Gemini Diffusion (deepmind.google)

Hello HN, I've been working solo on Octelium for the past 5+ years now, (yes, you just read that correctly :|) along with a couple more sub-projects that will hopefully be released soon and I'd love to get some honest opinions from you. Octelium is simply an open source, self-hosted, unified platform for zero trust resource access that is primarily meant to be a modern alternative to corporate VPNs and remote access tools. It is built to be generic enough to not only operate as a ZTNA/BeyondCorp platform (i.e. alternative to Cloudflare Zero Trust, Google BeyondCorp, Zscaler Private Access, Teleport, etc...), a zero-config remote access VPN (i.e. alternative to OpenVPN Access Server, Twingate, Tailscale, etc...), a scalable infrastructure for secure tunnels (i.e. alternative to ngrok), but also as an API gateway, an AI gateway, a secure infrastructure for MCP gateways and A2A architectures, a PaaS-like platform for secure as well as anonymous hosting and deployment for containerized applications, a Kubernetes gateway/ingress/load balancer and even as an infrastructure for your own homelab.

Octelium provides a scalable zero trust architecture (ZTA) for identity-based, application-layer (L7) aware secret-less secure access, via both private client-based access over WireGuard/QUIC tunnels as well as public clientless access (i.e. BeyondCorp), for users, both humans and workloads, to any private/internal resource behind NAT in any environment as well as to publicly protected resources such as SaaS APIs and databases via context-aware access control on a per-request basis through policy-as-code.

I'd like to point out that this is not an MVP, as I said earlier I've been working on this project solely for way too many years now. The status of the project is basically public beta or simply v1.0 with bugs (hopefully nothing too embarrassing). The APIs have been stabilized, the architecture and almost all features have been stabilized too. Basically the only thing that keeps it from being v1.0 is the lack of testing in production (for example, most of my own usage is on Linux machines and containers, as opposed to Windows or Mac) but hopefully that will improve soon. Secondly, Octelium is not a yet another crippled freemium product with an """open source""" label that's designed to force you to buy a separate fully functional SaaS version of it. Octelium has no SaaS offerings nor does it require some paid cloud-based control plane. In other words, Octelium is truly meant for self-hosting. Finally, I am not backed by VC and so far this has been simply a one-man show even though I'd like to believe that I did put enough effort to produce a better overall quality before daring to publicly release it than that of a typical one-man project considering the project's atypical size and nature.

Comments (2)

sybercecurity · 5h ago

Wow - looks impressive. Like the direction it's going. Doing things where access policies can be set as code is the way to go IMHO.

One issue I've heard from ZTA early adopters is the lack of interoperability between the various ZTNA solutions. Not a big problem unless you have two organizations that have different solutions that now have to work together (merger, partnership, etc.). Ironically, I have overheard people complain enough that they would pay for a FOSS solution...

geoctl · 5h ago

Thank you. Actually one of the very hardest things for me working on Octelium is basically how to describe it concisely and clearly and I still can't say that I have an answer, that's why I prefer to describe it as a "unified secure/zero trust access" platform. It's a ZTNA platform but not in the typical sense, it's also a remote-access VPN but actually works via identity-aware proxies to control access at L-7 instead of at L-3 like in VPNs. It's BeyondCorp but actually supports client-less access for both humans via their browsers and SSO but it also supports client-less access for workloads via OAuth2 client credential flows and standard bearer authentication which makes it relevant for any workload written in any language to access all your HTTP-based Services via a single bearer access token without being aware of the Cluster's existence at all. And it's also a deployment platform that enables you to deploy and scale any containerized application, HTTP-based or not, and instantly provide secure client-based/client-less access to it via your policies or even completely expose it to anonymous access like it's a hosting platform if you wish.

Gemini Diffusion (deepmind.google)

Google Wants You to Pay $250 for a God-Tier Subscription to AI (gizmodo.com)

AI Mode in Google Search (blog.google)

Nearly half of streaming subscriptions are for plans with ads (theverge.com)

Imagen 4 (deepmind.google)

Running the entire HEY test suite on different computers (twitter.com)

Iterator helpers have become Baseline Newly available (web.dev)

Veo 3: Video, meet audio (deepmind.google)

Thank You for Your Existence (daniel.haxx.se)

Gemini 2.5: Our most intelligent models are getting even better (blog.google)

Introducing Veo 3 and Imagen 4, and a new tool for filmmaking called Flow (blog.google)

Why Are Clinical Trials So Complicated? (2020) (science.org)

Where Did 'Jazz,' the Word, Come From? (2018) (wbgo.org)

Teacher Drag a 6yr-Old with Autism by His Ankle Fed OCR Might Not Do Anything (propublica.org)

Tesla Owners Are Installing DIY Rip Cords to Avoid Being Trapped in Case of Fire (fuelarc.com)

Magic Animator (magicanimator.com)

A bestiary of mathematical functions for systems designers (brunodias.dev)

A Fire Sale of Portland's Largest Office Tower Shows How Far the City Has Fallen (wsj.com)

NYC wants to turn 34th Street into a busway (nbcnewyork.com)

UUIDv7 Comes to PostgreSQL 18 (thenile.dev)

Chinese Hackers Hit Drone Sector in Supply Chain Attacks (securityweek.com)

Hackers Earn Over $1M at Pwn2Own Berlin 2025 (securityweek.com)

The Most Implausible Tunneling Method (practical.engineering)

Crawlomatic WordPress plugin patched for critical 9.8 RCE flaw (scworld.com)

Rust turns 10: How a broken elevator changed software forever (zdnet.com)

Good vs. Great Animations (emilkowal.ski)

Show HN: Sleek, Minimal and unique take on Portfolio (jaydip.me)

Investigation Update: Whole Cucumbers Outbreak, May 2025 (cdc.gov)

Microsoft Confirms Emergency Update for Windows Users (forbes.com)

MCP Server for Windows (blogs.windows.com)

I spent 15 years developing a tool to make sense of software version numbers

About Ghost (ghost.org)

Geek Seeks Gold: Search for Dutch Schultz's Missing Treasure [video] (youtube.com)

Microsoft-backed UK tech unicorn Builder.ai collapses into insolvency (ft.com)

Build a realtime chat app with Ably, Next.js and Netlify (ably.com)

Show HN: I built an iOS keyboard for iOS power users (flexiboardapp.framer.website)

Gemini 2.5 Flash Preview 05-20 (ai.google.dev)

Dieter Rams Turns 93 (instagram.com)

Agent Commerce Kit – Protocols for AI Agent Identity and Payments (github.com)

Chicago Sun-Times publishes made-up books and fake experts in AI debacle (theverge.com)

AI poses a bigger threat to women's work, than men's, says report (reuters.com)

Show HN: Transform Web, Text-to-CAD in the Browser (curranjrobertson.github.io)

By 2035 there will be at least one protest about turning off an AI (2023) (longbets.org)

When Textbook RSA Is Used to Protect the Privacy of Users (2018) (arxiv.org)

When Russia and America Coöperated to Avert a Y2K Apocalypse (2019) (newyorker.com)

Neural Networks, Manifolds, and Topology (colah.github.io)

The Last Letter (aeon.co)

How to Stop Students from Cheating with AI (wsj.com)

Experiment: My book took me a year to write. I had AI recreate it in an hour (varu.us)

Show HN: Codex powered language agnostic unit test generator (github.com)

Show HN: I Spent Years Building a FOSS Unified Zero Trust Secure Access Platform

Comments (2)