What it does

HTTP/1.1, HTTP/2 and HTTP/3

A certificate per name, WebSockets and HSTS, and the real client address from behind Cloudflare, a trusted proxy or the PROXY protocol.

Automatic certificates

ACME issuance and renewal (HTTP-01, DNS-01 with Cloudflare or deSEC), and a built-in local CA for LAN names.

Access control

Access lists, rule sets, rate limits, a proof-of-work browser check, and forward-auth to authentik, Authelia or oauth2-proxy.

A review before every change

Each change is shown as a diff before it goes live. Collect changes in a draft, and roll back any revision.

Logs, metrics and analytics

Access and error logs, a live tail with each request's timing, Prometheus metrics, traffic analytics and notifications.

REST API, YAML, CLI and MCP

An OpenAPI-described API, YAML import and export, a command line, and an MCP endpoint for AI assistants.

Secrets stay encrypted

Certificate keys, DNS credentials, TOTP secrets and access-list passwords are kept in a vault that one master key opens.

Quick start

With Docker and Compose v2:

mkdir paduraksa && cd paduraksa

# Download the compose file
curl -fsSLO https://raw.githubusercontent.com/hizkifw/paduraksa/main/deploy/compose.yaml

# Create the master key
head -c 32 /dev/urandom | base64 | sudo install -m 400 -o 10001 -g 10001 /dev/stdin master.key

# Start Paduraksa
docker compose up -d

# Print the one-time setup token
docker logs paduraksa 2>&1 | grep -A8 "Paduraksa first-run setup"

master.key is the only key to the vault, and a backup does not contain it. Open https://localhost:9443/ on the server and create the Owner with the setup token. Getting started goes on from there to a service behind HTTPS.