# BrowZer Multi-Service Support, NGINX Module Logging, and Multi-Tenant Design in OpenZiti

**URL:** <https://openziti.discourse.group/t/browzer-multi-service-support-nginx-module-logging-and-multi-tenant-design-in-openziti/5118>\
**Category:** BrowZer\
**Created:** [September 16, 2025, 11:01am UTC](https://openziti.discourse.group/t/browzer-multi-service-support-nginx-module-logging-and-multi-tenant-design-in-openziti/5118 "2025-09-16T11:01:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sherry-sun-webcomm](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sherry-sun-webcomm/32/3533_2.png) [@sherry-sun-webcomm](https://openziti.discourse.group/u/sherry-sun-webcomm)\
**Post date:** [September 16, 2025, 11:01am UTC](https://openziti.discourse.group/t/browzer-multi-service-support-nginx-module-logging-and-multi-tenant-design-in-openziti/5118/1 "2025-09-16T11:01:45Z")

</div>

Hi:

We are building a SaaS platform based on **OpenZiti BrowZer** to provide **agentless secure access** to internal web applications.  
Our requirements include:

- Hiding real network topology and service locations (network stealth)

- Fine-grained, identity-based access control (dynamic authorization)

- Multi-tenant isolation (logical first, physical optional)

- Unified connectivity across hybrid/multi-cloud environments

During testing, we observed some limitations and would like clarification and best-practice guidance from the OpenZiti team.

**Current versions tested:**

- `openziti v1.5.4`

- `ziti-browzer-bootstrapper 0.90.0`

### Questions

1. **targetArray Path Matching Behavior**

2. **Multiple Services on the Same VHost**

3. **BrowZer and Private Edge Routers**

4. **Multi-Tenant Isolation**

5. **Identity and Authorization (IdP / OIDC)**

6. **Roadmap and Future Enhancements**

### Expected Outcome / Clarification Needed

- Clarify whether **BrowZer’s path handling** is limited by design, and if support for sub-path/prefix routing is planned.

- Best practices for **multi-service mapping** : path vs. subdomain strategy.

- Recommended approach for **BrowZer with private edge routers** in multi-tenant deployments.

- Guidance on **multi-tenant isolation** setup: router design, service policies, resource allocation.

- Feasibility of **per-tenant IdP integration** in BrowZer.

- Insights on the **roadmap** for routing enhancements and multi-tenant management features.

**We’d greatly appreciate your clarification and guidance on the above questions. Thanks!**

---

<div class="post-metadata">

**Author:** ![smilindave26](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/smilindave26/32/185_2.png) [@smilindave26](https://openziti.discourse.group/u/smilindave26)\
**Post date:** [September 16, 2025, 12:02pm UTC](https://openziti.discourse.group/t/browzer-multi-service-support-nginx-module-logging-and-multi-tenant-design-in-openziti/5118/2 "2025-09-16T12:02:33Z")

</div>

Hi @sherry-sun-webcomm - Welcome to the community!

We haven’t been putting a ton of resources into BrowZer, but I know the main developer of it from NetFoundry watches this forum. We’ve instead been focusing our efforts on NetFoundry Frontdoor for this use case. You can see the preliminary docs here: [NetFoundry Docs Portal | NetFoundry Documentation](https://netfoundry.io/docs/frontdoor/intro)

---

<div class="post-metadata">

**Author:** ![PhilipGriffiths](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/philipgriffiths/32/341_2.png) [@PhilipGriffiths](https://openziti.discourse.group/u/PhilipGriffiths)\
**Post date:** [September 16, 2025, 3:30pm UTC](https://openziti.discourse.group/t/browzer-multi-service-support-nginx-module-logging-and-multi-tenant-design-in-openziti/5118/3 "2025-09-16T15:30:57Z")

</div>

Alongside Dave’s comment, I would mention that topics like multi-tenant isolation, per-tenant IdP integration, automated provisioning, etc, (and far more besides) are all things we already built into the NetFoundry platform (thus also covering NF Frontdoor). Building them is non-trivial, I would guestimate $300k-1M, depending how robust and scalable you want it, with a steady-state run-rate of $300-600k per year. I covered some of the differences between NetFoundry and OpenZiti in this blog - [Comparing NetFoundry and OpenZiti - NetFoundry](https://netfoundry.io/ziti-openziti/comparing-netfoundry-and-openziti/).

---

<div class="post-metadata">

**Author:** ![smilindave26](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/smilindave26/32/185_2.png) [@smilindave26](https://openziti.discourse.group/u/smilindave26)\
**Post date:** [September 16, 2025, 3:45pm UTC](https://openziti.discourse.group/t/browzer-multi-service-support-nginx-module-logging-and-multi-tenant-design-in-openziti/5118/4 "2025-09-16T15:45:36Z")

</div>

(I’ll also note that NetFoundry supports OEM/Whitelabling of NetFoundry Frontdoor, which might be closer to meeting your use case - let me know if you’d like somebody to reach out to you to discuss further)