Zero Trust

Look, zero trust access is what every security team talks about. Yet self-hosting a proper ZTNA stack means Kubernetes, CEL policies, and identity brokers — infrastructure stuff most people don’t want to touch. Octelium, an AGPL-3.0 project with 3,922 stars on GitHub, wraps all that into a single deployable stack that runs on a $6 VPS (affiliate link). Our quick take: Octelium is a standout open-source ZTNA option for teams who need self-hosted secure access without per-user licensing fees. The CLI-based installer handles everything from cluster bootstrap to TLS certificates in one script. And the policy engine supports CEL expressions and OPA-style rules for fine-grained access control — the kind of flexibility you’d expect from Cloudflare Access, but fully self-hosted. ...

Netmaker hits 11,665 GitHub stars as of July 2026 — but those stars aren’t from a launch-day hype spike. The project shipped v1.6.0, runs 7,705 commits, and is backed by Y-Combinator. The fastest setup we tested got a 3-node WireGuard mesh running in 22 minutes on three $6/month VPS instances. And we say “got” deliberately — because with raw WireGuard, that same setup took our team 2 hours and 14 minutes of manual config editing. Netmaker’s elevator pitch is that it removes manual WireGuard configuration entirely. After testing it across three cloud providers and a home lab, here’s what held up and what didn’t. When you purchase through our links, we may earn a commission. Thanks for supporting our independent testing! ...

Your WireGuard setup handles the tunnel fine. But does it ask for a second factor every time someone connects? Most self-hosted WireGuard tools — WAG, easy-wg-quick, Headscale — only solve the connection part. They don’t enforce authentication at the VPN level. So once someone gets your config file, they’re in. No second factor required. Disclosure: Some links in this review are affiliate links. We may earn a commission at no extra cost to you if you purchase through them. ...

Two weeks ago, PrivacyGuard published a full Firezone review covering the open-source zero-trust WireGuard platform — architecture, pricing, deployment walkthrough, and a comparison table against Tailscale and Netbird. Since then, the project pushed a significant connlib refactor (PR #13908), shipped two new client releases, and kept daily commits flowing. So here’s the natural follow-up question: has anything meaningful changed for someone evaluating Firezone? Short answer: the connlib refactor makes the internals cleaner, but your deployment decision from two weeks ago still holds. ...

The traditional VPN is dying. Not hyperbole — enterprise security teams are actively replacing perimeter-based access with zero-trust architectures. And Firezone is one of the most compelling open-source options in this space right now. After spending a week testing it on a $6 DigitalOcean VPS, here’s what stood out — and what didn’t. So first, the one-liner: Firezone is an open-source (Apache 2.0) zero-trust access platform built entirely on WireGuard. It gives teams resource-level access control with default-deny policies, SSO sync from Google Workspace or Microsoft Entra ID, and NAT hole-punching. You self-host it on a cheap VPS, or go with their managed cloud tier. Either way, the same Gateways work in both modes — so migrating later doesn’t hurt. ...

Firezone: open-source zero-trust via WireGuard with Docker self-hosted deploy. Quick review of features, pricing, and comparison to Tailscale and Netbird.