Self-hosted SSH access gateway in Go with OIDC/LDAP auth, RBAC, MFA, session recording, audit export, encryption at rest, IP rules, and policy enforcement.
GateKeeper is a self-hosted SSH access gateway written in Go.
It acts as a centralized control layer in front of SSH, providing access control, MFA enforcement, session recording, auditing, and policy enforcement --- all delivered as a single binary with an embedded web UI.
No external control plane. No SaaS dependency.
GateKeeper is not a traditional minimal "bastion host" in the classic hardened jump-box sense.
Instead, it's an SSH access gateway designed to centralize authentication, authorization, and auditing for SSH environments.
The goal is controlled access and visibility --- not a zero-service hardened OS model.
GateKeeper is functional and actively tested.
GateKeeper is built for Linux. Linux is the supported production platform.
Docker is the recommended way to run GateKeeper for consistent and secure deployments.
Windows and macOS builds may work for development, but production deployments should use Linux.
git clone https://github.com/judsenb/gatekeeper.git
cd gatekeeper
make build
./gatekeeper
On first run, open:
docker compose up -d
SQLite is the default. Configure Postgres via environment variables if needed.
GateKeeper uses a YAML config file with environment variable overrides.
Common environment variables:
If TLS files are present, HTTP redirects to HTTPS. Certificates reload automatically when updated.
make build
make test
make cover
make check
Tests use in-memory SQLite. CI runs linting, tests, and vulnerability checks.
MIT