warpgate

     

---

Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper.

• Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network.
• Warpgate will record every session for you to view (live) and replay later through a built-in admin web UI.
• Browser-based SSH, RDP and VNC access is built in; native clients continue to work.
• Not a jump host - forwards connection straight to the target in a way that's fully transparent to the client.
• Native 2FA and SSO support (TOTP & OpenID Connect)
• Built-in brute-force protection with IP blocking and user lockout
• Single binary with no dependencies.
• Written in 100% safe Rust.

Supported by:

Getting started & downloads

• See the Getting started docs page (or Getting started on Docker).
• Release / beta binaries
• Nightly builds

Documentation

Full documentation is available at warpgate.null.page, including:

• Login Protection - Configure brute-force protection
• SSO - Single Sign-On with OpenID Connect
• Tickets - Temporary access credentials

How is Warpgate different from a jump host / VPN / Teleport?

Reporting security issues

Please use GitHub's vulnerability reporting system.

Project Status

Warpgate is being actively used in enterprise settings.

What's planned and being worked on next is tracked on the public roadmap.

How it works

Warpgate is a service that you deploy on the bastion/DMZ host, which will accept SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC connections and provide an (optional) web admin UI.

Run warpgate setup to interactively generate a config file, including port bindings. See Getting started for details.

It receives connections with specifically formatted credentials, authenticates the user locally, connects to the target itself, and then connects both parties together while (optionally) recording the session.

When connecting through HTTPS, Warpgate presents a selection of available targets, and will then proxy all traffic in a session to the selected target. You can switch between targets at any time.

You manage the target and user lists and assign them to each other through the admin UI, and the session history is stored in an SQLite database (default: in /var/lib/warpgate).

You can also use the admin web interface to view the live session list, review session recordings, logs and more.

AI transparency disclosure

In late 2025, this project had started accepting AI-assisted contributions. Contributors are required to disclose AI use. I believe that by applying the same high quality standard to all PRs, whether AI-assisted or not, no sacrifice in quality or security needs to be made.

Since AI is a spectrum between braindead vibe bros and autocomplete users, I believe that being transparent about its use helps establish and limit the place of AI in this project.

Architectural and security decisions on this project are 100% human.

Contributing / building from source

• You'll need Rust, NodeJS and NPM
• Clone the repo
• Just is used to run tasks - install it: cargo install just
• Install the admin UI deps: just npm install
• Build the frontend: just npm run build
• Build Warpgate: cargo build (optionally --release)

The binary is in target/{debug|release}.

Tech stack

• Rust 🦀
  • HTTP: poem-web
  • Database: SQLite via sea-orm + sqlx
  • SSH: russh
• Typescript
  • Svelte 5
  • Bootstrap

Backend API

• Warpgate admin and user facing APIs use autogenerated OpenAPI schemas and SDKs. To update the SDKs after changing the query/response structures, run just openapi-all.

Contributors ✨

Thanks goes to these wonderful people (emoji key):

This project follows the all-contributors specification. Contributions of any kind welcome!