[opensourcedex]

octelium is a free, open source api development & testing project written in Go and released under AGPL-3.0. It has 4,056 GitHub stars, 153 forks and 16 open issues, and was last pushed 14 hours ago. On this registry it ranks #55 of 103 tracked projects in API Development & Testing, with 5 head-to-head comparisons available. It gained 5 stars over the last 3 tracked days.

What is octelium?

What it is

Octelium is a free and open source self-hosted zero trust secure access platform written in Go under the AGPL-3.0 license. It can operate as a remote access VPN, a ZTNA platform, an ngrok or Cloudflare Tunnel alternative, an API gateway, an AI or LLM gateway, a PaaS-like deployment platform, a Kubernetes gateway or ingress, and a homelab infrastructure.

The problem it addresses is the burden of giving people and workloads secure access to internal services, SaaS APIs, and deployed applications without distributing long-lived secrets or running several separate access tools. Octelium places access decisions at the application layer and uses identity-based, context-aware policies so each request can be evaluated before it reaches the resource. It sits in the self-hosted developer tools and API access ecosystem.

Key capabilities

  • Octelium provides private client access over WireGuard and QUIC tunnels, and public clientless access for humans and workloads.
  • It supports application-layer L7 access control, so policies can be applied on a per-request basis.
  • It offers secretless access to resources behind NAT and to SaaS APIs and databases.
  • It includes AI, LLM, and MCP gateway functions with identity-based access control, routing, and visibility.
  • It can deploy containerized applications as a PaaS-like platform, and it supports Kubernetes gateway or ingress use.

Who uses it and how

  • Teams can use it as a self-hosted remote access VPN alternative to OpenVPN Access Server, Twingate, and Tailscale, with client and clientless access.
  • Organizations can use it as a ZTNA or BeyondCorp-style platform, similar to Cloudflare Access, Google BeyondCorp, and Teleport, for identity-based access to private resources.
  • Developers and platform teams can use it as a tunnel, API gateway, AI gateway, or deployment platform, similar to ngrok, Cloudflare Tunnel, Kong Gateway, Apigee, Vercel, and Netlify.

Getting started

The README points to trying Octelium in a Codespace, installing CLI tools, and installing a first cluster. Kubernetes is listed as a topic, so cluster deployment is expected.

When to use it — and when not to

Octelium is a self-hosted alternative to several paid access, tunneling, gateway, and deployment products, but the operator must run the platform and its cluster infrastructure instead of relying on a hosted service. The AGPL-3.0 license may matter for teams that cannot use AGPL-licensed software in their deployment model. The repository is about one year old, the contributor count is not shown, it has sixteen open issues, and the README badges show both Apache 2.0 and AGPL v3, so teams should verify licensing and maturity before production use.

project readme (upstream, from github) — read inline

License License Discord Slack


Octelium

Table of Contents

What is Octelium?

Octelium is a free and open source, self-hosted, unified zero trust secure access platform that is flexible enough to operate as a modern zero-config remote access VPN, a comprehensive Zero Trust Network Access (ZTNA)/BeyondCorp platform, an ngrok/Cloudflare Tunnel alternative, an API gateway, an AI/LLM gateway, a scalable infrastructure for access and deployment to build MCP gateways and AI agent-based architectures/agentic meshes, a PaaS-like deployment platform for containerized applications, a Kubernetes gateway/ingress and even as a homelab infrastructure.

Octelium provides a scalable zero trust architecture (ZTA) for identity-based, application-layer (L7) aware secretless secure access via both private client-based access over WireGuard/QUIC tunnels as well as public clientless access, for both humans and workloads, to any private/internal resource behind NAT in any environment as well as to publicly protected resources such as SaaS APIs and databases, via context-aware access control on a per-request basis.

Octelium

Use Cases

Octelium is a versatile platform that can serve as a complete or partial solution for many different needs. Here are some of the key use cases:

  • Modern Remote Access VPN: A zero-trust, layer-7 aware alternative to commercial remote access/corporate VPNs like OpenVPN Access Server, Twingate, and Tailscale, providing both zero-config client access over WireGuard/QUIC and client-less access via dynamic, identity-based, context-aware Policies.
  • Unified ZTNA/BeyondCorp Architecture: A comprehensive Zero Trust Network Access (ZTNA) platform, similar to Cloudflare Access, Google BeyondCorp, or Teleport.
  • Self-Hosted Secure Tunnels: A programmable infrastructure for secure tunnels and reverse proxies for both secure identity-based as well as anonymous clientless access, offering a powerful, self-hosted alternative to ngrok or Cloudflare Tunnel. You can see an example here.
  • Self-Hosted PaaS: A scalable platform to deploy, manage, and host your containerized applications, similar to Vercel or Netlify. See an example for Next.js/Vite apps.
  • API Gateway: A self-hosted, scalable, and secure API gateway for microservices, providing a robust alternative to Kong Gateway or Apigee. You can see an example here.
  • AI Gateway: A scalable AI gateway with identity-based access control, routing, and visibility for any AI LLM provider. See an example here.
  • Unified Zero Trust Access to SaaS APIs: Provides secretless access to SaaS APIs for both teams and workloads, eliminating the need to manage and distribute long-lived and over-privileged API keys. See a generic example here, AWS Lambda here, and AWS S3 here.
  • MCP Gateways and A2A-based Architectures A secure infrastructure for Model Context Protocol (MCP) gateways and Agent2Agent Protocol (A2A)-based architectures that provides identity management, authentication over standard OAuth2 client credentials and bearer authentication, secure remote access and deployment as well as identity-based, L7-aware access control via policy-as-code and visibility (see an example here).
  • Homelab: A unified self-hosted Homelab infrastructure to connect and provide secure remote access to all your resources behind NAT from anywhere (e.g. all your devices including your laptop, IoT, cloud providers, Raspberry Pis, routers, etc...) as well as a secure deployment platform to deploy and privately as well as publicly host your websites, blogs, APIs or to remotely test heavy containers (e.g. LLM runtimes such as Ollama, databases such as ClickHouse and Elasticsearch, Pi-hole, etc...). See examples for remote VSCode, and Pi-hole.
  • Kubernetes Ingress Alternative: A more advanced alternative to standard Kubernetes ingress controllers and load balancers, allowing you to route to any Kubernetes service via dynamic, L7-aware policy-as-code (see an example here).

Main Features

  • A Modern, Unified Zero Trust Architecture Built on a scalable architecture of identity-aware proxies to control access at the application layer (L7), Octelium unifies access for humans and workloads to both private and protected public resources. It supports both zero-config VPN-like client-based access over WireGuard/QUIC and client-less BeyondCorp access, all built on top of Kubernetes for automatic scalability (read in detail about how Octelium works here).

  • Dynamic Secretless Access Octelium's layer-7 awareness enables Users to seamlessly access resources protected by application-layer credentials without exposing, managing and distributing such secrets (read more here). This works for HTTP APIs without sharing API keys and access tokens, SSH servers without sharing passwords and private keys, Kubernetes clusters without distributing kubeconfigs, PostgreSQL/MySQL databases (including compatible PostgreSQL/MySQL databases such as MariaDB and CockroachDB) without sharing passwords as well as any L7 protocol protected by mTLS.

  • Modern, Dynamic, Fine-grained Access Control Octelium provides you a modern, centralized, scalable, fine-grained, dynamic, context-aware, layer-7 aware, attribute-based access control system (ABAC) on a per-request basis (read more here) with policy-as-code using CEL and OPA (Open Policy Agent). Octelium has no notion of an "admin" user, enforcing zero standing privileges by default.

  • Context-aware, identity-based, L7-aware dynamic configuration and routing Route to different upstreams, different credentials representing different upstream contexts and accounts using policy-as-code with CEL and OPA on a per-request basis. You can read in detail about dynamic configuration here.

  • Continuous Strong Authentication A unified authentication system for both human and workload Users, supporting any web identity provider (IdP) that uses OpenID Connect or SAML 2.0 as well as GitHub OAuth2 (read more here). It also allows for secretless authentication for workloads via OIDC-based assertions (read more here). Built-in support for MFA/re-authentication/login via

readme truncated — read the full docs on github

Frequently asked questions

Is octelium free to use?

octelium is open source under the AGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does octelium do?

A next-gen FOSS self-hosted unified zero trust secure access platform that can operate as a remote access VPN, a ZTNA platform, API/AI/MCP gateway, a PaaS, an n

What is octelium written in?

octelium is primarily written in Go. Its source is publicly available at https://github.com/octelium/octelium, and it has 4,056 GitHub stars.