Tor
Outbound-only Tor client. Exposes SOCKS5 to permitted devices, with optional transparent-proxy and DNS-over-Tor.
spr-tor
gluetun
Multi-provider outbound VPN gateway with a built-in kill switch and DNS-over-TLS. Route selected device groups through any supported provider.
spr-gluetun
Algo VPN
Deploy a personal WireGuard VPN to your own cloud account, straight from the router. Keys and configs stay on the router.
spr-algo
WARP MASQUE
Route traffic through Cloudflare's WARP MASQUE proxy. Useful for network egress that needs a stable IP or DNS-over-HTTPS at the edge.
spr-masque
USQUE WARP TUN
TUN interface for routing traffic to MASQUE by @Diniboy1123/usque
spr-usque
Tailscale
Join your router to a Tailscale mesh. Reach LAN devices from anywhere, with SPR gating which devices actually cross the tailnet.
spr-tailscale
Headscale
Run the open-source Tailscale control server on your router. Your tailnet's coordination server lives on hardware you own — no cloud account required.
spr-headscale
Nebula
Slack's open-source overlay mesh: peer-to-peer WireGuard-style networking with a lighthouse for discovery. Pinned build from upstream source.
spr-nebula
Reticulum
A cryptography-based networking stack designed to work over anything from LoRa radios to the open internet. Run a Reticulum node on your router.
spr-reticulum
Meshtastic
Bridge a Meshtastic LoRa node to the SPR UI. See who's on the mesh, monitor battery and SNR, send text messages — all from the router.
spr-meshtastic
tunwg
Publish local services at public HTTPS URLs via end-to-end encrypted WireGuard tunnels, with automatic certificates. No port-forwarding.
spr-tunwg
dnscrypt-proxy
Encrypted outbound DNS on its own docker bridge. Pick resolvers, filter by protocol, and pin your upstream from SPR's UI.
spr-dnscrypt
Let's Encrypt
Set up TLS certificates for private LAN services with ACME/LetsEncrypt
spr-acme
SimpleX
Host your own SimpleX Chat relay (SMP server) on the router. Private message queues that never touch public servers, with a one-tap relay address for the app.
spr-simplex
Nostr
Run your own Nostr relay on the router with rust-nostr. Your clients publish and read notes through a relay you control, with NIP-11 info and NIP-42 auth.
spr-nostr
OpenCanary
Run believable decoy services on your network and surface unexpected probes, connections, and login attempts in SPR, with local history and optional webhooks.
spr-opencanary
Herdr
Run Herdr to deploy agents in KVM on SPR.
spr-herdr
mitmproxy
Intercept and inspect HTTPS traffic from selected devices. Ideal for reverse-engineering IoT behavior against strict egress policies.
spr-mitmproxy
Wireshark
Live packet capture in the browser. Point at a device, an interface, or a VLAN, and get a Wireshark session without leaving the SPR UI.
spr-wireshark
RIPE Atlas
Host a RIPE Atlas software probe. Contribute ping/traceroute/DNS/TLS measurements from your network and earn credits for your own probes.
spr-atlas
Diagnostics
Proof of concept
Nexmon
Packet injection for Raspberry Pi WiFi chipsets via Nexmon. Useful for research on WiFi behavior against your own network.
spr-nexmon
Hermes Agent
Run Nous Research's open-source Hermes Agent in an isolated krun guest, with its full dashboard embedded in SPR and router-managed WAN and DNS access.
spr-hermes
Home Assistant
Expose router and client state to Home Assistant. Devices, traffic, WiFi status, and speed tests become sensors and services.
home-assistant
Vaultwarden
Self-host a lightweight Bitwarden-compatible password vault on your router, with SPR-managed settings and HTTPS certificate support.
spr-vaultwarden
