed cookie (expiry.nonce.hmac), so a restart signs nobody out
- Stores the password as a scrypt hash and compares in constant time
- Rate limits failed attempts per address: 8 tries, then a 15 minute wait
How it is built
A Node/TypeScript service behind Traefik's forwardAuth middleware, issuing an HMAC-SHA256 signed cookie scoped to a parent domain so one login covers every protected host.
How it evolved
- 2026Scoped
Protecting LAN apps with basic auth forces an unwanted username, caches credentials with no real session, and gives no way to expire or revoke a login.
- 2026Built
A Node/TypeScript service behind Traefik's forwardAuth middleware, issuing an HMAC-SHA256 signed cookie scoped to a parent domain so one login covers every protected host.
- 2026Live
Shipped and still improving it.
Built by Syed Tasavour. More at syedtasavour.com.