Octelium
lastmod 2026-05-31created 2025-06-302 edits
A next-gen FOSS self-hosted unified zero trust secure access platform that can operate as a remote access VPN, a ZTNA/BeyondCorp architecture, API/AI gateway, a PaaS, an infrastructure for MCP & A2A architectures or even as an ngrok-alternative and a homelab infrastructure.
Open-source alternative to Teleport, Cloudflare, Tailscale, and Ngrok
About
- Octelium is a next-generation open-source self-hosted platform with unified support for remote access VPN, ZTNA, API/AI gateway, and more
- Self-hosted and single-tenant, it provides identity-based, application-layer (layer 7) secure access to all internal and public resources
- Includes features that meet modern security requirements, such as secret-less access, fine-grained policy-based control, and centralized management and auditing
- Offers a competitive edge over, and can replace, various commercial/open-source solutions such as Kubernetes, OpenVPN, Tailscale, and Cloudflare Access
- Adopts an open-source model and builds its business on commercial feature support and licensing, with a focus on providing full-featured self-hosting
Significance and overview of the Octelium project
- Octelium is a next-generation open-source unified Zero Trust self-hosted secure access platform that can replace commercial solutions such as Teleport, Cloudflare, Tailscale, and Ngrok.
- Compared with existing open-source/commercial solutions, its big advantage is that it can be fully self-hosted without compromising any features, free of extra costs and vendor lock-in.
What is Octelium
- Octelium is a unified access management platform applying identity-based, layer 7 algorithms
- It is an alternative to remote access VPNs (OpenVPN Access Server, Twingate, Tailscale, etc.) and also covers many roles such as ZTNA, BeyondCorp (Google BeyondCorp, Cloudflare Access, Teleport, etc.), ngrok (reverse proxy), API/AI gateway, self-hosted PaaS infrastructure, Kubernetes ingress replacement, and Homelab infrastructure
- For access by users (both humans and workloads), organizations, and applications, it supports both client-based access over WireGuard/QUIC tunnels and BeyondCorp-style clientless browser access
- At its core are policy-as-code, which defines policies as code, fine-grained context- and identity-based security, and secret-less authentication and authorization
Main use cases
- Modern remote access VPN: WireGuard/QUIC-based, dynamic, identity-aware, application-layer security
- Unified ZTNA/BeyondCorp access setup
- Self-hosted secure tunnel/reverse proxy (replaces ngrok, Cloudflare Tunnel)
- Self-hosted PaaS (container app deployment, scaling, anonymous public hosting)
- API gateway (replaces Kong Gateway, Apigee)
- AI gateway (LLM provider connections, identity-based control)
- Unified secret-less SaaS API access
- Provides MCP/A2A (model context and agent-to-agent standards) gateway infrastructure
- Advanced replacement for Kubernetes ingress/load balancers
- Homelab (unified secure remote management of personal resources, IoT, cloud, etc.)
Key features
Modern unified architecture
- Identity-aware, application-layer control for all resources (internal/behind NAT, public) and all users (humans/workloads)
- Provides both VPN-based remote access and BeyondCorp clientless access
- Runs on Kubernetes, with horizontal scaling and availability built in automatically
Dynamic secret-less access
- Supports secure access to many apps/DBs such as HTTP/gRPC APIs, web apps, SSH, Kubernetes, and PostgreSQL/MySQL without managing or sharing secret keys
- mTLS and the like can also be accessed without sharing PKI/certificates
Context-aware, identity-based, layer 7 access control
- Built-in centralized, modular, composable policy system (ABAC)
- Supports policy languages such as CEL and OPA, allowing fine-grained control per request
Dynamic routing/configuration
- Policy-based routing of the same resource to different upstream contexts, accounts, or conditions
Continuous strong authentication
- Integrates with standard IdPs such as OpenID Connect and SAML2.0
- Workloads authenticate secret-lessly with OIDC tokens
- Supports NIST assurance levels, MFA, and phishing resistance (Passkey, Yubikey, etc.)
Deep application-layer visibility and auditing
- OpenTelemetry integration; every request is logged in real time and sent to external OTLP collectors
Serverless SSH and container app deployment
- SSH access even to containers, IoT, and non-SSH hosts without root privileges
- Supports PaaS-like container app deployment, scaling, and secure access
Centralized, declarative, programmable management
- Managed declaratively like Kubernetes; cluster state can be reproduced with a single command/code
- DevOps/GitOps-friendly operation with the octeliumctl CLI and gRPC API
No network changes required, and chronic VPN problems solved
- Upstream resources do not need to know Octelium exists, and services can run securely behind NAT without opening ports
- Automated setup of unique dual-stack private IPs, private DNS, and more
Fully open source, self-hosted, no vendor lock-in
- Full source is public; no commercial-version feature restrictions or Vendor Lock-in
- Supports scalable setups from a single-node mini cluster to large clouds
License and support
- Client source is Apache 2.0; the cluster is AGPLv3
- Commercial licenses and enterprise support; external contributions are currently limited
- Community support via official documentation, Discord, Slack, email, Reddit, and more
Summary of key FAQ items
- Currently in Public Beta; became open source after a long period of internal development
- Led by a single developer (George Badawi), self-run without VC or outside capital
- Can act as a VPN, but fundamentally aims for a ZTA based on an identity-aware proxy
- The design goal is no actual "not-really-open-source" restrictions or commercial requirements, with full-featured self-hosting
- The business model comes from technical support, commercial licenses, and enterprise add-on features (e.g. SIEM integration, Vault backend, EDR)