DEV Community

Cover image for Hi, I’m Doğukan. I build identity and access software, and I’ve opened up seven of my projects
Doğukan TURHAL
Doğukan TURHAL

Posted on Edited on

Hi, I’m Doğukan. I build identity and access software, and I’ve opened up seven of my projects

#introduction #security #go #opensource

Hi, I'm Doğukan Turhal. I live in Türkiye and run HexxLock, a two-person company that builds identity and access software. This is my first post here.

What I work on

Login, permissions and audit logs. Who is this user, what can they access, and can we prove later what they did. Working on security is honestly mind-blowing. It takes a lot of hard work, research and testing, and a few tears :D Most of my code is Go, but I also write Rust, C/C++, C#/.NET, Python, TypeScript and Bash. We run everything on Kubernetes and PostgreSQL, on our own servers.

The projects

I published seven of our projects on GitHub: https://github.com/dogukanturhal

  • falcon-id: our identity provider (OpenID Connect and OAuth). It supports DPoP, PAR and JAR. Permissions use SpiceDB for relationships, OPA for attribute rules, and roles per tenant. It is not OpenID or FAPI certified.
  • jess: gives people temporary access to servers and databases (SSH, PostgreSQL, RDP) and records every session.
  • talon: a proxy that sits in front of internal apps and checks login and permissions on every request.
  • keystone: a Kubernetes operator that runs PostgreSQL migrations for many tenants and detects schema drift.
  • keystone-sdk: the same migration logic as a library for Go, Rust and .NET.
  • platform-shared: shared Go packages from our services (auth, tenant isolation, outbox, Vault).
  • hexx-pep-core: a small Go library for tamper-evident audit logs and signed offline decisions.

Most of the code is Go. Rust is in jess and keystone-sdk, .NET in keystone-sdk, TypeScript in jess. C/C++ and Python I use in other work, not in these repos.

All of them are before version 1.0 and none has had a security audit. They come from our private codebase, so if you find something that still looks internal, open an issue and I'll fix it. Each README lists what doesn't work yet.

What I'll write about

  • How I added DPoP and PAR to falcon-id, and what broke along the way.
  • How jess records sessions so the recording can still be trusted later, and where that stops working.
  • Running PostgreSQL migrations for many tenants from Kubernetes.
  • Post-quantum signatures: what Go supports today and what it doesn't.

Why I'm here

  • I'm open to remote senior or staff roles, or contract work, in identity, access control and platform engineering.
  • HexxLock is looking for partners: security companies and cloud providers whose customers want to run this on their own infrastructure.
  • I want code reviews. If you read something and think it's wrong, please tell me.

You can comment here, open an issue on GitHub, or message me on LinkedIn. I reply to everyone.

Thanks for reading, and happy coding :)

Top comments (0)