Use OpenZiti to secure your monitoring
blog.openziti.io
blog.openziti.io
For access to my home network, I use two things:
1. Wireguard
2. An identity aware SSO proxy by Buzzfeed[0]
I really like Buzzfeed's SSO implementation, but it hasn't received updates in a while and doesn't seem to be maintained to me. I could absolutely see OpenZiti replacing this for me.
I really like Wireguard and have absolutely no complaints with it -- but if OpenZiti could replace this as well and match the performance I get on Wireguard I would consider implementing it at home (and would probably be a happy enough customer to push for it at work).
One non-typical use-case I use Wireguard for is being able to do remote game streaming to my Windows hosts via Moonlight+Nvidia Gamestream. Would anyone be able to (anecdotally or scientifically) share how well a use-case like this would work with OpenZiti?
Performance wise, it depends. Wireguard is UDP-based so for some use cases it gets awesome performance but not all, and often requires tweaking to optimise. OpenZiti is TCP out of the box (this year we will move it to UDP with optimisations to deliver TCP reliability with a protocol we have built - https://github.com/openziti/ziti/blob/v0.19.8/doc/transwarp_...). You can see a comparison here - https://netfoundry.io/benchmark/benchmarking%20open%20source...
It would be interesting to understand too, if you replace Buzzfeed SSO with OpenZiti, are there any features you would want OpenZiti to have (i.e., can share that they exist already or we learn where we potentially need to do development)?
You can 100% use OpenZiti for gaming use cases, I have a couple of colleagues who have written blogs on it: - https://blog.openziti.io/set-up-a-secure-multiplayer-minecra... - https://www.reddit.com/r/selfhosted/comments/v8222j/gaming_o...
One thing I'm not seeing in docs is a way to use existing third-party identity systems (such as Okta, LDAP, Google Oauth, etc.). Does OpenZiti have a way to use external identities? As an example, with Buzzfeed SSO, I can expose an HTTP application to the world, but limit who can actually access it (such as my brother who can use his Gmail to authenticate to certain services I have shared with him).
Also we have already support 3rd party CAs too. It's a complex topic though so "it depends" is probably the best answer.