wardn
Self-hosted access control

Access control you host.
Doors that decide alone.

Drive it from your software through the API, or by hand from the dashboard. Each door decides on site, in milliseconds, and keeps deciding when the network is gone.

Read the docs Run it in 10 minutes →
Live · one lane, one controller
Your system billing · booking · WMS waiting for passages
wardn server on your infrastructure source of truth for rights
Controller DIN rail · minimal Linux Local queue
Door Closed
Link up Every passage is decided on site, then reported.
Security by topology

Nothing connects into a site.

The controller dials out and keeps the connection open. No port to open on the customer's router, no fixed address to negotiate with their IT department.

Rights, commands and updates all travel over connections the controller opens itself, mutually authenticated and encrypted.

  • Inbound ports to open0
  • Fixed address to negotiateNone
  • Direction of every linkOut
CUSTOMER SITE inbound: refused dials out · mTLS controller doors router your server
Self-hosted

You host it.

Broker, database, object store, identity provider: on your own servers, on AWS, or on near-free tiers. Any MQTT broker with shared subscriptions, any managed PostgreSQL, any S3 API, any OIDC provider.

Nothing is sent anywhere you didn't choose.

18 MBof RAM for the wardn server at rest.
One 25 MB binary.

The whole stack on hardware you own.

  • BrokerEMQX
  • DatabasePostgreSQL
  • Object storeMinIO
  • IdentityKeycloak
  • wardn serverone binary, any host
  • Dashboardnginx container
  • Data sent anywhere you didn't choosenone
Each piece is a URL and a credential. Mix them as your site needs.
Integrable

Your system drives it.

Everything the dashboard does, the API does. Machine API keys, idempotent provisioning, a live event socket, and a published OpenAPI contract.

Credential types are free-form and every right carries your own metadata. Your domain fits as it is.

Provision a rightreplay-safe
curl -X POST -H "X-API-Key: $KEY" \
  -d '{"userId":"…","zoneId":"…",
       "validFrom":"2026-08-11T07:00:00Z",
       "validTo":"2026-08-11T19:00:00Z",
       "externalId":"booking-88213",
       "credentials":[{"type":"licensePlate",
                       "value":"1-ABC-123"}]}' \
  /api/v1/provisioning/access-rights

# then listen to every passage, scoped to your workspace
wscat -c "wss://…/ws/activity?apiKey=$KEY"
Dashboard

Or run it by hand.

A full dashboard for the people on duty: the live feed, every door and its mode, rights and their history, controllers, alerts and over-the-air updates.

It is one more API client. Nothing on screen is out of your system's reach, and every action carries the operator's name in the audit trail.

Portable

It runs on any minimal Linux.

One statically linked binary per architecture, carrying its own libc. It does not care how old the distribution is.

Updated over the air. The server picks the right build for each controller.

One releaseover the air
Raspberry Piaarch64-unknown-linux-musl
Update to v1.3.0downloading
UniPiaarch64-unknown-linux-musl
Update to v1.3.0downloading
Industrial boxx86_64-unknown-linux-musl
Update to v1.3.0downloading
No GPU. No constant cloud connection. Enough to keep the rights encrypted on site and drive a relay.
Where it fits

Your system owns the business rules. wardn owns the door.

Parking

licensePlate
Your billing system

Owns plates and subscriptions.

wardn

Opens the lane and reports every passage, even through a 4G outage.

Offices and coworking

badge · qrCode · phone
Your booking tool

Grants a right for a slot.

wardn

Enforces it at the door and tells you who came in.

Logistics yards

licensePlate · qrCode
Your WMS

Knows which carrier is expected.

wardn

Lets that truck through the gate, and nobody else.

Already built

What you don't have to build.

Tenant isolation

Several customers on one system. None ever sees another's data, not even a controller identifier.

Security

Mutual TLS on every link. A stolen controller holds hashes, not badge numbers or plates.

GDPR

Retention windows, right of access, right to erasure, and an append-only audit trail where every action carries a name.

Fleet

Heartbeat, alerts, a live debug console, and over-the-air updates across every controller.

What wardn is not

A full access control suite like Nedap AEOS or Genetec. It solves one problem precisely, and is built to sit under the system that solves the others.

Your doors.
Your servers.
Your rules.

Read the docs Read the API