Self-Hosted Gateway
Docker-native reverse proxy over WireGuard to expose local services
1.7k stars 87 forks last commit first released AGPL-3.0
Slowing down
No commits since 17 Mar 2025. Check the issue tracker before you rely on it.
Self-Hosted Gateway automates provisioning of Reverse Proxy-over-VPN (RPoVPN) WireGuard tunnels to expose local Docker Compose services to the public Internet. It combines Caddy, Nginx and WireGuard to provide per-link tunnels, automatic TLS and a minimal docker-compose workflow.
Key Features
- Automates provisioning of WireGuard-based RPoVPN tunnels that forward traffic from a public gateway to local docker-compose projects.
- Uses Caddy on the client side and NGINX on the gateway to handle HTTPS termination, proxying and automatic TLS certificate provisioning.
- Docker-native workflow: generate a small "link" docker-compose snippet and run a client container that establishes the tunnel and exposes specified services.
- Per-link network isolation via Docker Compose private networks and dedicated WireGuard tunnels, reducing cross-service exposure.
- Supports passing remote client IPs to local containers via proxy protocol, basic-auth via env variables, and proxying generic TCP/UDP traffic (socat).
Use Cases
- Expose self-hosted web apps, dashboards or development services running in docker-compose to the public Internet without manual port forwarding.
- Enable remote access to services from behind CGNAT or double-NAT by terminating traffic on a public VPS gateway and routing it over WireGuard tunnels.
- Provide isolated, per-service tunnels for teams who want reproducible, auditable exposure of containerized services.
Limitations and Considerations
- Requires a publicly addressable Linux gateway (VPS) with SSH and open ports 80/443 and an open UDP port range; a domain with A records is needed for TLS.
- Installation and operation expect familiarity with Docker, docker-compose, Makefiles and basic Linux network/SSH administration; not a turnkey SaaS.
- Relies on third-party components (WireGuard, Caddy, NGINX); diagnosis may require troubleshooting across those layers.
Self-Hosted Gateway is focused on a reproducible, self-managed pattern for exposing containerized services using reverse-proxy-over-VPN. It is intended for operators comfortable with Docker and VPS administration who want an open-source alternative to commercial tunneling services.
Categories:
Tags:
Tech Stack:
Similar to Self-Hosted Gateway
Zoraxy
HTTP reverse proxy and gateway with web UI and real-time analytics
A general-purpose HTTP reverse proxy and forwarding tool for homelabs, offering web UI, ACME/TLS, stream proxy, plugins and realtime monitoring.
GoDoxy
Reverse proxy and container orchestrator for self-hosters
High-performance reverse proxy and container orchestrator with Web UI, automatic Docker/Podman route discovery, idle-sleep, access control, and automated Let's Encrypt support.
Ferron
Fast, memory-safe web server with automatic TLS and modern protocol support
A Rust-written, memory-safe web server offering automatic Let's Encrypt TLS, KDL configuration, HTTP/2/HTTP/3, reverse proxying, and built-in tooling for serving web apps.
UUSEC WAF
Web application firewall and API security gateway (WAAP)
High-performance web application firewall and API security gateway with semantic detection, rule management, and reverse-proxy deployment for protecting websites and APIs.
SWAG
Nginx reverse proxy with automated TLS certificates and fail2ban
LinuxServer.io SWAG is a Docker image bundling Nginx reverse proxy, ACME certificate automation (Let’s Encrypt/ZeroSSL), optional PHP, and fail2ban intrusion prevention.
HomeServerHQ
All-in-one home server platform with VPN, email, and relay
Integrated installer and platform for home infrastructure. Provides VPN relay for NAT traversal, preconfigured email, automatic HTTPS, reverse proxy, and a web management utility.
