immudb is an immutable, cryptographically verifiable database system designed for tamper-evident storage. It provides ACID transactions with cryptographic verification via Merkle trees, ensuring data integrity and historical auditability. The system supports multiple data models: key-value, SQL (with PostgreSQL wire protocol compatibility), and document storage. Architecture follows a modular client-server design with separate binaries for server (immudb), admin CLI (immuadmin), client CLI (immuclient), and test tool (immutest). Key entry points include cmd/immudb/immudb.go (server), cmd/immuadmin/immuadmin.go (admin), and cmd/immuclient/immuclient.go (client). Data flows involve clients sending requests via gRPC or PostgreSQL wire protocol to the server, which processes transactions, appends to an immutable log, updates verification structures, and returns verifiable responses. External dependencies include Go modules for gRPC, protobuf, Viper, cryptographic libraries, and optional S3/MinIO for remote storage. The codebase demonstrates strong engineering practices with clear separation of concerns, extensive testing, and active maintenance.
Ockam is a framework for building secure, interconnected systems that provides identity-based end-to-end encrypted communication, secure channel establishment, and policy-based access control. The architecture features clear separation of concerns with modules for core types, identity management, secure channels, transport abstractions, vault cryptography, API orchestration, and a command-line interface. Implemented primarily in Rust with Elixir components, it uses async/await and OTP patterns for concurrency. Key entry points include the ockam CLI, node builder/context, and orchestrator API. The system enables secure multi-hop routing, message forwarding, and service integration with external systems like Kafka and InfluxDB.
Oblivion is a cross-platform VPN/tunneling application that provides secure internet access through Cloudflare Warp technology (unofficially) and supports Zero Trust authentication. The application uses a hybrid architecture with a Flutter frontend for the UI and a Rust core for tunnel logic, communicating via FFI on desktop and platform channels on mobile. It supports multiple tunneling protocols (MASQUE over QUIC/HTTP-3, WireGuard) and includes features like split tunneling, traffic obfuscation, and geo-location-based exit node selection. The codebase demonstrates strong engineering practices in platform abstraction, configuration management, and privilege separation, though build complexity and dependency management introduce maintenance challenges.
zrok is a production-grade, self-hostable secure resource sharing platform built on OpenZiti overlay networking. It enables users to share web services, files, TCP/UDP tunnels, and VPN connections through firewalls and NAT without requiring inbound connectivity. The system supports both public and private sharing modes, OAuth authentication (GitHub, Google, OIDC), and includes a full REST API (v2), a CLI tool (`zrok2`), a React web console, a background agent daemon with gRPC remote control, and SDKs in Go, Python, and Node.js. Architecturally, zrok follows a controller-agent pattern. The controller is a Go REST server that manages accounts, environments, shares, accesses, frontends, namespaces, organizations, and bandwidth limits. It uses SQLite3 or PostgreSQL for persistence with versioned migrations, and integrates with InfluxDB for usage metrics and RabbitMQ (AMQP) for dynamic proxy mapping updates. The agent runs as a background process on the user's machine, managing child processes for each share/access and exposing a gRPC API for remote management. Frontend proxies (public, dynamic, socks, Caddy) handle incoming traffic with OAuth, basic auth, and interstitial pages. Key entry points include the CLI commands under `cmd/zrok2/` (e.g., `share`, `access`, `enable`, `admin`), the controller REST handlers in `controller/`, the agent gRPC service in `agent/agentGrpc/`, and the SDK packages in `sdk/golang/sdk`, `sdk/python/src/zrok2`, and `sdk/nodejs/sdk`. The system also includes a canary testing framework for continuous health validation and a comprehensive metrics/limits engine for bandwidth enforcement. External dependencies include OpenZiti (overlay network), InfluxDB (metrics), RabbitMQ (messaging), Caddy (optional web server), and various OAuth providers. The project is actively maintained with frequent commits, automated CI/CD, and multi-platform release pipelines (Linux, macOS, Windows, Docker).
Pomerium is an identity-aware access proxy that provides zero-trust security for internal web applications and services. It acts as a reverse proxy that authenticates users via OIDC/OAuth2 providers, authorizes access based on policy rules (Pomerium Policy Language evaluated via OPA/Rego), and proxies HTTP, gRPC, WebSocket, and SSH traffic. The system is built as a multi-service architecture with gRPC-based inter-service communication, using Envoy as the underlying proxy engine. Key components include an authentication service, authorization service with policy evaluator, a distributed databroker for session/config storage (with Raft consensus), and a control plane that generates Envoy configuration dynamically. It supports multiple identity providers (Google, Okta, Azure, Auth0, etc.), mTLS client certificates, WebAuthn, and SSH tunneling with a TUI client. The codebase also includes a Model Context Protocol (MCP) implementation for AI tool access control, and a 'Zero' cloud-managed mode for enterprise deployments. External dependencies include Envoy, PostgreSQL, Pebble (RocksDB), and cloud blob storage (S3, GCS, Azure Blob). Architecturally, Pomerium follows a modular design with clear separation of concerns: configuration management (layered sources, validation, envoy config builders), policy engine (parser, generator, criteria matchers), storage abstraction (in-memory, file, postgres, blob with caching and querier patterns), telemetry (OpenTelemetry, Prometheus, health checks), and utility packages (cryptography, HTTP, gRPC, protobuf, retry, fanout). The system is highly configurable with runtime flags and supports hot-reload via config diffing. The codebase demonstrates strong engineering practices with extensive unit, integration, and end-to-end tests (Playwright-based acceptance suites). Data flows: Incoming requests are intercepted by Envoy, which forwards them to the Pomerium proxy service. The proxy authenticates the user via the authenticate service (OIDC/OAuth2 flows), then authorizes via the authorize service (policy evaluation with OPA/Rego). Session and user data are stored in the databroker (distributed key-value store with Raft replication). Configuration is managed centrally and distributed to all services via gRPC streams. Telemetry data (traces, metrics, logs) is exported via OpenTelemetry and Prometheus.
This repository is Microsoft's Agent Governance Toolkit, a production-grade multi-language framework (Python, TypeScript, Rust, Go, .NET) for enforcing policy, identity, trust, audit, and sandboxing on autonomous AI agents. In production, it intercepts agent tool calls, messages, and delegations before they reach external services, evaluating them against declarative policies (OPA, Cedar, or custom backends) with deterministic outcomes (allow/deny/escalate/transform). The system provides a full governance plane including a Rust-based policy engine (Agent Control Specification), a service mesh (AgentMesh) with API gateway, trust engine, policy server, and audit collector, a hypervisor for execution rings and sandboxing (Docker, Hyperlight, Nono), compliance verification (OWASP, EU AI Act), SLO monitoring, and a plugin marketplace. Integrations exist for LangChain, CrewAI, AutoGen, OpenAI Agents, Semantic Kernel, MCP, and many other frameworks. The toolkit is deployed as CLI tools (`agt`, `agentmesh`, `agentos`), Docker containers with sidecar patterns, Kubernetes charts, and VS Code/Chrome extensions. The architecture is polyglot with a shared policy engine core written in Rust; the Python SDK is the richest, with the .NET and Go SDKs covering governance middleware and lifecycle management. The codebase is heavily tested with 992 conformance tests across 10 formal specs, fuzzing targets, and CI gates enforcing deterministic policy outcomes, fail-closed behavior, and no-stub registration.
Firezone is a zero-trust network access platform providing secure remote access through VPN-like tunnels. The production system consists of a cloud-based management portal (Elixir/Phoenix), data-plane components (Rust gateways and relays), and native clients for macOS/iOS, Android, Windows, and Linux. The portal manages multi-tenant accounts, identity (OIDC, SAML, email OTP, X.509), access policies, device posture, and logs. It exposes a REST API (PortalAPI) for CRUD operations and WebSocket channels for real-time client/gateway connectivity. The Rust core (connlib) handles ICE/STUN/TURN connectivity, WireGuard tunnels, and eBPF-accelerated packet routing. PostgreSQL is used for persistence with logical replication for change data capture, Oban for background job processing, and Redis for caching/presence. External dependencies include identity providers (Entra, Okta, Google Workspace), device management systems (Intune, Defender, SentinelOne, etc.), log sinks (Splunk, Datadog, Elastic, S3), and billing (Stripe). The architecture separates the web admin interface (PortalWeb), REST API (PortalAPI), and internal ops (PortalOps) into distinct endpoints. Data-plane components (gateway, relay) communicate via WebSockets with the API to receive policy updates. Clients connect to relays using ICE/STUN/TURN. The system uses Phoenix PubSub for real-time updates and Postgres logical replication to propagate changes to connected clients and gateways. Key entry points: PortalWeb.Endpoint (admin UI), PortalAPI.Endpoint (REST/WebSocket for clients and gateways), PortalOps.Endpoint (ops dashboard). Rust binaries: firezone-gateway, firezone-relay, firezone-headless-client, firezone-gui-client. Mobile apps: Firezone iOS/macOS (Swift), Firezone Android (Kotlin).
ScaleTail is a curated collection of Docker Compose configurations for self-hosting 80+ services with a consistent Tailscale sidecar pattern. Each service directory contains a `compose.yaml` that defines a `tailscale` container (using `tailscale/tailscale:latest`) and an application container using `network_mode: service:tailscale`, enabling secure HTTPS access via Tailscale Serve or MagicDNS. The repository provides environment-driven configuration (`.env` files), health checks, and per-service READMEs. It is not a standalone application or library but a deployment template repository. The dominant character is 'application' as it facilitates deploying applications, though it is purely configuration and documentation. The pattern is highly reusable for any Docker-based self-hosted service wanting Tailscale integration.