🚪 Gozne

Sign. Turn. Enter.

Your wallet opens the door. Your server decides what happens next.

Gozne is a self-hosted wallet authentication and authorization gateway with temporary access and signed approvals. Put it in front of an HTTP application, define who can enter and what each identity may do, and keep control of sessions on your own server.

A wallet proves ownership by signing a message. Gozne checks it, creates an opaque session and tells the reverse proxy whether to let the request through. Your application receives a verified identity and roles. It needs no blockchain libraries or access to anyone's keys.

🛠️ Working alpha. EVM and Solana authentication, wallet-bound invitations a control panel and configurable multi-person approvals are implemented. Actions use a local simulation by default. An operator can instead enable the private signed-webhook adapter for an application service. There is no stable release or external security audit yet.

A door for your tools 🔑

Private documentation, an internal dashboard, a small team portal, a service running at home: if your users already have wallets, they can use them to sign in without adding another password.

Gozne also lets you try a more deliberate workflow:

1. Invite a collaborator for 30 minutes. The invitation belongs to their public wallet address. Forwarding the URL gives someone else no access.
2. Let them request a deployment. The request names the project, version and environment.
3. Review and sign it. The configured number of distinct administrators sign that exact request, with an action ID, payload hash and short expiry.
4. Execute it once. The requesting session records the simulation or sends the exact action to a configured private webhook. A second execution is rejected; webhook retries reuse the action ID.

The owner and collaborator use separate browser profiles. The default approval threshold is one, so an owner can run a quick single-wallet test. Raise it per application when an operation must be reviewed by more than one person.

What's included

• 👛 Choose your wallet: Rabby, MetaMask and other EIP-6963 EVM providers; Phantom with Sign-In With Solana. The selector never silently switches wallets.
• 🍪 Revocable sessions: server-side state, secure host-only cookies, application roles and CSRF protection.
• 🧩 Resource authorization: permission catalogs, reusable role bundles, scoped grants, parent-child resources, time and workflow conditions, visible resource lookup and a private decision API. See the resource authorization guide.
• ⏱️ Temporary invitations: reader access for a specific wallet, expiry and immediate revocation, without rewriting the main policy.
• ✍️ Signed intent: exact deployment parameters, fresh proofs from one or more distinct administrators, a local simulation and optional HMAC-signed webhook delivery with idempotent retries.
• 🧭 Multiple applications: operator-controlled application creation and configuration, with separate workspace sign-in. See the application guide.
• 🖥️ A responsive control panel: permanent users, wallets, roles, invitations, requests and deployment receipts, active-session revocation and an application-scoped audit trail with filters and pagination. Built with local HTML, CSS and JavaScript, without a frontend framework or CDN.
• 🌍 English and Spanish interfaces: browser detection, an explicit language switcher, persistent preference and locale-aware dates across sign-in, the protected workspace and administration. See the internationalization guide.
• 🗃️ SQLite and a CLI: transactional migrations, policy administration, hash-chained audit exports, live backups and recovery.
• 🐳 A complete local setup: non-root containers, Nginx and HTTPS on OrbStack.
• 🧪 Checks that exercise failures: replay, database write failures, SIGKILL, full storage, concurrent requests, image scanning and SBOM reports.

Gozne never asks for a seed phrase or private key. Sign-in requires no transaction, fees or balance lookup. EVM support currently covers externally owned accounts (EOAs); smart wallets, WalletConnect, OIDC and passkeys are future work.

Try it on a Mac 🚀

Start OrbStack, then run:

git clone https://github.com/enriquegrx/gozne.git
cd gozne
sh scripts/demo-certs.sh
docker compose -f examples/compose/orbstack.yaml up --build -d --wait
docker compose -f examples/compose/orbstack.yaml exec gateway gozne policy apply /app/policy.json

Open the local demo. OrbStack supplies the local domain and HTTPS. The starter policy has no authorized wallets. Its example-user identity has reader and admin roles for the demo. Attach your public address:

docker compose -f examples/compose/orbstack.yaml exec gateway gozne wallet attach example-user evm YOUR_PUBLIC_ADDRESS

Use solana instead of evm for a Solana address. Open the HTTPS URL in the browser where your wallet extension is installed, select it and sign in. For EVM, the example policy allows Ethereum mainnet, chain ID 1.

The public URL now contains only wallet sign-in and the protected application. Open the separate internal panel for administration. Its port is bound to loopback, with a separate API and Docker network. The local panel certificate generated above is self-signed and lasts seven days; review and trust that certificate locally for browser testing. Production requires a trusted certificate and private ingress. See the private administration deployment guide.

The control panel walkthrough takes you through the owner/collaborator demo, permission rules, API calls and exact execution limits. Existing installations must explicitly grant admin to their operator; see the upgrade instructions.

Do not reapply the empty starter policy after adding wallets. Policy imports replace the whole policy and invalidate existing access state. The named volume keeps your state across restarts. Stop the demo with:

docker compose -f examples/compose/orbstack.yaml down

For portable HTTPS and proxy integration, see operations. The root Compose file runs only the API on 127.0.0.1:3001; browser authentication needs an HTTPS reverse proxy.

Check the running demo at any time with npm run build followed by DOCKER_CONTEXT=orbstack npm run deployment:check. It checks service separation, public route denial and TLS expiry. See the diagnostic options.

The QUIQUE.ES workspace example demonstrates a separate protected application with its own interface and no wallet libraries. Its production layout and shared visual language document the public authentication door and the private operator workspace.

How the pieces fit

flowchart LR
    W[Browser + wallet] -->|Signed message| G[Gozne]
    G --> S[(SQLite)]
    W --> N[Nginx]
    N -->|Check live session| G
    N -->|Verified identity + roles| A[Your application]
    A -->|Permission + resource + verified session| G
    G -->|Optional signed action webhook| A

Loading

Authentication protects application access. Signed actions are a separate API workflow; placing a proxy in front of an app does not automatically protect its individual operations with approval signatures.

Development

Use Node.js 24.20.0. With nvm:

nvm install
nvm use
npm ci
npm run check
npm start

check runs formatting, lint, compilation and tests. start uses the compiled code and initializes state/gozne.sqlite. In another terminal:

npm run cli -- config check --json
npm run cli -- doctor --json

Configuration validation is read-only. doctor expects an initialized database.

Variable	Local default	Purpose
GOZNE_SURFACE	public	public authentication or admin internal controls
GOZNE_HOST	127.0.0.1	Listen address
GOZNE_PORT	3001	HTTP port
GOZNE_DATABASE	./state/gozne.sqlite	SQLite file
GOZNE_LOG_LEVEL	info	silent, info, warn or error
GOZNE_AUTHORIZATION_TOKENS	{}	JSON map of application IDs to private service tokens
GOZNE_ACTION_MODE	simulation	simulation or private webhook delivery
GOZNE_ACTION_WEBHOOK_URL	—	HTTPS receiver URL
GOZNE_ACTION_WEBHOOK_SECRET	—	Shared secret of at least 32 bytes
GOZNE_ACTION_WEBHOOK_TIMEOUT_MS	5000	Receiver timeout, from 500 to 10,000 ms

The container listens on 0.0.0.0 and stores state in /app/state. No session signing secret is needed. Node reads environment variables; it does not load .env files automatically. Authentication returns 503 until a policy is imported. Keep /v1/auth/validate internal to the proxy.

Read more 📚

• Vision and scope · Architecture
• API guide · OpenAPI contract
• Control panel and signed actions
• Signed action webhooks
• Resource authorization
• Threat model · Recovery
• Verification and reports · Roadmap
• Architecture decisions · Project provenance
• QUIQUE.ES public and private deployment
• Internationalization and translation workflow
• Contributing · Reporting a vulnerability

The repository is public, but a distribution license has not been selected. No open-source license has been granted yet.