Knock. Approve. Enter.
Human-in-the-loop access control for web apps and SSH.
Kalitka adds an explicit human decision before access is granted — while keeping your existing authentication in place.
No approval, no path through. Grants are temporary and expire on their own.
A contractor needs Grafana for 30 minutes.
They open grafana.example.com. Kalitka creates an access request. You see who is asking, which resource they want, and where the request comes from. Approve once. Access expires automatically.
See who is asking, what they want to access, where the request comes from, and approve only that request.
- Contractoropens the link
- grafana.example.comprotected resource
- Kalitkaaccess request
- Telegram approvalone human decision
- Temporary accessexpires on its own
Authentication answers who you are.
Kalitka asks whether you should enter right now.
Your applications probably already have Google, local credentials, LDAP, MFA or another login. Kalitka does not replace them. It puts one explicit human decision in front of them.
Keep your existing authentication. Add a human decision before access.
- 01Somebody requests access to a protected resource.
- 02Kalitka creates an access request.
- 03An authorized person approves or denies it.
- 04A temporary grant is issued.
- 05Normal application authentication continues.
Put Kalitka behind your reverse proxy and in front of sensitive applications.
Your proxy asks Kalitka whether a request may pass. Kalitka answers from recorded state: an approved, unexpired grant for that resource — or nothing.
It works as an additional gate and does not replace application authentication.
Approval inside the SSH login flow
Kalitka can integrate into an SSH login flow using PAM and human approval. The connection waits until someone decides, and the session is bound to that grant.
SSH support is experimental — expect the interface around it to keep changing.
$ ssh prod-01Kalitka approval required.Waiting for approval...✓ Approved.Opening session.
Decide where you already work
Telegram
Fast approval from an existing chat workflow.
Web Control Plane
Review pending requests, approve or deny access and inspect history.
Secure cross-channel approval using short-lived one-time capabilities.
Context first, then the decision
Before approving, the person deciding sees who is asking, which resource is requested and where the request originates — so an approval is never a blind tap on a notification.
Access requested
- User
- contractor@example.com
- Resource
- grafana.prod.example.com
- Source
- 91.x.x.x · Germany
- Requested
- one-time access
Illustration of the approval message — buttons are not interactive here.
Every decision is bound to a specific request and resource.
| Resource | Subject | Source | State | Time | Approver |
|---|---|---|---|---|---|
| grafana.prod.example.com | contractor@example.com | 91.x.x.x · DE | pending | just now | — |
| pgadmin.internal.example.com | anna@example.com | 10.x.x.x · office | approved | 12 min ago | sergej |
| grafana.prod.example.com | contractor@example.com | 91.x.x.x · DE | expired | 2 h ago | sergej |
| backup.internal.example.com | unknown@example.com | 203.x.x.x · unknown | denied | yesterday | anna |
The web control plane lists pending requests and past decisions with resource, subject, source, state, time and approver. Example data shown.
The gate should fail closed.
When Kalitka cannot confirm an approved, unexpired grant for a resource, the request does not pass. Grants end on their own instead of waiting to be revoked.
Read the security model- short-lived grants
- one-time capabilities
- resource-bound access
- signed sessions
- explicit trusted-proxy boundaries
- atomic resolve-once semantics
- durable audit events
Why not just a VPN?
Kalitka is not trying to replace your VPN or identity provider. It adds a human decision where permanent standing access is too much.
- VPN / Tailscale
Gives network reachability: once you are on the network, the services behind it are reachable.
- Cloudflare Access
Identity- and policy-based application access, evaluated automatically from rules.
- Teleport
A broader infrastructure access platform covering servers, clusters and databases.
- Kalitka
Adds an explicit human approval step for a specific access request, where permanent standing access is too much.
Fail-closed by default. A separate, auditable break-glass path is part of the operational design rather than silently bypassing approval.
Your gate. Your infrastructure.
Kalitka ships as a container and runs inside your own infrastructure, next to the services it protects. State stays local in SQLite; there is no external control plane to depend on.
docker pull ghcr.io/everycore-net/kalitka:latestPoint your proxy at the gate
Run the container next to your services, then send the routes you want protected through a forward-auth check. The snippet is an illustrative Traefik example — see the documentation for the complete configuration.
# example only — see docs for the full setup
http:
middlewares:
kalitka:
forwardAuth:
address: "http://kalitka:8080/auth"
trustForwardHeader: true
routers:
grafana:
rule: "Host(`grafana.example.com`)"
middlewares: ["kalitka"]
service: grafanaBuilt in the open.
Access control is easier to trust when you can read it. The code, the security model and the decisions behind them are public, so you can verify how the gate behaves instead of taking a description at face value.
Explore the source on GitHubWhere the gate is heading
Broad directions, not promises or dates.