wg-easy VS vouch-proxy

Check out wg-easy on GitHub. There is also a wg with pinole on their page. Works so easily together. https://github.com/wg-easy/wg-easy

sounds like you just want wg-easy.

This wg-easy?

Definitely not an OSI approved license, but does look like they made an attempt in the spirit of GPL, no?

https://github.com/wg-easy/wg-easy/blob/master/LICENSE.md

> You may:

Use this software for yourself;

Use this software for a company;

Modify this software, as long as you:

Publish the changes on GitHub as an open-source & linked fork;

Don't remove any links to the original project or donation pages;

You may not:

Use this software in a commercial product without a license from the original author;

wg-easy running in Docker. Then access it using WireGuard on my mobile devices.

Just plain wg-easy (wireguard with frontend). No 3rd parties involved, just me & my endpoint

I suggest running a VPN server like wireguard (very easy to install on phone and set up using https://github.com/wg-easy/wg-easy) and have the port open only to that. The VPN will do the rest in terms of NATing ports and whatnot.

https://github.com/wg-easy/wg-easy (7.6k stars)

I use wg-easy for now https://github.com/wg-easy/wg-easy

Look into vouch proxy

Vouch proxy is designed for this usage: https://github.com/vouch/vouch-proxy I don't think there are any nice UIs to configure it though so you'll need to be familiar with running it yourself.

Not sure this is a "best practice", but it lets me keep control of the Ingress resources inside their YAML configs. I've also layered Vouch Proxy into the ingress configurations to require SSO/MFA auth to access the resources behind the Ingress. Cloudflare has the ability to do this, but I found it cumbersome to keep track of the configs outside the K8s cluster.

I've used vouch proxy for my own stuff previously, before more recently moving to Cloudflare Access. vouch can be slightly janky at times to get working right, but once set up, it's been solid.

For example: nginx -> Vouch proxy -> KeyCloak -> Jellyfin

While this works, we were hoping to make access a bit easier with say an OpenID Connect SSO and reverse-proxy solution. I've seen Vouch Proxy, https://github.com/vouch/vouch-proxy which is really just SSO on top of nginx, but I'm wondering if there's a simpler way to do this.

You seem to be quite knowledgeable and a minimal provider with just the bare minimum would suffice for you. Have a look at Vouch Proxy, it does one thing and it does it well.