44 < meta charset ="utf-8 " />
55 < meta name ="viewport " content ="width=device-width, initial-scale=1 " />
66 < title > Codehead Systems — open source by Ned Wolpert</ title >
7- < meta name ="description " content ="An open-source workshop of cryptography, authentication, and infrastructure libraries by engineer Ned Wolpert. Featuring pk-auth, the Hofmann Elimination (OPAQUE PAKE), and a collection of JVM utilities. " />
7+ < meta name ="description " content ="An open-source workshop of cryptography, authentication, and infrastructure libraries by engineer Ned Wolpert. Featuring pk-auth, mini-auth (a teachable identity suite), the Hofmann Elimination (OPAQUE PAKE), and a collection of JVM utilities. " />
88 < meta name ="theme-color " content ="#0B0B0D " />
99
1010 < link rel ="preconnect " href ="https://fonts.googleapis.com " />
@@ -46,15 +46,13 @@ <h1 class="hero__title">
4646 < div class ="hero__split ">
4747 < p class ="hero__lead ">
4848 Run by < a href ="https://github.com/wolpert "> Ned Wolpert</ a > — coding
49- since 1994, Codehead since 2005 (Amazon · Alexa, and points
50- before and after). Libraries I've reached for too many times to keep
51- rebuilding.
49+ since 1981, coding for businesses since 1994. Open-source since 1998,
50+ and Codehead Systems since 2005.
5251 </ p >
5352
5453 < aside class ="hero__sidecar " aria-label ="workshop facts ">
5554 < dl >
5655 < div > < dt > Curator</ dt > < dd > Ned Wolpert</ dd > </ div >
57- < div > < dt > Coding since</ dt > < dd > 1994</ dd > </ div >
5856 < div > < dt > Codehead since</ dt > < dd > 2005</ dd > </ div >
5957 < div > < dt > License</ dt > < dd > Apache 2.0 / MIT</ dd > </ div >
6058 < div > < dt > Status</ dt > < dd > < span class ="status-dot " aria-hidden ="true "> </ span > actively maintained</ dd > </ div >
@@ -72,10 +70,11 @@ <h1 class="hero__title">
7270 < section id ="projects " class ="projects ">
7371 < header class ="section-head ">
7472 < span class ="mono-tiny "> § THE CATALOGUE</ span >
75- < h2 class ="section-head__title "> Three corners of the workshop.</ h2 >
73+ < h2 class ="section-head__title "> Four corners of the workshop.</ h2 >
7674 < p class ="section-head__lede ">
77- Three projects, each with its own discipline — passkeys, password-less
78- cryptography, and the small Java tools in between.
75+ The most recent four projects, each with its own discipline — passkeys, password-less
76+ cryptography, a teachable identity suite, and the small Java tools
77+ in between.
7978 </ p >
8079 </ header >
8180
@@ -183,12 +182,119 @@ <h3 class="project__title">
183182 </ div >
184183 </ article >
185184
186- <!-- ─── 03 · Libraries ─── -->
185+ <!-- ─── 03 · mini-auth ─── -->
187186 < article class ="project ">
188187 < header class ="project__rail ">
189188 < span class ="mono-tiny "> PROJECT</ span >
190189 < span class ="project__num " aria-hidden ="true "> 03</ span >
191- < span class ="mono-tiny project__rail-tag "> C – UTILS</ span >
190+ < span class ="mono-tiny project__rail-tag "> C – IDENTITY</ span >
191+ </ header >
192+
193+ < div class ="project__body ">
194+ < div class ="project__heading ">
195+ < h3 class ="project__title "> mini-auth</ h3 >
196+ < span class ="project__kicker mono-tiny "> oauth2 · oidc · passkeys</ span >
197+ </ div >
198+
199+ < p class ="project__lede ">
200+ A readable, < strong > educational</ strong > family of auth &
201+ identity services.
202+ </ p >
203+
204+ < p class ="project__text ">
205+ A monorepo of six small, deployable services and two shared
206+ libraries — each one intentionally small enough to read
207+ end-to-end. Real cryptography wired into a single token plane and
208+ policy engine, runnable in a homelab.
209+ </ p >
210+
211+ < ol class ="sub-list ">
212+ < li >
213+ < div class ="sub-list__row ">
214+ < span class ="sub-list__name "> mini-kms</ span >
215+ < a href ="https://github.com/codeheadsystems/mini-auth/tree/main/services/mini-kms " class ="sub-list__link mono-tiny "> view →</ a >
216+ </ div >
217+ < p class ="sub-list__note "> Envelope-encryption key management.</ p >
218+ </ li >
219+ < li >
220+ < div class ="sub-list__row ">
221+ < span class ="sub-list__name "> mini-idp</ span >
222+ < a href ="https://github.com/codeheadsystems/mini-auth/tree/main/services/mini-idp " class ="sub-list__link mono-tiny "> view →</ a >
223+ </ div >
224+ < p class ="sub-list__note "> Machine identity via OAuth2 client-credentials.</ p >
225+ </ li >
226+ < li >
227+ < div class ="sub-list__row ">
228+ < span class ="sub-list__name "> mini-oidc</ span >
229+ < a href ="https://github.com/codeheadsystems/mini-auth/tree/main/services/mini-oidc " class ="sub-list__link mono-tiny "> view →</ a >
230+ </ div >
231+ < p class ="sub-list__note "> Human SSO & OpenID Provider with passkey support.</ p >
232+ </ li >
233+ < li >
234+ < div class ="sub-list__row ">
235+ < span class ="sub-list__name "> mini-gateway</ span >
236+ < a href ="https://github.com/codeheadsystems/mini-auth/tree/main/services/mini-gateway " class ="sub-list__link mono-tiny "> view →</ a >
237+ </ div >
238+ < p class ="sub-list__note "> Forward-auth gateway for reverse proxies.</ p >
239+ </ li >
240+ < li >
241+ < div class ="sub-list__row ">
242+ < span class ="sub-list__name "> mini-directory</ span >
243+ < a href ="https://github.com/codeheadsystems/mini-auth/tree/main/services/mini-directory " class ="sub-list__link mono-tiny "> view →</ a >
244+ </ div >
245+ < p class ="sub-list__note "> Identity source of truth.</ p >
246+ </ li >
247+ < li >
248+ < div class ="sub-list__row ">
249+ < span class ="sub-list__name "> mini-ca</ span >
250+ < a href ="https://github.com/codeheadsystems/mini-auth/tree/main/services/mini-ca " class ="sub-list__link mono-tiny "> view →</ a >
251+ </ div >
252+ < p class ="sub-list__note "> Internal CA for mTLS workload identity.</ p >
253+ </ li >
254+ < li >
255+ < div class ="sub-list__row ">
256+ < span class ="sub-list__name "> mini-token</ span >
257+ < a href ="https://github.com/codeheadsystems/mini-auth/tree/main/libs/mini-token " class ="sub-list__link mono-tiny "> view →</ a >
258+ </ div >
259+ < p class ="sub-list__note "> Shared token plane & JWKS management.</ p >
260+ </ li >
261+ < li >
262+ < div class ="sub-list__row ">
263+ < span class ="sub-list__name "> mini-policy</ span >
264+ < a href ="https://github.com/codeheadsystems/mini-auth/tree/main/libs/mini-policy " class ="sub-list__link mono-tiny "> view →</ a >
265+ </ div >
266+ < p class ="sub-list__note "> Authorization decision engine.</ p >
267+ </ li >
268+ </ ol >
269+
270+ < p class ="project__text ">
271+ Built to teach: a concepts-first course, a code-first reading order,
272+ and labs that build and verify tokens by hand. Uses vetted,
273+ production-grade cryptographic constructions — though the project
274+ itself is unaudited.
275+ </ p >
276+
277+ < ul class ="chips ">
278+ < li > Java 21</ li > < li > OAuth 2.0</ li > < li > OpenID Connect</ li > < li > WebAuthn</ li > < li > mTLS</ li > < li > Ed25519</ li > < li > Argon2id</ li >
279+ </ ul >
280+
281+ < div class ="project__links ">
282+ < a class ="link-arrow link-arrow--lead " href ="https://codeheadsystems.github.io/mini-auth/ ">
283+ < span > visit the project site</ span > < span class ="link-arrow__icon "> ↗</ span >
284+ </ a >
285+ < a class ="link-arrow " href ="https://github.com/codeheadsystems/mini-auth ">
286+ < span > view source</ span > < span class ="link-arrow__icon "> ↗</ span >
287+ </ a >
288+ </ div >
289+ </ div >
290+ </ article >
291+
292+ <!-- ─── 04 · Libraries ─── -->
293+ < article class ="project ">
294+ < header class ="project__rail ">
295+ < span class ="mono-tiny "> PROJECT</ span >
296+ < span class ="project__num " aria-hidden ="true "> 04</ span >
297+ < span class ="mono-tiny project__rail-tag "> D – UTILS</ span >
192298 </ header >
193299
194300 < div class ="project__body ">
0 commit comments