Octelium

What it is

Octelium is a self-hosted zero trust access platform from Octelium Labs LLC, whose sole owner, George Badawi, has developed it alone so far. It runs on Kubernetes. The page says it is getting ready for v1.0 and that its architecture, main features and APIs were stabilized before the project was open sourced.

How it works

Access goes through a scalable set of identity-aware proxies at layer 7, not through layer-3 routing. Clients connect over WireGuard (kernel, TUN, or unprivileged via gVisor) or, experimentally, QUIC. Clientless access is also supported. Upstreams need no change and can listen on localhost or behind NAT.

Policies use CEL and OPA, are evaluated per request, and can also choose upstreams and credentials dynamically. The page says there is no "admin" user, so zero standing privileges is the default. Secretless access covers HTTP APIs, SSH, Kubernetes, PostgreSQL/MySQL-compatible databases, and any L7 protocol protected by mTLS. Every request is logged and exported over OTLP.

Preconditions / Affected

The single-node install needs a Linux VM or VPS with at least 2GB RAM and 20GB disk, running Ubuntu 24.04 LTS or later or Debian 12+, and a domain name. The page calls this enough for development, personal or undemanding production use, but not for highly available setups. Multi-node Kubernetes is supported for those.

What to do

Install a single-node cluster as root on the VM:

curl -o install-cluster.sh https://octelium.com/install-cluster.sh
chmod +x install-cluster.sh
# Replace <DOMAIN> with your actual domain
./install-cluster.sh --domain <DOMAIN>

Install the CLIs on Linux or macOS:

curl -fsSL https://octelium.com/install.sh | bash

Or with Homebrew:

brew install octelium/tap/octelium

A playground repository runs a demo cluster in a GitHub Codespace, so you can try it without a real VM. Clusters are managed declaratively with octeliumctl, and configurations can be kept in Git.

Caveats

• Licensing is split. The CLIs, the Go SDK, /apis and /pkg are Apache 2.0. Everything in /cluster is AGPLv3, with a commercial license offered as an alternative. Check AGPLv3 fit before embedding or modifying the server side.
• Some features are enterprise-only. The web dashboard, SIEM integrations (Splunk, Datadog), SCIM 2.0 provisioning, encrypted Secret management at rest, TLS and public DNS management, and UI policy builders are in a separate source-available enterprise repository. It is free for personal and internal evaluation use.
• Not yet v1.0. The page gives no date. QUIC tunneling is labelled experimental.
• Single maintainer. The project does not accept pull requests, though the page says this may change. Vulnerabilities go to security@octelium.com.
• Piped installers. The install scripts are fetched from octelium.com and run directly, so review them before running as root.
• Not covered. The page gives no benchmarks, audit results or production references.