octelium
Network SecurityA free, open‑source self‑hosted zero‑trust platform providing secure remote access VPNs, ZTNA/BeyondCorp, API and AI gateways, PaaS deployment capabilities, and homelab infrastructure.
Features
- Zero‑config remote access VPN via WireGuard/QUIC tunnels
- Comprehensive Zero Trust Network Access (ZTNA) / BeyondCorp platform
- Self‑hosted secure tunnel and reverse proxy alternative to ngrok/Cloudflare Tunnel
- Scalable PaaS for deploying containerized applications
- Secure API gateway with policy‑as‑code access control
Recent releases
View all 14 releases →- Added `octelium ssh` command for interactive SSH sessions and remote command execution on enabled Sessions.
- Added `octelium cp` command for copying files/directories between local filesystems and connected Session filesystems, including inter‑Session transfers.
Full changelog
You can upgrade an already running Cluster via the command octops upgrade as shown here. You can read the full changelog here.
Features
- Introducing the
octelium sshcommand. With this command you can open an interactive SSH session or execute a remote command, via an embedded SSH client inside theocteliumCLI, on a connected
Octelium Session using its name, if the Session is enabling the--esshflag when connecting to the Cluster. Here are some examples:
# Open an interactive shell
octelium ssh john-abcdef
# Run a single remote command
octelium ssh john-abcdef -- uptime
# Run a shell pipeline
octelium ssh john-abcdef -- sh -c "ps aux | grep python"
# Local port forward: forward local :5432 to remote localhost:5432
octelium ssh john-abcdef -L 5432:localhost:5432
# Multiple port forwards, no interactive shell
octelium ssh john-abcdef -N -L 5432:localhost:5432 -L 6379:localhost:6379
# Dynamic SOCKS5 proxy on local port 1080
octelium ssh john-abcdef -D 1080 -N
- Introducing the
octelium cpcommand. This command can copy files or directories between the local filesystem and remote filesystems of connected Octelium Sessions or between two connected Sessions that are enabling the--esshflag when connecting to the Cluster viaoctelium connect. Here are some examples:
# Copy a local file to a session
octelium cp ./config.json john-123456:/home/user/config.json
# Copy a file from a session to local
octelium cp john-123456:/home/user/output.csv ./output.csv
# Copy a local directory to a session
octelium cp -r ./src/ john-123456:/home/user/src/
# Copy a directory from a session to local
octelium cp -r john-123456:/home/user/dist/ ./dist/
# Copy a file from one session to another
octelium cp john-123456:/home/user/data.json linus-abcdef:/home/user/data.json
# Copy a directory from one session to another
octelium cp -r john-123456:/home/user/data/ linus-abcdef:/home/user/data/
Improvements
- Various fixes for the
octeliumCLI. - Various fixes and improvements for Vigil, GatewayAgent, Nocturne, Ingress, AuthServer, DNSServer.
- SBOM
sbom.jsonfile has been added to the release artifacts.
- Linux capabilities (add/drop) support in managed container securityContext
- CEL time functions: isWeekday, isWeekend, isWeekendInTZ, isWeekdayInTZ
- CEL net functions: isIP, isIPv4, isIPv6, isPrivateIP, isIPInRange
Full changelog
You can upgrade an already running Cluster via the command octops upgrade as shown here. You can read the full changelog here.
Features
- Support for adding and droping Linux capabilities in managed containers. Here is an example:
kind: Service
metadata:
name: nginx
spec:
mode: HTTP
config:
upstream:
container:
port: 80
image: nginx:latest
securityContext:
capabilities:
add: ["NET_ADMIN", "SYS_TIME"]
drop: ["ALL"]
- Introducing
timefunctions for the CEL engine. Here are some examples for the added functions:
time.isWeekday(timestamp("2023-10-18T12:00:00Z"))
time.isWeekend(timestamp("2023-10-21T12:00:00Z"))
time.isWeekendInTZ(timestamp("2023-10-20T23:00:00Z"), "Asia/Tokyo")
time.isWeekdayInTZ(timestamp("2023-10-22T23:00:00Z"), "Asia/Tokyo")
- Introducing
netfunctions for the CEL engine. Here are some examples for the added functions:
net.isIP("192.168.1.1")
net.isIPv4("10.0.0.1")
net.isIPv6("2001:db8::1")
net.isPrivateIP("10.5.0.1")
net.isIPInRange("192.168.1.50", "192.168.1.0/24")
Improvements
- Various reliability-related fixes for Vigil.
- Various fixes and improvements for Nocturne, AuthServer, RscServer and DNSServer.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.