Tiresias - Access Control

Tiresias is a secure infrastructure authorization client for systems administrators, DevOps engineers, and self-hosters. Designed as the mobile companion to the open-source Tiresias server, it acts as a cryptographically enforced approval gateway for privileged operations (such as SSH session requests and cluster commands), ensuring that sensitive actions require explicit physical hardware token verification. KEY FEATURES: • OPEN SOURCE & SELF-HOSTED Retain full sovereignty over your infrastructure. Deploy the Tiresias server component on your own private network, VPS, or homelab using Docker and GitHub. • REAL-TIME AUTHORIZATION QUEUE Receive push notifications whenever an authorization request is triggered across your infrastructure. Inspect target nodes, requesting users, commands, and session hashes before granting access. • FIDO2 & WEBAUTHN HARDWARE SIGNING Approve sensitive operations using physical FIDO2 security keys (such as YubiKeys) via NFC or USB-C. Cryptographic WebAuthn assertions guarantee non-repudiation. • PRIVATE MESH & NETWORK CHECK Verifies network connectivity against your private Tailscale mesh or internal DNS prefix, warning administrators when operating outside trusted boundaries. • LOCAL PASSCODE & BIOMETRIC PROTECTION Secure the client interface with local 6-digit PIN encryption and Face ID authentication. Credentials and tokens remain exclusively in the encrypted iOS Keychain. • PRIVACY-FIRST & ZERO TRACKING Tiresias does not collect analytics, contains no third-party telemetry, and serves zero ads. All communication occurs directly between your device and your self-hosted server. REQUIREMENTS & GETTING STARTED: Tiresias is a companion client that requires a running Tiresias server instance. The backend server is open source and can be self-hosted via Docker. Visit the GitHub repository to deploy your own instance. EVALUATION & DEMO: New users and administrators evaluating Tiresias can test the app immediately without deploying a server by tapping "Connect to Demo Server" on the pairing screen.