warp-tech/warpgateFully transparent SSH, HTTPS, Kubernetes, database and RDP/VNC bastion/PAM that doesn't need additional client-side software
Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper.
Supported by:
Full documentation is available at warpgate.null.page, including:
|
|
|
Please use GitHub's vulnerability reporting system.
Warpgate is being actively used in enterprise settings.
What's planned and being worked on next is tracked on the public roadmap.
Warpgate is a service that you deploy on the bastion/DMZ host, which will accept SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC connections and provide an (optional) web admin UI.
Run warpgate setup to interactively generate a config file, including port bindings. See Getting started for details.
It receives connections with specifically formatted credentials, authenticates the user locally, connects to the target itself, and then connects both parties together while (optionally) recording the session.
When connecting through HTTPS, Warpgate presents a selection of available targets, and will then proxy all traffic in a session to the selected target. You can switch between targets at any time.
You manage the target and user lists and assign them to each other through the admin UI, and the session history is stored in an SQLite database (default: in /var/lib/warpgate).
You can also use the admin web interface to view the live session list, review session recordings, logs and more.
In late 2025, this project had started accepting AI-assisted contributions. Contributors are required to disclose AI use. I believe that by applying the same high quality standard to all PRs, whether AI-assisted or not, no sacrifice in quality or security needs to be made.
Since AI is a spectrum between braindead vibe bros and autocomplete users, I believe that being transparent about its use helps establish and limit the place of AI in this project.
Architectural and security decisions on this project are 100% human.
cargo install justjust npm installjust npm run buildcargo build (optionally --release)The binary is in target/{debug|release}.
poem-websea-orm + sqlxrusshjust openapi-all.Thanks goes to these wonderful people (emoji key):
This project follows the all-contributors specification. Contributions of any kind welcome!
| Warpgate | SSH jump host | VPN | Teleport |
|---|
| ✅ Precise 1:1 assignment between users and services | (Usually) full access to the network behind the jump host | (Usually) full access to the network | ✅ Precise 1:1 assignment between users and services |
| ✅ No custom client needed | Jump host config needed | ✅ No custom client needed | Custom client required |
| ✅ 2FA out of the box | 🟡 2FA possible with additional PAM plugins | 🟡 Depends on the provider | ✅ 2FA out of the box |
| ✅ SSO out of the box | 🟡 SSO possible with additional PAM plugins | 🟡 Depends on the provider | Paid |
| ✅ Command-level audit | 🟡 Connection-level audit on the jump host, no secure audit on the target if root access is given | No secure audit on the target if root access is given | ✅ Command-level audit |
| ✅ Full session recording | No secure recording possible on the target if root access is given | No secure recording possible on the target if root access is given | ✅ Full session recording |
| ✅ Non-interactive connections | 🟡 Non-interactive connections are possible if the clients supports jump hosts natively | ✅ Non-interactive connections | Non-interactive connections require using an SSH client wrapper or running a tunnel |
| ✅ Self-hosted, you own the data | ✅ Self-hosted, you own the data | 🟡 Depends on the provider | SaaS |
| ✅ Built-in brute-force protection | 🟡 Requires fail2ban setup | 🟡 Depends on the provider | ✅ Built-in brute-force protection |
 Hariharan 💻 |
 kamilkrzeminski 💻 |
 Lars 💻 |
 Hugues Granger 💻 |
