netory

netory is an open-source MIT-licensed collection of three self-hosted network services written in Go. Each one is a single static executable with no runtime dependencies, published for Linux and macOS and as a container image. The project is built using Google's Bazel build system in combination with their first-party Gazelle BUILD file generator.

📖 Overview

Running your own dynamic DNS without handing your zone to yet another provider? protean accepts DynDNS2 updates from the clients you already have - routers, ddclient, inadyn - and writes them to the DNS provider you already use. Serving curl … | sh installers? signpost publishes them as immutable, checksummed, optionally signed releases, over HTTPS only, with atomic rollback. Need to let customers into a production API without letting them reach all of it? pivot sits in front of it as a read-only proxy that issues their credentials, authenticates to the backend on their behalf, filters every request against path rules, and protects the backend with rate limits, a concurrency cap and a response cache.

✨ TL;DR

# Install one service - protean, signpost or pivot - for linux or darwin, amd64 or arm64
curl -fsSL https://github.com/adnoctem/netory/releases/latest/download/pivot_linux_amd64.tar.gz \
  | tar -xzf - pivot
sudo install -m 0755 pivot /usr/local/bin/pivot

# Or all three at once
curl -fsSL https://github.com/adnoctem/netory/releases/latest/download/netory_linux_amd64.tar.gz \
  | sudo tar -xzf - -C /usr/local/bin protean signpost pivot

# Or run the container image - multi-architecture, distroless, uid 65532
docker run --rm ghcr.io/adnoctem/pivot:latest version

Prefer to check what you install first? Every release publishes a checksum file covering every tarball:

base=https://github.com/adnoctem/netory/releases/latest/download
curl -fsSLO "$base/pivot_linux_amd64.tar.gz"
curl -fsSL "$base/CHECKSUMS_SHA256.txt" | sha256sum -c --ignore-missing
tar -xzf pivot_linux_amd64.tar.gz pivot

Linux is the only platform the services are supported on as servers. The macOS builds are for the subcommands that need no server - rules validate, bundle validate, secret generate, version - which is what runs on a laptop or in a CI job.

🛠️ Services

Like most modern Go projects the executables are located within the cmd directory, each with its own README documenting how to install, configure, run and operate it. Here's a quick-reference list as an overview:

• protean: a self-hosted dynDNS control plane in front of Cloudflare, Route 53 or Spaceship
• signpost: a public script router for the one-line install pattern, serving immutable releases
• pivot: a transparent, read-only API proxy for letting customers into a production API safely

How each one works, what the three share and where their limits are is described in the Architecture.

🔃 Contributing

Refer to our documentation for contributors for building and testing, the repository layout, dependency rules, commit message formats and how a release is made. Participation follows the Code of Conduct; report vulnerabilities privately as described in the Security Policy.

📥 Maintainers

This project is owned and maintained by Ad Noctem Collective refer to the AUTHORS or CODEOWNERS for more information. You may also use the linked contact details to reach out directly.

©️ Copyright

• Assets provided by: IconScout
• Sources provided by: Ad Noctem Collective under the MIT License