BurrowGate started because every service I self-host sits behind a reverse proxy, and the proxy was never the whole job. I would add fail2ban, then rate limiting, then a separate dashboard to see who was hitting my servers, then something to put a login in front of the apps that have no auth of their own... So this is the version where one container does it. It terminates TLS and gets Let's Encrypt certificates on its own, routes by hostname, load balances across origins with health checks, identifies and blocks bots, applies rate limits and IP, ASN or country policy, can put a proof-of-work or captcha challenge in front of a visitor, and can require a login with TOTP or a security key before a request ever reaches the app behind it. Every request shows up in a live dashboard with a world map, and you can replay any captured request with edited headers to see what the origin does. It's open source under EUPL-1.2. No paid tier, no hosted version, no enterprise edition held back. You run it, you own the data, and the only outbound request it makes is an hourly check for a new release, which one setting turns off. Getting started is four commands and a Docker Compose file. It generates its own admin password and a temporary certificate on first boot, then you add a site and click to issue a real certificate. Happy to answer anything here today, and I would like to hear what would stop you from putting it in front of your own services.

BurrowGate

Self-hosted reverse proxy and access gateway

Self-hosted reverse proxy and access gateway