Warpgate

WireGuard is a cross-platform VPN tunnel and network interface for securely encapsulating IP packets over UDP. It uses a private key for each interface and public keys for peers; its Cryptokey Routing mechanism associates peers with allowed tunnel IP addresses, which select encrypted destinations when sending and act as an access-control check when receiving. The project uses cryptographic components including the Noise protocol framework, Curve25519, ChaCha20, Poly1305, BLAKE2, SipHash24, and HKDF. It is configured through the wg tool and ordinary system networking utilities, supports roaming between IP addresses, and is designed for use from embedded devices to backbone routers.

WebSSH is a self-hosted, multi-user browser workspace for SSH and SFTP, developed for homelabs and teams. It combines multiple SSH sessions in tabbed one-, two-, or four-pane layouts with persistent tmux shells when available, session-aware commands, diagnostics, notes, and a dual-pane file workspace. Its SFTP workspace supports uploads, downloads, previews, editing, file operations, and server-to-server transfers with progress, cancellation, quotas, path validation, and explicit conflict handling. The application also provides encrypted private-key storage, host-key decisions, passkeys, TOTP, recovery codes, optional OIDC and LDAP authentication, audit logging, backups, and administration controls. WebSSH is distributed for self-hosting through Docker and Docker Compose, with a persistent data volume and no hosted control plane or runtime CDN dependency. The project warns that the WebSSH host handles SSH credentials, terminal contents, and transferred files, and is licensed under the MIT License.

NetBird is an open-source, WireGuard-based overlay networking and Zero Trust Network Access platform for connecting remote users, cloud and on-premises resources, edge devices, containers, and agents through peer-to-peer encrypted tunnels. Its agents manage WireGuard connections, obtain peer candidates through ICE and STUN, exchange connection information through a signaling service, and use a relay when direct connections fail. A centralized management service maintains network state, peer addresses, access policies, and configuration updates, while the admin interface supports identity-based access control, network segmentation, SSO, MFA, device posture checks, private DNS, routes, exit nodes, SSH, reverse proxying, activity logging, and integrations such as Terraform and Ansible. NetBird can run as a hosted cloud service or be self-hosted; its repository includes the client, management, signal, and relay components, with most code licensed under BSD-3-Clause and the management, signal, and relay directories under AGPLv3.

Tailscale is a networking service for creating private WireGuard-based networks between a user's devices and servers. It can provide remote access over SSH and route traffic through an authorized device configured as an exit node, such as a local Mac, so external websites see that device's network address rather than the server's data-center address. The project includes the open-source `tailscaled` daemon and `tailscale` command-line tool, with the daemon running on Linux, Windows, macOS, and to varying degrees on FreeBSD and OpenBSD. The repository also supplies code used by Tailscale's mobile applications; platform-specific GUI wrappers and hosted-service components are separate. Packages are provided for several distributions, and the project uses WireGuard with authentication features including 2FA, OAuth, and SSO.

walgit is a Rust-based Git server distributed as a single binary that stores repositories in S3-compatible object storage or Google Cloud Storage, without a database, elected leader, or important local state. The object store acts as the source of truth: pushes are written as immutable objects and made visible by atomically rewriting a manifest with compare-and-swap, while local repositories serve as disposable caches. Replicas can point to the same bucket and serve repositories without coordination; compaction publishes compacted packs back into the log. It provides Git smart HTTP fetch and push, bundle-URI clones served as static files, Git LFS, a repository-browsing web UI, a JSON API with an SDK, per-repository push policies, webhooks, and token or OIDC authentication.