Tor
Outbound-only Tor client. Exposes SOCKS5 to permitted devices, with optional transparent-proxy and DNS-over-Tor.
spr-tor
gluetun
Multi-provider outbound VPN gateway with a built-in kill switch and DNS-over-TLS. Route selected device groups through any supported provider.
spr-gluetun
Algo VPN
Deploy a personal WireGuard VPN to your own cloud account, straight from the router. Keys and configs stay on the router.
spr-algo
WARP MASQUE
Route traffic through Cloudflare's WARP MASQUE proxy. Useful for network egress that needs a stable IP or DNS-over-HTTPS at the edge.
spr-masque
Tailscale
Join your router to a Tailscale mesh. Reach LAN devices from anywhere, with SPR gating which devices actually cross the tailnet.
spr-tailscale
Headscale
Run the open-source Tailscale control server on your router. Your tailnet's coordination server lives on hardware you own — no cloud account required.
spr-headscale
Nebula
Slack's open-source overlay mesh: peer-to-peer WireGuard-style networking with a lighthouse for discovery. Pinned build from upstream source.
spr-nebula
Reticulum
A cryptography-based networking stack designed to work over anything from LoRa radios to the open internet. Run a Reticulum node on your router.
spr-reticulum
Meshtastic
Bridge a Meshtastic LoRa node to the SPR UI. See who's on the mesh, monitor battery and SNR, send text messages — all from the router.
spr-meshtastic
tunwg
Publish local services at public HTTPS URLs via end-to-end encrypted WireGuard tunnels, with automatic certificates. No port-forwarding.
spr-tunwg
dnscrypt-proxy
Encrypted outbound DNS on its own docker bridge. Pick resolvers, filter by protocol, and pin your upstream from SPR's UI.
spr-dnscrypt
SimpleX
Host your own SimpleX Chat relay (SMP server) on the router. Private message queues that never touch public servers, with a one-tap relay address for the app.
spr-simplex
mitmproxy
Intercept and inspect HTTPS traffic from selected devices. Ideal for reverse-engineering IoT behavior against strict egress policies.
spr-mitmproxy
Wireshark
Live packet capture in the browser. Point at a device, an interface, or a VLAN, and get a Wireshark session without leaving the SPR UI.
spr-wireshark
RIPE Atlas
Host a RIPE Atlas software probe. Contribute ping/traceroute/DNS/TLS measurements from your network and earn credits for your own probes.
spr-atlas
Diagnostics
Proof of concept
Nexmon
Packet injection for Raspberry Pi WiFi chipsets via Nexmon. Useful for research on WiFi behavior against your own network.
spr-nexmon
Home Assistant
Expose router and client state to Home Assistant. Devices, traffic, WiFi status, and speed tests become sensors and services.
home-assistant
Vaultwarden
Self-host a lightweight Bitwarden-compatible password vault on your router, with SPR-managed settings and HTTPS certificate support.
spr-vaultwarden
For developers
Build a plugin
Plugins are docker-compose apps with a small plugin.json
that declares an install token path, an optional web UI, and the network capabilities SPR should grant.
SPR handles isolation, routing, and the reverse proxy for you.