Add a sign-in gate to a DigitalOcean droplet or VPS

When this fits

The app already runs on a server you manage, and it should not be open to everyone. You want people to sign in before they reach it, without changing the app.

Steps

1. 01

   In Stedhold, choose Connect source, then Protect an existing server, and enter the server's address (for example https://203.0.113.10:8080).

2. 02

   Stedhold checks the address is public and reachable, then gives you a private link.

3. 03

   Set who can open it and invite them.

4. 04

   Remember the server is still reachable at its own address. Close that route in your firewall if the private link should be the only way in.

Good to know

• Stedhold forwards requests to your server. The server does not sleep; it is yours and stays on.
• Your app receives the signed-in person's email in a signed X-Stedhold-User-Email header.
• Requests over 50 MB are refused, and upstream calls time out.

Other ways to do this

If you already use Cloudflare and are comfortable with DNS and tunnels, Cloudflare Access can put a sign-in in front of a server too. Stedhold is simpler if you would rather not move your DNS or configure an identity provider, or if you also want to host apps without a server.