{"id":30430406,"url":"https://github.com/archellir/sekisho","last_synced_at":"2026-02-11T13:01:45.743Z","repository":{"id":310770786,"uuid":"1041150465","full_name":"archellir/sekisho","owner":"archellir","description":null,"archived":false,"fork":false,"pushed_at":"2025-08-20T04:18:05.000Z","size":2,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-08-20T06:18:39.906Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/archellir.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-20T04:07:12.000Z","updated_at":"2025-08-20T04:18:10.000Z","dependencies_parsed_at":"2025-08-20T06:18:41.868Z","dependency_job_id":"885396dc-6aae-4d7d-87e8-f2944d87debd","html_url":"https://github.com/archellir/sekisho","commit_stats":null,"previous_names":["archellir/sekisho"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/archellir/sekisho","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archellir%2Fsekisho","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archellir%2Fsekisho/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archellir%2Fsekisho/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archellir%2Fsekisho/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/archellir","download_url":"https://codeload.github.com/archellir/sekisho/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/archellir%2Fsekisho/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29333155,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-11T12:42:24.625Z","status":"ssl_error","status_checked_at":"2026-02-11T12:41:23.344Z","response_time":97,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-08-22T18:19:03.189Z","updated_at":"2026-02-11T13:01:45.738Z","avatar_url":"https://github.com/archellir.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Sekisho (関所)\n\nA minimal zero-trust proxy for personal use. Single Go binary, no dependencies.\n\n\u003e **関所 (Sekisho)** - Japanese checkpoint stations that controlled access during the Edo period.\n\n## Features\n\n- **OAuth2/OIDC Authentication** - Google, GitHub, Microsoft providers\n- **Rule-based Authorization** - Flexible policy engine with glob patterns\n- **HTTP/HTTPS Reverse Proxy** - Full reverse proxy with connection pooling\n- **Session Management** - AES-256-GCM encrypted cookies\n- **Rate Limiting** - Token bucket algorithm with per-IP/user limits\n- **Security Headers** - Comprehensive security header injection\n- **Audit Logging** - JSON logs to stdout for log aggregation\n- **Health Checks** - Ready for monitoring stack integration\n- **Metrics Endpoint** - Prometheus compatible metrics at `/metrics`\n\n## Architecture\n\nPure Go standard library implementation:\n- **Zero external dependencies** - Only Go stdlib\n- **Single binary deployment** - ~10MB static binary\n- **In-memory session storage** - No external database required\n- **YAML configuration** - Simple, environment variable interpolation\n- **Kubernetes ready** - Single deployment file\n- **Security first** - Built with zero-trust principles\n\n## Quick Start\n\n### 1. Build from source\n```bash\ngit clone https://github.com/archellir/sekisho.git\ncd sekisho\nmake build\n```\n\n### 2. Generate configuration\n```bash\n./bin/sekisho -generate-config \u003e config.yaml\n```\n\n### 3. Configure OAuth (Google example)\n```bash\nexport OAUTH_CLIENT_ID=\"your-google-client-id\"\nexport OAUTH_CLIENT_SECRET=\"your-google-client-secret\"\n```\n\n### 4. Run\n```bash\n./bin/sekisho -config config.yaml\n```\n\n## Configuration\n\n### Basic Setup\n```yaml\nserver:\n  listen_addr: \":8080\"\n\nauth:\n  provider: \"google\"\n  client_id: \"${OAUTH_CLIENT_ID}\"\n  client_secret: \"${OAUTH_CLIENT_SECRET}\"\n  redirect_url: \"https://auth.yourdomain.com/callback\"\n\nupstream:\n  - host: \"app.yourdomain.com\"\n    target: \"http://app-service:8080\"\n\npolicy:\n  default_action: \"deny\"\n  rules:\n    - name: \"public_access\"\n      path: \"/public/*\"\n      action: \"allow\"\n    - name: \"authenticated_access\"\n      path: \"/*\"\n      require_auth: true\n      action: \"allow\"\n```\n\n### Advanced Policy Rules\n```yaml\npolicy:\n  rules:\n    - name: \"admin_only\"\n      path: \"/admin/*\"\n      methods: [\"GET\", \"POST\"]\n      allow_users: [\"admin@company.com\"]\n      action: \"allow\"\n\n    - name: \"api_access\"\n      path: \"/api/*\"\n      allow_users: [\"*@company.com\"]  # Wildcard domain matching\n      deny_ips: [\"192.168.1.100\"]     # IP blacklisting\n      action: \"allow\"\n```\n\n## Deployment\n\n### Docker\n```bash\nmake docker\ndocker run -p 8080:8080 \\\n  -e OAUTH_CLIENT_ID=your-id \\\n  -e OAUTH_CLIENT_SECRET=your-secret \\\n  sekisho:latest\n```\n\n### Kubernetes (behind nginx ingress)\n```bash\n# Edit OAuth credentials in deployments/k8s/sekisho.yaml first\nkubectl apply -f deployments/k8s/sekisho.yaml\n```\n\nThe deployment assumes you have nginx ingress handling TLS termination and routing traffic to the `sekisho` service on port 8080. Metrics are exposed on `/metrics` for your existing monitoring stack.\n\n## Security\n\n### Built-in Security Features\n- **AES-256-GCM encryption** for session cookies\n- **HMAC-SHA256 signatures** for cookie authentication\n- **Constant-time comparisons** for all token validation\n- **CSRF protection** with secure token generation\n- **Security headers** (CSP, HSTS, X-Frame-Options, etc.)\n- **Rate limiting** with token bucket algorithm\n- **Request ID tracking** for audit trails\n\n### OAuth2 Security\n- **State parameter validation** prevents CSRF attacks\n- **Secure redirect validation** prevents open redirects\n- **Token exchange** uses client credentials securely\n- **Session expiration** and automatic cleanup\n\n### Network Security\n- **TLS termination** handled by nginx ingress\n- **Minimal container** with basic security\n- **Service-to-service** communication via ClusterIP\n\n## Performance\n\n- **Sub-10ms latency** overhead for authenticated requests\n- **1000+ concurrent connections** supported\n- **Connection pooling** with keep-alive\n- **DNS caching** (5-minute TTL)\n- **Policy decision caching** (10,000 entry LRU cache)\n- **Memory usage** \u003c100MB for typical workloads\n\n## Monitoring\n\n### Health Checks\n```bash\ncurl http://localhost:8080/health\n# {\"status\":\"healthy\",\"service\":\"sekisho\"}\n```\n\n### Metrics (Prometheus compatible)\n```bash\ncurl http://localhost:8080/metrics\n```\n\n### Audit Logs\n```json\n{\n  \"timestamp\": \"2024-01-01T12:00:00Z\",\n  \"user\": \"user@example.com\",\n  \"action\": \"allowed\",\n  \"method\": \"GET\",\n  \"path\": \"/api/users\",\n  \"ip\": \"10.0.0.1\"\n}\n```\n\n## Development\n\n### Prerequisites\n- Go 1.25.0+\n- Make\n\n### Commands\n```bash\nmake help                 # Show all available commands\nmake build               # Build binary\nmake test                # Run tests\nmake test-cover         # Run tests with coverage\nmake docker             # Build Docker image\nmake deploy-k8s         # Deploy to Kubernetes\n```\n\n### Testing\n```bash\n# Unit tests\ngo test ./tests/unit/\n\n# Integration tests\ngo test ./tests/integration/\n\n# All tests with coverage\nmake test-cover\n```\n\n## Comparison\n\n| Feature | Sekisho | Pomerium | Teleport | Traefik | nginx | Authentik | Cloudflare ZT |\n|---------|---------|----------|----------|---------|-------|-----------|---------------|\n| Dependencies | 0 | Many (Go) | Many (Go) | Few (Go) | Few | Many (Python) | None (SaaS) |\n| Binary Size | ~10MB | ~15MB | ~50MB | ~25MB | \u003c1MB | N/A (Container) | ~10MB (agent) |\n| Memory Usage | \u003c100MB | ~200MB | \u003e1.3GB | ~300MB | ~50MB | ~2GB | ~50MB (agent) |\n| Configuration | YAML | YAML | YAML | YAML/TOML | Config files | Web UI | Web UI |\n| OAuth2/OIDC | Native | Native | Native | Via Plugin | Via Lua | Native (IdP) | Native |\n| Policy Engine | | | RBAC | Limited | Limited | Flow-based | Cloud |\n| Session Management | | | Certs | Via Plugin | Via Lua | | |\n| Certificate Auth | | | (Built-in CA) | | mTLS | | |\n| SSH Proxy | | (v0.30+) | | | | (2025+) | |\n| TCP Proxy | | | | | | | |\n| Behind Ingress | | | | | N/A | | N/A |\n| Deployment | Single binary | Single binary | Multi-node | Single binary | System service | Docker Compose | SaaS + agent |\n| Target Use Case | Personal/Homelab | SMB/Enterprise | Enterprise DevOps | Cloud Native | Web Server | SMB/Homelab | Enterprise/Teams |\n| License | MIT | Apache 2.0 | AGPL/Commercial | MIT | BSD | MIT | Commercial |","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farchellir%2Fsekisho","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farchellir%2Fsekisho","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farchellir%2Fsekisho/lists"}