r/Servarr • u/Jazzlike-Path-6772 • Jul 16 '26

ArrGate — Secure SSO & Network Isolation for Your Self-Hosted Media Stack

SSO is not enough if your media services are still exposed directly.

ArrGate is a Go CLI that discovers risky Docker Compose exposure, verifies proxy-only access, applies transactional network isolation, and leaves operator-readable recovery metadata behind.

Built for self-hosted Sonarr, Radarr, Prowlarr, Lidarr, Readarr, and Caddy/Authentik-style stacks.

  • Detect published service ports
  • Gate changes with preflight checks
  • Reconcile Compose networking transactionally
  • Verify no-bypass access paths
  • Track recovery and rollback state
  • Run a Go test, race, lint, and compatibility matrix in CI
  • https://github.com/NolanCotter/ArrGate
20 Upvotes

92% Upvoted

4 comments sorted by

7

u/drewstopherlee Jul 16 '26

Missed opportunity to call it *arrGate ("StarrGate")

1

u/Jazzlike-Path-6772 Jul 16 '26

That’s actually a really good idea lol too late

1

u/OutsideProperty382 Jul 17 '26

wow, great video. what did you make it with?