I got tired of paying per user for authentication services. So I built Knell - a self-hosted auth system that does one thing well.
## The Problem
Every auth vendor wants to charge you per user. Start small, grow big, and suddenly your auth bill is thousands per month. Plus you're handing over all your user data to a third party.
I wanted something I could deploy once, own forever, and actually understand how it works.
## What is Knell?
Knell is a self-hosted authentication system built with TypeScript, Fastify, and PostgreSQL. It handles accounts, sessions, and sign-in so your apps don't have to.
No bloat. No vendor lock-in. No mystery black boxes.
## Features
**Security first:**
- Argon2id password hashing (the strongest algorithm available)
- Rate limiting (5 login attempts per 15min)
- Account lockout after failed attempts
- IP blocking for bad actors
- Timing attack prevention
- OWASP Top 10 compliant
**Session management:**
- JWT access tokens (15min expiration)
- Refresh tokens (7 days, revocable)
- Device fingerprinting
- Max 5 concurrent sessions per user
- Track last activity
**Performance:**
- Handles 15k+ concurrent users
- Sub-20ms response times
- Connection pooling
- Query batching
- In-memory caching
## Quick Start
bash
git clone https://github.com/roadsman/knell-auth.git
cd knell-auth
docker-compose up -d
That's it. Server runs on port 3000.
## API Example
**Sign up:**
bash
curl -X POST http://localhost:3000/signup \
-H "Content-Type: application/json" \
-d '{"email":"user@example.com","password":"SecurePass123!"}'
Returns access token + refresh token.
**Authenticate requests:**
bash
curl http://localhost:3000/me \
-H "Authorization: Bearer "
## Why I Built This
1. **Cost** - No more per-user pricing
2. **Privacy** - My users' data stays with me
3. **Control** - I understand every line of code
4. **Learning** - Built exactly what I needed, nothing more
## Tech Stack
- **TypeScript** - Type safety for auth logic
- **Fastify** - Fast, low overhead HTTP server
- **PostgreSQL** - Reliable, battle-tested database
- **Argon2** - Memory-hard password hashing
- **Docker** - Easy deployment
## What's Next
This is v0.1.0. Coming soon:
- Email verification
- Password reset
- TOTP/2FA
- OAuth providers (Google, GitHub)
- WebAuthn/passkeys
## Try It
GitHub: https://github.com/roadsman/knell-auth
MIT licensed. Deploy it anywhere. Own your data.
Feedback welcome!
Top comments (0)