Warpgate
A self-hosted, protocol-aware bastion host and reverse proxy for SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP, and VNC that needs no client software, with session recording and replay, native 2FA/SSO, and built-in brute-force protection.
Warpgate sits in a DMZ as a single point of entry for SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP, and VNC targets. Because it’s protocol-aware, users connect with their normal client — including a MySQL CLI or GUI — and Warpgate authenticates and routes the session without any agent or wrapper installed on either end.
Administrators manage users and targets through a built-in web admin UI, where every session can be recorded and later replayed. It ships with native two-factor authentication and OpenID Connect SSO, plus brute-force protection with automatic IP blocking and user lockout.
Warpgate is written in Rust, distributed as a single binary (with a Docker image also available), and released under the Apache-2.0 license.
Submitted by the community.
Community feedback
This space is for grounded, evaluable experience — versions used, environments, what you measured or observed, and how it behaves alongside other software. General impressions without supporting detail may be removed. Sign in to write one; posts are tied to a verified identity, not anonymous.