Warpgate

Warpgate is a self-hosted bastion host and privileged access manager that sits in front of your internal infrastructure and controls who can reach what. It handles SSH, HTTPS, RDP, VNC, Kubernetes, PostgreSQL, and MySQL targets through a single access point, with no proprietary client software required. Your users connect with their existing tools or a browser terminal, and Warpgate handles authentication before transparently handing the connection off to the target.

It's a practical alternative to a VPN, a jump host, or commercial PAM products like Teleport or StrongDM. The key difference: every feature ships in the free build, licensed under Apache-2.0 with no edition tiers.

What Warpgate manages for you:

• Authentication: Built-in TOTP, OIDC SSO, SSH key support, and LDAP key sync. Brute-force protection and just-in-time session approvals are included.
• Access control: Role-based access assigned per resource, not per network segment. Manage access in the admin UI or through the API for larger installations.
• Session recording: SSH, Kubernetes interactive streams, RDP, and VNC sessions are recorded and replayable in the admin UI. Database targets capture query logs.
• Protocol-native listeners: Warpgate exposes real protocol endpoints, so you can point a DATABASE_URL at it, connect VSCode over SSH through it, or open an RDP desktop with a native client.
• No authorized_keys sprawl: Add a target once, assign it to user groups, and Warpgate handles credential management from there.

Deployment is a single binary or Docker image that runs entirely on your own infrastructure. For larger setups, you can run multiple nodes behind a load balancer, share state through a database, and store recordings in S3-compatible object storage. Target credentials are encrypted at rest.

Users get a web interface with copy-paste connection strings, so you're not repeatedly explaining how to connect. That browser interface also includes a terminal for SSH and desktop access for RDP and VNC sessions, covering the cases where someone doesn't have a native client handy.

Compared to a JumpServer or a traditional SSH bastion, Warpgate adds protocol-aware audit logging, SSO integration, and multi-protocol support without requiring you to assemble those pieces separately. Compared to commercial alternatives, it skips the SaaS control plane and the client app requirement entirely.