Measured in production Cloudflare Authelia OIDC OpenLDAP nginx

Zero-inbound external access

Thirty-five hostnames published without opening a port.

We publish your services to the internet through an outbound tunnel behind single sign-on, with no inbound firewall rule and no exposed origin.

Externally reachable services published through an outbound tunnel, fronted by an OIDC provider and a central directory. No inbound firewall rules, no exposed origin, and single sign-on across the estate — with every hostname tabulated against the access rule that guards it, so a gap is a visible empty cell.

35

public hostnames, 0 inbound firewall rules
28

access rules, tabulated against every hostname — no gaps
15,087

logins reviewed in one audit, 0 unexpected

Every figure was read from a live estate carrying real load. Measured in production, on a live estate publishing 35 hostnames. The access review was performed later, against the running configuration.

What you are handed

Every service published through an outbound tunnel, with no inbound rule left behind
Single sign-on in front of the services that have no authentication of their own, MFA enforced on administrative interfaces
A hostname-versus-rule table, so an uncovered service is a visible empty cell rather than an assumption
True client address restored behind the proxy, so per-address controls act on the visitor
A probe that must reach the origin to succeed, because the auth layer can answer for a dead one

Usually bought as

Build 2–6 weeks

Design and delivery of a defined system — a monitoring estate, an alarm-to-ticket integration, an access layer, a backup regime, a hosting platform — including the documentation and the handover.

A working system you can operate without us.

Start this one

01 The shape

A tunnel connector runs in a dedicated always-on container and holds outbound QUIC connections to the edge. Public hostnames map to internal origins through the tunnel's ingress rules. Nothing listens on the WAN, and the origin addresses are never published.

Authentication sits in front: the edge access layer delegating to an OIDC provider, with a central directory as the identity store and group membership driving authorisation.

02 Two failures worth recording

The OIDC provider rejecting X-Forwarded-Proto: http. The connector speaks plain HTTP to the backend, but the provider's OIDC implementation requires HTTPS in that header or it generates OAuth redirect URIs with the wrong scheme. The fix is a small nginx shim in front that injects the correct header before proxying.

A connector on a stopped container reading as a total outage. Most hostnames appeared to work — they returned 302s. Those 302s were access-layer login pages, served at the edge, entirely independent of whether the origin was alive. Only the one hostname not behind the access layer showed the real error.

The lesson generalises past this stack: when an auth layer can answer on behalf of a dead origin, a green check on the front door tells you nothing about the building. Probe something that must reach the origin to succeed. That probe is part of what we hand over.

03 Auditing it later

An access layer is only as good as the last time someone checked it still covers everything. A later review tabulated all 35 published hostnames against the 28 access rules in force — every hostname in a row, the rule that guards it in the column — so a gap is a visible empty cell rather than an assumption. There were none.

The same review restored the true client address behind the tunnel, so per-address controls act on the visitor rather than on the proxy in front, and read back 15,087 logins from the access log. None was unexpected.

Want this one, scoped for your estate?

Start a conversation See everything else