Cardea
SSH bastion server with access control, session recording, and optional TPM-backed key protection.
At a glance
- GitHub stars
- 37
- Last activity
- 2026-11-02
- Latest release
- v1.9.3
2026-11-02 - Commits (12 mo)
- 225
- License
- EUPL-1.2
- Language / platform
- Go, Docker
Maintenance health: Actively maintained — Commits in the last 3 months.
Run Cardea yourself
- RAM: ~512 MB server (1 vCPU)
- Docker: yes — image
hectorm/cardeaon Docker Hub (82.8k pulls)
Estimated monthly server cost
| Provider | Plan size | ~ USD / month | |
|---|---|---|---|
| Vultr | 512 MB | $3.5 | Deploy → |
| DigitalOcean | 512 MB | $4 | Deploy → |
| Akamai (Linode) | 1 GB | $5 | Deploy → |
Rough estimate from the app's stack and category, not a benchmark. Several light apps can share one server. Some hosting links may be affiliate links. We may earn a commission at no extra cost to you; it never affects which apps we list.
Cardea is an alternative to
Similar self-hosted apps
Puter
Web-based operating system designed to be feature-rich, exceptionally fast, and highly extensible.
Pangolin
Identity-aware tunneled reverse proxy with dashboard UI, access control, and WireGuard-based tunnels (alternative to Cloudflare Tunnel, Tailscale).
Termix
Clientless web-based server management platform with SSH terminal, tunneling, and file editing capabilities.
Firezone
Secure remote access gateway that supports the WireGuard protocol. It offers a Web GUI, 1-line install script, multi-factor auth (MFA), and SSO.
Warpgate
Fully transparent SSH, HTTPS, Kubernetes, MySQL and Postgres bastion/PAM that doesn't need additional client-side software.
MeshCentral
Run your own web server to remotely manage and control computers on a local network or anywhere on the internet.
Is this your project? Get it featured or send a correction upstream to awesome-selfhosted-data.