Claimward

Zero-Trust access to your network, on your terms.

Claimward authenticates users with your identity provider and brings up a per-device WireGuard tunnel to your private network. Self-hosted, open source, written in Go.

Get started View on GitHub
🔐

Auth you already have

GitHub out of the box (OAuth device flow), or any OIDC provider — Google, Okta, Entra, Keycloak. No passwords on the wire.

⚡

WireGuard fast

Modern, lean, kernel-grade crypto. One peer per device, scoped routes, leases that expire on their own.

🧩

Self-hosted & open

Run the control plane on your own gateway. BSD-3-Clause. No SaaS, no lock-in, no telemetry.

How it works

  1. Sign in. The client authenticates with GitHub (or any OIDC provider) in your browser.
  2. Enroll. It sends its WireGuard public key to the server with that token.
  3. Authorize. The server verifies the token, allocates an address, and adds the device as a peer on the gateway.
  4. Connect. The client brings up an encrypted WireGuard tunnel into your private network.

Open components

claimward-vpn-server

Control plane: verifies OIDC tokens, allocates addresses, programs the WireGuard gateway.

claimward-vpn-client

Shared Go core (protocol, OIDC, tunnel) and the claimward CLI.

claimward-vpn-app-osx

macOS app: Go tray + Svelte webview UI + privileged WireGuard helper.