Hecate

The gate

Hecate decides how the outside world reaches anything on the host. Which names are published, which internal services they lead to, which ports are handed out, and what the gateway has complained about lately. It is one screen instead of a folder of hand edited configuration files that only one person understands.

What it gives you

Publishing a site is a form, not an evening. A name is pointed at an application, TLS is required, and the gateway configuration is produced from that. There is no file to edit by hand and no reload to remember, and the same mechanism produces every published name, so they cannot drift apart.

Private by default. Services get an address that only the gateway can reach. Exposing one directly to the internet is a separate, deliberate act, it is refused unless that application has first been added to a list of applications permitted to be exposed at all, and some parts of the infrastructure can never be exposed under any circumstances. The safe thing is what happens if nobody does anything.

Port allocation without a spreadsheet. Applications are given addresses from a managed range, with a name and a purpose recorded against each one. Nothing is assigned twice, and a released address goes back to the pool.

Rate limits with evidence. Limits can be set for published names, and the console reports what actually happened: whether anything was refused or delayed in the last day. If something is being blocked, you can see at a glance whether this is the cause.

Complaints in one place. Whatever the gateway noticed, misconfiguration included, is collected and shown rather than left in a log nobody opens.

Who it is for

Anyone hosting several things on one machine who is tired of remembering which file publishes what. It makes the edge of your infrastructure describable.