Show HN: Octelium – FOSS L7-Aware Zero Trust Access/PaaS Platform over WireGuard

3 points

a year ago

Hello HN, I've been working solo on Octelium for years now and I'd love to get some honest opinions from you. Octelium is simply an open source, self-hosted, unified platform for zero trust resource access that is primarily meant to be a modern alternative to corporate VPNs and remote access tools. It is built to be generic enough to not only operate as a ZTNA/BeyondCorp platform (i.e. alternative to Cloudflare Zero Trust, Google BeyondCorp, Zscaler Private Access, Teleport, etc...), a zero-config remote access VPN (i.e. alternative to OpenVPN Access Server, Twingate, Tailscale, etc...), a scalable infrastructure for secure tunnels (i.e. alternative to ngrok, Cloudflare Tunnels, etc...), but also can operate as an API gateway, an AI gateway, a secure infrastructure for MCP gateways and A2A architectures, a PaaS-like platform for secure as well as anonymous hosting and deployment for containerized applications, a Kubernetes gateway/ingress/load balancer and even as an infrastructure for your own homelab.

Octelium provides a scalable zero trust architecture (ZTA) for identity-based, application-layer (L7) aware secret-less secure access (eliminating the distribution of L7 credentials such as API keys, SSH and database passwords as well as mTLS certs), via both private client-based access over WireGuard/QUIC tunnels as well as public clientless access, for users, both humans and workloads, to any private/internal resource behind NAT in any environment as well as to publicly protected resources such as SaaS APIs and databases via context-aware access control on a per-request basis through centralized policy-as-code with CEL and OPA.

I'd like to point out that this is not some MVP or a side project, I've been actually working on this project solely for way too many years now. The status of the project is basically public beta or simply v1.0 with bugs (hopefully nothing too embarrassing). The APIs have been stabilized, the architecture and almost all features have been stabilized too. Basically the only thing that keeps it from being v1.0 is the lack of testing in production (for example, most of my own usage is on Linux machines and containers, as opposed to Windows or Mac) but hopefully that will improve soon. Secondly, Octelium is not a yet another crippled freemium product with an """open source""" label that's designed to force you to buy a separate fully functional SaaS version of it. Octelium has no SaaS offerings nor does it require some paid cloud-based control plane. In other words, Octelium is truly meant for self-hosting. Finally, I am not backed by VC and so far this has been simply a one-man show.