OpenMe - Single Packet Auth

With openme setup in your GNU/Linux server, every port looks closed to scanners and bots — always.

With this app you can securely ask (knock) your server to open certain ports to your phone only as long as you need them.

HOW IT WORKS

Your phone sends a single packet that is signed and encrypted.
The openme server decrypts and verifies the signature, then it adds firewall rule ONLY for your phone IP for a predefined period of time. That's it!

No banner is ever shown.
No handshake is ever exposed.
To anyone watching the wire, your server doesn't exist.

WHAT YOU CAN DO WITH THE APP

• Store multiple server profiles — home, VPS, work — and knock with one tap.
• Import profiles by scanning a QR code generated by the openme CLI.
• Works over Wi-Fi, mobile data, and VPNs.

WHO IT IS FOR
• Anyone running a home server or a VPS who wants a second line of defence
beyond passwords and 2FA.
• Developers and sysadmins who expose SSH, HTTPS, or other services and want to keep them invisible to scanners and brute-force attacks.
• Privacy-conscious users who would rather not advertise which services they run.

MODERN SECURITY AT A GLANCE

• Ed25519 signatures — each knock is cryptographically signed with your private key, which never leaves your device.
• ChaCha20-Poly1305 encryption — the payload (timestamp, random nonce, target IP) is authenticated and encrypted end-to-end.
• Replay protection — the server rejects any packet it has already seen or that is outside the ±60-second time window.
• Open protocol — the full 165-byte packet format is publicly documented at openme.merlos.org so you can audit every byte.

REQUIRES

A server running the openme daemon (GNU/Linux, open-source, free). Set-up takes
about five minutes — see openme.merlos.org/docs/getting-started.

OPEN SOURCE

openme is MIT-licensed. Source code, protocol specification, and self-hosting
instructions are at github.com/merlos/openme.

PRIVACY

The app collects no personal data. Keys stay on your device. No analytics,
no trackers, no cloud accounts required.