Moat

Moat is still in development. The gate, the command line and the desktop app work; Moat Cloud doesn't exist yet. If you want to try it, you'll find everything on GitHub.

The problem

Many small companies run their website on ordinary shared hosting: PHP, FTP access, no server of their own. As soon as the website needs to talk to another service, things get tricky. A newsletter form creates a contact in HubSpot or Mailchimp, a chat on the website asks OpenAI. That takes an API key, and it must never end up in the browser. Whoever finds it there can read contacts, send emails or run AI requests on the company's bill.

The usual ways out are a backend of your own, a paid API gateway service or a quickly written PHP script that holds the key in plain text and forwards everything that comes in. Moat aims to be a fourth way: simple enough for shared hosting and still secure.

What is Moat?

Moat puts a small gate on the hosting you already have: a single PHP file, without Composer and without a database. The website only calls the gate, and the gate:

• forwards only approved routes: exact method and path, a fixed target address, HTTPS only. Everything else gets an error.
• adds the API key only on the way out. The browser never sees it, and even on the hosting it is stored only encrypted.
• limits what a visitor can do: rate limits per visitor and overall, the size of a request, allowed content types and which websites may call the gate at all.
• can be locked: an environment like “staging” or a single gate is switched off with one command and then forwards nothing.

Secure, even when something goes wrong

One rule stands above all others in Moat: even if Moat Cloud is hacked, the gate on the hosting must not be compromised. It follows that:

• The configuration is pure data, never code. The gate executes nothing it receives.
• The gate accepts a new configuration only if it is signed with your own key, is meant for exactly this gate and has a higher version than the current one.
• Secrets are sealed on your own computer for one specific gate and can only be opened there.
• A local policy on the hosting defines what is allowed at all and always takes precedence over the configuration.
• The gate has no admin interface on the internet.
• The gate checks target addresses before connecting: no internal addresses, no automatic redirects.

How much you trust Moat Cloud is up to you. With Moat Desktop or the command line every gate runs in “Signed” mode: you approve every change with your own key file. If Moat Cloud is hacked, an attacker can't change anything.

Moat Desktop

Moat Desktop is the app for your own computer, with no account and no server. Every website is a project, and a project is a folder with a moat.yaml that you can also keep in Git. The app shows at a glance which routes, gates and environments exist, whether all secrets are sealed and whether a gate is locked.

Routes, upstreams and environments can be edited right in the app. Comments in the moat.yaml are kept, and a help section explains every step. Sealing and signing still run through the command line for now.

Who is it for?

For small companies, clubs and agencies whose website runs on shared hosting and who want to connect a few services without running a server of their own. The gate only needs PHP 8.2 or newer with the sodium and curl extensions. Gates for Node and .NET are planned for later.

What exists and what's coming

• Works: the PHP gate (signed bundles, exact routing, SSRF protection, CORS, rate limits, locks), the moat command line and Moat Desktop.
• Planned: Moat Cloud as a dashboard, as a service or self-hosted with Docker or Kubernetes; quotas and budgets, so that for example an AI chat can't cost more than a fixed amount per day; sealing and signing right in the desktop app; a setup wizard and ready-made templates for services like HubSpot or OpenAI.

How it's built

• An Nx monorepo in TypeScript. Moat Core contains schema, signing and sealing exactly once, and the command line, the desktop app and later the cloud all use the same code.
• The gate is PHP with no runtime dependencies, built as a single file, checked with PHPStan at the highest level and tested on PHP 8.2 to 8.5.
• Cryptography only with libsodium (Ed25519 signatures, XChaCha20-Poly1305), checked in TypeScript and PHP against the same test vectors.
• Moat Desktop with Electron and Angular, the configuration as YAML with a strict schema.
• Shared conformance tests every gate must pass, and security tests from an attacker's point of view.
• Planned, built and tested largely together with AI agents.

Code and license

The code is on GitHub, under the MIT license. You may use, change and share it freely, commercially too. Bugs and ideas are welcome as issues. The screenshots show sample data; no real API was called in the demos.