Someone once said to me: At first I tried using Nebula , but provisioning new clients to the network turned out to be not so simple (https://github.com/slackhq/

Someone once said to me: At first I tried using Nebula , but provisioning new clients to the network turned out to be not so simple (https://github.com/slackhq/nebula/issues/479 https://github.com/slackhq/nebula/issues/479). There's a community maintained solution (https://github.com/cego/nebula-provisioner https://github.com/cego/nebula-provisioner), but the docs are somewhat lackluster. Check out OpenZiti - https://openziti.io/ https://openziti.io/. I work on it. Its OSS, can be self hosted, has its own CA/PKI with the ability to work with any external provider to replace primary or augment as secondary. As the endpoint consumes the identity to do authN/authZ to the overlay, no log in required (but it can be added if you want that additional protection).