Docs

Get started

Documentation lives with the code. This page points at the sections you need, in the order you need them.

Read documentation on GitHub

Quick start

Three steps

1. Pull the image. Kalitka ships as a container and stores its state locally in SQLite.
2. Wire up your proxy. Send the authorization check of Traefik, nginx, Caddy or Envoy to Kalitka.
3. Connect an approval channel. Telegram, email or the web control plane — whichever your team already lives in.

docker

docker pull ghcr.io/everycore-net/kalitka:latest

traefik · forward auth

http:
  middlewares:
    kalitka:
      forwardAuth:
        address: "http://kalitka:8080/auth"
        trustForwardHeader: true

Reference

Topics

Quick StartRun the container, point your proxy at it, approve the first request.DockerContainer image, volumes and environment variables.Reverse ProxyTraefik, nginx, Caddy and Envoy integration.Google AuthenticationIdentify requesters through Google sign-in.TelegramApprove or deny requests from a chat.EmailApprovals via short-lived one-time capabilities.Web Control PlanePending requests, decisions and history in the browser.SSH / PAMExperimental approval inside the SSH login flow.ConfigurationResources, policies, grant lifetimes and trusted proxies.SecurityTrust boundaries and the security model.

Something missing or wrong? Open an issue on GitHub.