Demo mode — sign in with demo / demo · Read-only, resets hourly · GitHub
Servers
No servers match .
No servers yet.

Favourites

Star a server in the list to pin it here.

Recent

Servers you open will show up here.
Ctrl P jump to any server  ·  Ctrl K quick connect
No active sessions
Uploading...
Backup & restore

Downloads servers, users, groups, webhooks and API keys as one file. Jump-host routes are stored by name, so they survive the move to another instance.

With a passphrase the file is encrypted and carries SSH passwords and private keys, re-encrypted on the target with its own key. Leave it empty for a metadata-only backup — you would then re-enter every credential by hand.
Session recordings are files on disk and are never included — copy them separately.
No passphrase: credentials will be left out of this backup.

Restores from a backup file. Existing users are never deleted, and anything whose name already exists here is skipped.

Replace removes every server, webhook and API key on this instance before restoring. Users are kept.
Settings

These take effect without a restart, and apply to every instance of this gateway. A value set here overrides the matching environment variable.

This deployment sets WEBGATE_CONFIG_LOCKED. Settings are shown but cannot be changed here — change them where the deployment is defined.
Set by the deployment, not here

These are read before webgate can serve a request, or would let the panel lock itself out. Change them where the deployment is defined.

Branding

Make this gateway look like your company. Everything here is stored on the server, so every user sees it on their next load — no per-machine setup.

An emoji, or upload an icon below.
Two colours, because one accent rarely reads well on both a light and a dark ground. Everything else keeps the shipped design.
PNG, JPEG, WebP, SVG, GIF or ICO, up to 1 MB each.
AI agent

Lets operators ask an agent to investigate a host. It runs a fixed list of read-only commands over their own SSH access and summarises what it finds. Each server must also opt in separately.

Leave blank for the default. Point it anywhere reachable from the gateway.
Operators can pick a different one per investigation.
One round may run several tools at once, so the command count can exceed this.
These values came from environment variables. Saving here stores them in the database instead, and from then on this panel is the source of truth.
Download
Download as ZIP
View/Edit
Rename
Delete
Host key
Recorded the first time this server was reached. A connection is refused if the key changes, so clear it only when you know why it changed — a rebuild, a rotation — and confirm the new one out of band.
Nothing pinned yet. The next connection records the key this server presents, and every connection after that is checked against it.
The AI agent is not set up on this gateway. Configure it in Admin → AI agent to allow diagnosis on this server.
Lets an operator ask the agent to investigate this host. It runs a fixed set of read-only commands and sends their output to the configured model. Off by default.
Choose a new password

You are using the default password. Please set a new password to continue.

User Management
Username Role Allowed Groups 2FA Actions
Add User
Audit log
Time User Action Detail IP

Nothing matches that filter. Nothing recorded yet.

API Keys
Save this key — it won't be shown again
Name Key Prefix Last Used Created
Generate New Key
Webhooks
Name URL Events Last
Add Webhook
Session recordings
Server User Started Duration Size

User will only see servers in these groups. Leave empty to deny all access.

Available groups:
Two-Factor Authentication
2FA is enabled
Your account is protected with two-factor authentication.
2FA is not enabled
Add an extra layer of security to your account.
Scan this QR code with your authenticator app (Google Authenticator, Authy, etc.)
2FA Enabled Successfully
Your account is now protected with two-factor authentication.