We spent several days rebuilding 1lan, our reverse-tunnel service, so that each machine gets an allocated endpoint instead of one derived from its own IP address. The rebuild went fine. What was interesting was the bugs.

We’ve published the core of Authinator3 as open source under the ISC license: gitlab.com/jowolf/authinator3.

Authinator is a web login gateway for firewalls. Authenticate over HTTPS, click once, and your current IP address is granted passage through the firewall - everyone else sees a wall. It replaces both permanently-open management ports and brittle port-knocking schemes with something anyone can operate from a phone: a login page.

Authinator has guarded our own production gateways in one form or another since 2007.