Claimward authenticates users with your identity provider and brings up a per-device WireGuard tunnel to your private network, from macOS, Linux and Windows. Self-hosted, open source, written in Go.
GitHub out of the box (OAuth device flow), any OIDC provider — Google, Okta, Entra, Keycloak — or go-authn in front of a SAML federation such as RENATER or eduGAIN, where each device's WireGuard key is registered by its owner. No passwords on the wire.
Modern, lean crypto: kernel WireGuard on the gateway, wireguard-go on the devices. One peer per device, scoped routes, leases that expire on their own.
A person may belong to several tenants — matched on email domain, groups or institution — and chooses one per session. Each tenant's routes are pushed to its devices live, over gRPC on TLS.
The tunnel is owned by a small privileged helper that enrolls only with the servers its root-owned configuration names, takes no tunnel settings from a request, and listens on a socket one group can reach.
Run the control plane on your own gateway. BSD-3-Clause. No SaaS, no lock-in, no telemetry.
Control plane: verifies GitHub, OIDC or go-authn tokens, places the device in a tenant, allocates addresses, programs the WireGuard gateway, streams route updates.
Shared Go library: wire protocol, sign-in, tunnel, and the app core and privileged helper all three apps are built on. It ships no binary.
macOS app: Go tray + Svelte webview UI + privileged helper (LaunchDaemon). A DMG on each release.
Linux app: window and tray drawn in pure Go (go-widgets, no cgo), helper under a hardened systemd unit.
Windows app: window and tray drawn in pure Go (go-widgets, no cgo), helper as a service, tunnel on a Wintun adapter.
