I developed it, so I'm biased, but you might look at http://socketpolicyserver.com
The software is packaged as a Debian package, making it easy to install, upgrade, delete, or purge on Debian systems.
The software is written as an Apache module and uses configuration files that are relatively familiar to anyone using Apache.
The software uses the cross-platform Apache Portable Runtime library, allowing the code to be relatively simple and easy to audit.
The software is well-documented and includes logging capabilites and working configuration files.
Those are some of the best practices I used when designing and packaging the software. And here is a caveat:
- As of the date of this posting, the software has been in production use for several months without any glitches, however, please note that it has not been subject to heavy loads.
I know this isn't everything you asked - simply several pros and a caveat for one package.