Gated access on purpose: requests, Turnstile, one-time signup

How friends get into my Hub without open registration — request a seat (or use an invite), prove you’re not a bot, redeem a one-time signup link.

#cerb
#security
#self-hosting

Open signup on a personal box is unpaid sysadmin for strangers. My gate is deliberate:

Someone requests access on Hub (or I send a direct invite)
Cloudflare Turnstile filters the obvious bots
I approve (or don’t)
They get a one-time signup token — not a forever open door
New friends land on Hub with a small default quota

Direct invites skip the request form when I already know you. Same redeem path, fewer steps. Rate limits and less leaky errors came along for the ride. Turnstile has to allow hub.walkerjacob.com.

The vibe I want is a house key, not a lobby. If you know me and need space, there’s a path. If you found Admin by accident, you get pointed at Hub — Hub is not Admin.

comments self-hosted

No comments yet.