Rangs eMART Access Control

Problem

The company ERP sat on a public IP and was directly addressable from the internet. A shared or stolen application password worked from any laptop anywhere. The fix had to close that hole without a SaaS per-seat bill and without touching the ERP itself.

Constraints

• Employees are not local administrators; enrolment had to be a single command they could run.
• The ERP server's own firewall is the authority on ports. The new layer must not replace it.
• Adding a second protected application later should be configuration, not a project.
• The whole thing runs on one small cloud instance with no break-glass access besides SSH.

Architecture

• Headscale control plane (self-hosted Tailscale) with a subnet router that advertises the ERP address; the ERP firewall trusts only the router's egress IP, so even a PC on the office LAN is blocked unless enrolled.
• Caddy for TLS and the public entry points, Authelia for admin authentication with regulation and lockout, Headplane for node, tag, ACL, and DNS management.
• A Python enrolment and approval service that turns a PowerShell one-liner on the employee's PC into a pending request an administrator approves in a web console.
• A service registry (services.json): adding an application regenerates the ACL policy, advertises and approves the subnet route, rewrites firewall rules, and creates an internal DNS name in one step. Removing it revokes all four.
• age-encrypted backups of the control plane on a timer, health checks, and a disaster-recovery runbook.

What I built

Everything: the install phases, hardening, the registry apply script, the enrolment service and Windows scripts, and the documentation set (security model, runbook, onboarding, troubleshooting, failure behaviour, DR).

Outcome

The ERP is no longer reachable from the internet, an approved device loses access within seconds of revocation, and the second protected application took an afternoon. The security model document records the accepted risks honestly, including the one control the customer chose to switch off.