beyondcorp 开源项目推荐（24 个）

pomerium /pomerium

Pomerium is an identity and context-aware access proxy.

octelium /octelium

新一代 FOSS 自托管统一零信任安全访问平台，可作为远程访问 VPN、ZTNA 平台、API/AI/MCP 网关、PaaS、ngrok 替代方案以及家庭实验室基础设施运行。

thomseddon /traefik-forward-auth

最低限度的前向验证服务，为traefik反向代理提供基于Google/OpenID oauth的登录和验证

pomerium /awesome-zero-trust

A curated collection of awesome resources for the zero-trust security model.

pritunl /pritunl-zero

Zero trust system

presbrey /beyond

BeyondCorp-inspired HTTPS/SSO Access Proxy. Secure internal services outside your VPN/perimeter network during a zero-trust transition.

cloudposse /terraform-aws-ec2-bastion-server

Terraform 模块，用于定义一个通用的 Bastion 主机，具备参数化的user_data并支持 AWS SSM 会话管理器，实现带有 IAM 认证的远程访问。

gnur /tobab

tobab: the poor mans identity aware proxy, easy to use setup for beyondcorp in your homelab

dniel /traefik-forward-auth0

A backend for performing forward authentication with Auth0 using the Traefik reverse proxy.

pomerium /pomerium-helm

Official helm charts for Pomerium.

gnur /beyondauth

a traefik / nginx companion to create an identity aware proxy like beyondcorp

jsiebens /brink

brink - a lightweight identity aware proxy

pomerium /pomerium-operator

An operator for running Pomerium on a Kubernetes cluster.

cyakimov /helios

Identity-Aware Proxy

ChandraNarreddy /sniproxy

SNI respecting TLS reverse proxy that supports pluggable authentication

route1337 /docker-cf-mnet-server

A simple webserver that serves some basic data for Cloudflare ZTA Managed Network usage

kostyay /gcloud-switch

kubectx for gcloud — fast, native CLI to switch gcloud configurations with fuzzy pick, auth checks, and no Python cold-start

Chebis26 /zero-trust-architecture

Zero Trust AWS architecture: identity-aware proxy, microsegmentation, continuous verification, BeyondCorp patterns on AWS

MahyarNemati /zero-trust-gateway

Identity-aware reverse proxy in Go: OIDC login with PKCE, WebAuthn passkeys with step-up auth, sealed session cookies, per-route policy with hot reload, and short-lived ES256 assertions minted for upstreams.

HOFFMAN-ALTERNATIVE /zero-trust-gateway

Identity-aware zero-trust reverse proxy in Go: OIDC/JWT + JWKS rotation, PKCE login, deny-by-default YAML policy, mTLS 1.3 upstreams, signed sessions, JSON audit log, Prometheus