Six projects, one family

What I build

Aegis × Burrow is the host: one login in front of everything, and a tunnel for any port. Bulwark guards it. The rest install from its dashboard, in the same addon format. Every demo below is the real interface.

Aegis × Burrow

One post-quantum login in front of everything you self-host, on a tunnel engine that gives any port its own HTTPS address.

  • A login nobody can read. Your password is sealed twice in the browser with keys from an ML-KEM-768 + X25519 exchange. Cloudflare only sees ciphertext.
  • Any port, its own address. On your domain, a wildcard, or a free trycloudflare.com name. Behind the login, a password, or open.
  • Your machines on one map. Link a box with one command; the gate watches it and keeps a standby copy of itself.
  • Addons and updates. Bulwark, Termix, Selkies Forge and the rest install from the dashboard. It updates itself, with versions to roll back to.
$curl -fsSL https://raw.githubusercontent.com/alexd-aero/aegis-burrow/main/install.sh | bash

Burrow

The engine inside Aegis × Burrow: any port on your machine, at its own HTTPS address. No ports opened on your router.

How it works ↗

Try it: publish a port

.example.com
https://grafana.example.com
  • Your domain, or none. One Cloudflare authorization links your own domain. Without one, every tunnel gets a free trycloudflare.com address.
  • One wildcard record. Every tunnel at NAME.tunnel.example.com, with your own certificate held on a small VPS relay.
  • Ports on an address. Another whole site on docs.example.com:8080.
  • Clone a link. Put someone's tunnel on an address of yours. Their gate still decides who may open it.
  • A control socket. Apps on the same machine publish their own tunnels. Selkies Forge does, for every desktop.
  • Extensions. Addons run inside Burrow and add a page to it. Burrow Pages is built that way.

Bulwark

A shield for everything you publish from home. It judges every request inside the gateway, in microseconds, before your app sees it.

  • Sees through disguises. Double-encoded, fullwidth and overlong paths are decoded the way your app would, then judged.
  • Names every attack. 21 categories, 44 tagged CVEs, MITRE ATT&CK and OWASP references on every hit.
  • Bans everywhere at once. Two payloads from one address and it's out of every tunnel and the dashboard.
  • Sees waves coming. Surges, campaigns and clusters, each with a forecast. A critical one turns strict mode on by itself.

On by default in Aegis × Burrow. Also an addon for Selkies Forge, or its own app.

Try to get past it

Bulwark's real detection engine, copied unchanged from its repository, runs in this page. Two payloads from one address get it banned, like on a real gate.

BulwarkLiveOverviewPatternsListsInspectorloading the engine…
…
normalizematchlexersscore
Livesample traffic from documentation addresses, judged as it arrives

Selkies Forge

Turns any Linux machine, even a Raspberry Pi, into a launch pad for 153 Linux desktops that run in your browser.

  • Pick, click, done. Ubuntu with Xfce, Fedora with KDE, Kali, Arch with i3, or let it choose for your memory and cores.
  • It checks its own work. Downloads or builds the desktop, starts it in Docker, makes sure it really works, heals it if not.
  • GPU and IPv6. Smart GPU passthrough where the hardware allows; every desktop on its own IPv6 network.
  • One file. Python's standard library and Docker. Nothing to configure.
$curl -fsSL https://raw.githubusercontent.com/adatskov-wcpss/animated-fiesta/main/docker.sh | bash
Selkies Forge: picking a desktop from the catalog Selkies Forge: a desktop's page Selkies Forge: your running desktops

Burrow Pages

Your static sites from GitHub or GitLab, an upload, or a site that lives elsewhere, on your own subdomains.

  • Push and it's live. Every push deploys; any earlier deploy is one click from live again.
  • Who can open it. Your Aegis login, a password of its own, or everyone, still behind the gate's shield.
  • Analytics without cookies. Who visits, from where, without a script in your pages.
  • Ports and short links. Another site on a port of the same address, and s.example.com/launch-style links with click counts.

An addon for Aegis × Burrow, built as a Burrow extension.

docs.example.comlive
  1. sourcegithub.com/you/docsmain
  2. pushfix the install guide4c2e91a
  3. buildnpm run build → dist/11 s
  4. livehttps://docs.example.combehind your login

What a site's page shows after a push. Illustration.

selfmail

Your own mail server with a modern web mail app, for home servers and Raspberry Pis that can't open port 25.

  • One script. Postfix, OpenDKIM and the web app; everything else happens in the browser.
  • DNS done for you. Connect Cloudflare and it writes the records, then checks each one against public DNS.
  • A mail app that's nice to use. Command palette, undo send, every domain you own in one inbox, catch-all addresses.
  • Alerts for the family. Announces itself on the Weft mesh, so Bulwark can email you about attack waves.
$git clone https://github.com/alexd-aero/selfmail.git && cd selfmail && sudo ./setup.sh
selfmail: the inbox selfmail: domain and DNS

Weft

The addon format behind Selkies Forge and Aegis × Burrow. Write an addon once and it installs in either.

  • One manifest, five scripts. forge-addon.json plus detect, install, update, uninstall and status, in bash.
  • Addons find each other. Running addons announce themselves on the Weft mesh; no one wires them together.
  • Any source. A git repository, a folder in one, or an archive.
  • Built for agents too. A validator, a stand-in host, and a strict brief an AI can follow.
// examples/pulse/forge-addon.json, from the repository
{
  "spec": 1,
  "id": "pulse",
  "name": "Weft Pulse",
  "version": "1.0.0",
  "requires": { "forge": ">=1.10.0", "burrow": ">=2.0.0" },
  "scripts": {
    "detect": "weft/detect.sh",
    "install": "weft/install.sh",
    "update": "weft/install.sh",
    "uninstall": "weft/uninstall.sh",
    "status": "weft/status.sh"
  },
  "actions": [{ "id": "restart", "label": "Restart" }]
}