I have a bunch of side projects running on the same server. Portfolio, dashboards, internal tools, the works. And I kept running into the same problem. Some of these should be public, some should not, and I did not want to add login logic to every single app.
So I built Gatehouse. It is a lightweight auth gateway that sits between your reverse proxy and your services. You configure which domains need authentication, and Gatehouse handles the rest. One login covers all your subdomains because it uses cross subdomain cookies.
The way it works is clean. Your reverse proxy sends a subrequest to Gatehouse's verify endpoint before forwarding traffic. Gatehouse checks if the domain is protected, if the path is public, if the IP is whitelisted, and if the user has a valid session. If yes, traffic flows through. If not, the user gets redirected to a login page.
It comes with an interactive CLI that generates all the configs for you. You pick your proxy (Caddy, Nginx, or Traefik), set your auth domain, add your sites with their upstreams and protection rules, and it spits out the proxy config, docker compose, and env file. Zero manual config editing.
There is also a dashboard where you can manage users, sites, and active sessions from the browser. You can see who is logged in, from where, and revoke sessions instantly.
The whole thing runs as a single Docker container with SQLite for storage and JWT for sessions. No external database needed. I use it in production right now to protect my personal tools behind auth.deepaksilaych.me.