# Attribution

Every component is under a permissive licence. Preserve each project's
copyright and licence notice if you redistribute.

| Component | Licence | Pinned commit | Source |
|---|---|---|---|
| caddyserver/caddy | Apache-2.0 | `04fe16102872` | https://github.com/caddyserver/caddy |
| louislam/uptime-kuma | MIT | `e7420f8fa546` | https://github.com/louislam/uptime-kuma |
| crowdsecurity/crowdsec | MIT | `c261e4fce615` | https://github.com/crowdsecurity/crowdsec |
| gitleaks/gitleaks | MIT | `b58d3f102cf3` | https://github.com/gitleaks/gitleaks |
| aquasecurity/trivy | Apache-2.0 | `8f815546c7b5` | https://github.com/aquasecurity/trivy |
| projectdiscovery/nuclei | MIT | `a14b3de2a4bf` | https://github.com/projectdiscovery/nuclei |
| authelia/authelia | Apache-2.0 | `1eb93a5e5f01` | https://github.com/authelia/authelia |
| keycloak/keycloak | Apache-2.0 | `9b7c2d4fd7b6` | https://github.com/keycloak/keycloak |
| open-policy-agent/opa | Apache-2.0 | `3f2d1bd96090` | https://github.com/open-policy-agent/opa |
| vectordotdev/vector | MPL-2.0 | `9aee1f50eefe` | https://github.com/vectordotdev/vector |
| juanfont/headscale | BSD-3-Clause | `eeaac680bef2` | https://github.com/juanfont/headscale |
| traefik/traefik | MIT | `fcbfb8aff229` | https://github.com/traefik/traefik |

## What each does

### caddyserver/caddy
- Licence: Apache-2.0
- Role: Reverse proxy with automatic HTTPS
- Terminates TLS and gets certificates automatically. The simplest way to put a real front door on your services.

### louislam/uptime-kuma
- Licence: MIT
- Role: Uptime and service monitoring
- Watches your services and tells you when they stop responding, before your users do.

### crowdsecurity/crowdsec
- Licence: MIT
- Role: Collaborative intrusion prevention
- Reads your logs, detects attack patterns, and blocks offenders. Shares signals with other installations.

### gitleaks/gitleaks
- Licence: MIT
- Role: Secret scanning
- Catches API keys and credentials before they reach a repository. Run it as a pre-commit hook and stop leaks at the source.

### aquasecurity/trivy
- Licence: Apache-2.0
- Role: Vulnerability scanner for images and filesystems
- Scans your container images and dependencies for known CVEs. The check most self-hosters skip and most regret.

### projectdiscovery/nuclei
- Licence: MIT
- Role: Template-based vulnerability scanning
- Thousands of community templates for known exposures. Point it at your own hosts and find what is misconfigured.

### authelia/authelia
- Licence: Apache-2.0
- Role: Authentication and single sign-on portal
- Puts a login in front of services that have none - which is most of them. 2FA included.

### keycloak/keycloak
- Licence: Apache-2.0
- Role: Identity and access management
- Full IAM: users, roles, groups, OIDC and SAML. The right answer when you have more than a handful of people.

### open-policy-agent/opa
- Licence: Apache-2.0
- Role: Policy engine
- Express your access rules as code and enforce them consistently, instead of scattering if-statements through services.

### vectordotdev/vector
- Licence: MPL-2.0
- Role: Observability data pipeline
- Collects logs and metrics from everything else and routes them where you want. The plumbing under your monitoring.

### juanfont/headscale
- Licence: BSD-3-Clause
- Role: Self-hosted mesh VPN control server
- Tailscale's control plane, running on your hardware. Connect machines across networks without exposing anything publicly.

### traefik/traefik
- Licence: MIT
- Role: Cloud-native edge router
- Discovers services automatically and routes to them. Better than Caddy when your containers come and go.

## Note

Source is fetched at the pinned commits above rather than vendored.
No upstream project is modified.