Hey folks! 👋
I've been helping a small friend-of-a-friend startup (5 engineers, all remote) move off a janky old OpenVPN setup they were running on a Raspberry Pi 4. Their main goal was something more secure and modern with zero-trust principles, but they absolutely needed to keep it low-cost and low-overhead—no cloud subscription if possible, and minimal hardware footprint.
We evaluated a few ZTNA tools, and **Twingate** really stood out for this specific use case. Here's why it worked so well for them:
* **The Connector/Router model is perfect for on-prem hardware.** You run the "Connector" (lightweight Docker container) in your private network, and the "Router" (another container) can be on the same Pi. It handles all the auth and tunnels.
* **Resource usage is tiny.** Their setup uses maybe 2% CPU and 200MB RAM idle. Beats a full VPN server.
* **The admin console is cloud-based** (free for up to 5 users), but the data plane stays on their Pi. Best of both worlds: easy management without the data leaving their box.
* **Setup was under an hour.** The Docker Compose file is dead simple.
Here's the core of their `docker-compose.yml`:
```yaml
version: '3'
services:
twingate-router:
image: twingate/router
restart: unless-stopped
network_mode: host
environment:
- TWINGATE_ACCESS_TOKEN=${ACCESS_TOKEN}
- TWINGATE_REFRESH_TOKEN=${REFRESH_TOKEN}
- TWINGATE_NETWORK=${NETWORK_ID}
twingate-connector:
image: twingate/connector
restart: unless-stopped
network_mode: host
environment:
- TWINGATE_ACCESS_TOKEN=${ACCESS_TOKEN}
- TWINGATE_REFRESH_TOKEN=${REFRESH_TOKEN}
- TWINGATE_NETWORK=${NETWORK_ID}
```
They're now accessing their internal Grafana, Postgres, and a few dev services seamlessly. The engineers just installed the Twingate client on their laptops, and it "just works" with MFA.
Has anyone else run Twingate in a similar low-resource, self-hosted scenario? Curious about your experience with stability or how you handled logging (I hooked it up to a local Prometheus agent for metrics).
Dashboards or it didn't happen.