Open Source Software We Depend On

Our primary server OS. Stable base system, excellent jails/bhyve virtualisation, tight integration with OpenZFS. Powers Netflix, PlayStation, and a significant portion of the internet's infrastructure.

Used for firewalls, VPN gateways, and anything where default-secure matters most. Two remote vulnerabilities in the default install over 25+ years. The home of pf, OpenSSH, and LibreSSL.

Illumos-based distribution maintained by the community. Chosen for ZFS-native storage appliances where the original Solaris engineers' work lives closest to the metal.

Used when a client's workload needs Linux — containerised applications, specific GPU drivers, or a team that already knows Debian-family systems. We don't force BSD where it doesn't fit.

FreeBSD-based firewall and routing platform built on pf. Used for perimeter firewalls, VLAN segmentation, site-to-site VPN, and traffic shaping. Actively maintained with a clean audit trail.

Remote access to everything we manage. Born out of the OpenBSD project, now running on effectively every Unix system on the planet. We enforce key-based auth, disable root login, and audit access logs.

Modern VPN with a codebase small enough to actually audit (~4,000 lines of kernel code). Used for site-to-site tunnels and remote access where IPsec complexity isn't warranted.

WireGuard-based overlay network that handles peer discovery, NAT traversal, and access control automatically. We use it for zero-config remote access on client networks where self-hosted coordination matters.

WireGuard-based mesh VPN with a polished client experience. The client is open source; used when ease of deployment across mixed device types (Mac, Windows, iOS, Android) is the priority.

Free, automated TLS certificates via the ACME protocol. Every web-facing service we manage uses valid TLS. No self-signed certificates in production, no excuses.

MTA handling inbound and outbound delivery. Wietse Venema's design focuses on security through a modular, least-privilege architecture. The de-facto standard for self-hosted mail.

IMAP and POP3 server. Fast, secure, well-maintained. Handles mailbox storage and client access. Pairs cleanly with Postfix for a complete inbound mail stack.

Spam filtering and DKIM/DMARC/SPF enforcement. Faster than SpamAssassin with a better default ruleset. Handles the signal processing that keeps your inbox clean without outsourcing decisions to a cloud provider.