Compute basis
One M workload for identity service and password manager. Managed NetBird runs alongside with its own scope.
Zero-trust VPN and password manager with shared sign-in
Access to networks and passwords with one identity: managed NetBird for network access, Vaultwarden for team passwords and your identity service for sign-in.
- Managed NetBird and Vaultwarden
- Keycloak or Authentik included
- Recovery path is planned
Starting point
What organisations build secure access for
Remote access and passwords are the two places where teams most often share credentials. The package puts both under one sign-in.
Access through groups
Devices and people gain access through groups and routes instead of shared credentials.
Manage passwords as a team
Each person gets their own vault; shared credentials sit in collections and are released selectively.
Recovery path
Access to the identity service should remain available without the VPN that depends on it.
How it fits together
NetBird, Vaultwarden and sign-in working together
NetBird
Zero-trust networking on WireGuard; sign-in through OIDC.
Vaultwarden
Password manager for teams; sign-in through OIDC.
Keycloak or Authentik
Included in the package price. Protocols and roles are defined per application.
Extensions and scope limits
The recovery path to the identity service does not sit solely behind the VPN that depends on it. A conformity statement for zero trust or NIS2 is not part of the package.
Operations
How your secure access package is operated
Core apps, monitoring and updates within the agreed scope.
Restore order
Planned restore order: identity service with keys, Vaultwarden data, NetBird configuration; then check device enrolment and access without an existing VPN connection.
Checks before release
Check version compatibility of identity service, NetBird and Vaultwarden; verify groups, routes and sign-in before approval.
Offer
What does zero-trust VPN with a password manager cost?
The price includes Vaultwarden on one M workload. Keycloak or Authentik comes with the package at no extra charge. Managed NetBird is a separate offer and is added at its registry price.
Essential, Compute Mfrom €509.70 net per monthEstimate before setup. Scope and topology of Managed NetBird are defined in the proposal.
Calculation
- Workload, one app included
- €129.90 net per month
- Compute M
- €29.90 net per month
- Keycloak or Authentik
- included in the package
- Managed NetBird
- €349.90 net per month
- Service level: Essential
- included in price
- Total with Business
- €709.50 net per month
Straightforward provisioning within a few business days
Payment
- Bank transfer
One-time setup based on scope, specified in the proposal. Additional storage is booked in 50 GB steps: €4.99 net per month. Assess Business for the access path. The service level for NetBird is priced separately; the published ladder applies.
Selection
One identity for VPN and passwords: Keycloak or Authentik
Keycloak or Authentik is included in the package price. You choose the identity service that fits your organisation.
| Choice | Scope | Configurator entry |
|---|---|---|
| Keycloak | OIDC/SAML, brokering and LDAP/AD federation. Realm and client configuration are operating tasks. | Configure package: Keycloak |
| Authentik | OIDC/SAML, sources, flows and LDAP/proxy providers. Account for outposts per integration. | Configure package: Authentik |
Selection
Which size fits your devices and sites?
Single-app hosting operates one application. The package adds further apps and shared identity planning; integrations are scoped in the proposal.
| Compute | Resources from registry | Essential, net per month |
|---|---|---|
| S | 2 vCPU · 4 GB RAM · 80 GB NVMe SSD | €479.80 net per month |
| M | 4 vCPU · 8 GB RAM · 80 GB NVMe SSD | €509.70 net per month |
| L | 8 vCPU · 16 GB RAM · 80 GB NVMe SSD | €569.70 net per month |
- M is the starting size. WZ-IT checks which size your use needs before the proposal, based on devices, sites and relay traffic. Users are not limited; XL can be selected in the configurator.
Licences and editions
Licences and editions: NetBird, Vaultwarden, sign-in
As of 25 October 2026. Free cores form the pricing basis. Commercial editions and vendor services are separate.
| Licence | Function and boundary |
|---|---|
| NetBird (BSD-3-Clause, AGPL-3.0) | Client under BSD-3-Clause; management, signal, relay and dashboard under AGPL-3.0. OIDC SSO without user limit with documented Keycloak and Authentik; high availability and SCIM belong to the Commercial License. Licence file · Feature documentation · Edition boundary |
| Vaultwarden (AGPL-3.0) | OIDC sign-in from version 1.35.0 with documented Keycloak and Authentik; the master password stays mandatory. SAML and native LDAP are missing. Unofficial server, not affiliated with Bitwarden. Licence file · Feature documentation · Edition boundary |
| Keycloak (Apache-2.0) | OIDC, SAML and identity brokering in the free core. Licence file · Feature documentation |
| Authentik (MIT) | MIT core with OIDC, SAML, LDAP and proxy providers. Enterprise features have a separate licence and are not included. Licence file · Feature documentation · Edition boundary |
Questions about zero-trust VPN and password manager
Answers to the most important questions
- Workload, compute, additional apps, storage and service level are summed from the registry. Keycloak or Authentik is included in the package price. One-time setup is based on scope and defined in the proposal; commercial licences are separate.
- Yes. The two entry links select exactly one identity service in the configurator. An existing customer identity provider can be connected after technical review. Sign-in, roles, blocking and emergency access are reviewed together before approval.
- Managed NetBird remains a separate offer at its own registry price. The package adds it to the base of identity service and password manager. Scope and service level of NetBird are defined in the proposal.
- If the identity service is reachable only through the VPN it signs in, repair access is missing during an outage. Administrative access is therefore planned separately.
- Backup scope and retention are specified in the proposal using the registry components and your requirements. The recovery order shown describes the planning for this package.
- Original files, databases, configuration and customer-owned exportable keys are recorded in the exit scope. Export formats and handover are specified per app. See the data portability framework.
- Operations in data centres in Germany, Switzerland or Austria. A confidentiality agreement under Section 203 German Criminal Code (StGB) is available on request at the German location. A subdomain under wz-it.cloud and one .de domain are included; your own domain can be connected by CNAME. Monthly cancellation with 30 days notice to month-end, no minimum term. WZ-IT sets no user limit; size depends on Compute S to XL and edition limits.
Knowledge
Secure access in detail
Applications
Operations and handover
Related articles
- Deploying NetBird via MDM: Intune, Jamf and GPO with Managed PoliciesSince summer 2026, NetBird can be managed through your existing MDM like any other business software. With client version 0.73.0 from 18 June 2026, NetBird...
- Replacing Your VPN: From Classic VPN to Zero Trust and Mesh VPNThe classic corporate VPN comes from a time when staff, servers and applications sat in one shared network. A gateway at the network edge checks...
Reviews & projects
Managed open source with consulting and operations
Customer feedback on open-source selection, implementation, maintenance and long-term operations.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
Secure access and identity
Configure Secure access and identity and request an offer
Choose the identity service and add requirements in the configurator. WZ-IT specifies setup, sizing and operating scope in the proposal.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.