Pomerium
Pomerium is an open-source identity-aware reverse proxy that enforces authentication and per-route authorisation before any request reaches a backend service. Traffic flows through Pomerium, which validates the user's identity against an external identity provider (Google, GitHub, Okta, Azure AD, and others) and evaluates a per-route policy before proxying or denying the request. It is written in Go, licensed under Apache 2.0, and deployable via Docker Compose. The project has approximately 4,000 GitHub stars and is actively maintained.
Each route carries its own policy (allow/deny by email address, group membership, or IdP claim), making it a zero-trust access model: network location grants no implicit trust, and every route is independently secured.
Placed in Tools / Assess / inner.
Pomerium solves a persistent self-hosting problem: most self-hosted applications either have no authentication, rely on HTTP Basic Auth, or require VPN access for external reach. Pomerium provides a universal authentication layer in front of any HTTP service — including services that have no auth of their own — without requiring a VPN client on the user's device.
Compared to Cloudflare Tunnels (which outsources the proxy to Cloudflare's edge), Pomerium is fully self-hosted, open-source, and more granular on per-route policy. The tradeoff is operational overhead — Pomerium requires a running container and an IdP configuration, whereas Cloudflare Tunnels requires only a Cloudflare account. For homelab or private infrastructure where Cloudflare is not acceptable as an intermediary, Pomerium is the stronger choice.
The Synology use case (fronting DSM and Docker-hosted services) illustrates the broader pattern: Pomerium as a universal authentication perimeter over a portfolio of self-hosted services that individually lack robust auth. This is directly applicable to any homelab or private cloud deployment with more than a few exposed services.
Inner position reflects a clear Docker Compose trial path, direct complementarity with the Docker Security Hardening and Self-Hosted Application Security Review blips already on this radar, and direct applicability to any self-hosted stack needing external access without VPN.
Trial gate: Pomerium deployed fronting at least two self-hosted services with per-route IdP policies enforced and verified for at least one deny case.
