Sign inSign up

onepam/gateway

By onepam

•Updated 5 months ago

OnePAM Zero Trust Access Gateway — proxy SSH, RDP, VNC, HTTP & DB sessions with recording

Image
Networking
Security
0

444

onepam/gateway repository overview

⁠OnePAM Gateway

Zero-trust access gateway for privileged infrastructure sessions.

The OnePAM Gateway sits inside your network and proxies privileged connections — SSH, RDP, VNC, HTTP, and databases — between the OnePAM control plane and your internal servers. Every session is recorded, logged, and policy-enforced without exposing credentials to end users.

⁠Quick Start

docker run -d --name onepam-gateway \
  --restart unless-stopped \
  -p 443:443 -p 51820:51820/udp \
  -v gateway_data:/app/data \
  --env-file gateway.env \
  onepam/gateway:latest

Or with Docker Compose:

services:
  gateway:
    image: onepam/gateway:latest
    restart: unless-stopped
    ports:
      - "443:443"
      - "51820:51820/udp"
    volumes:
      - gateway_data:/app/data
    env_file:
      - gateway.env

volumes:
  gateway_data:

⁠Features

FeatureDescription
SSH Proxyingxterm.js-based terminal with asciinema recording
RDP/VNCFull desktop session proxying via FreeRDP
HTTP ProxyingWeb session capture with HAR recording
Database AccessPostgreSQL, MySQL query logging and access control
Session RecordingEvery session recorded and uploaded to S3-compatible storage
WireGuard VPNOptional site-to-site VPN on UDP 51820
mTLSMutual TLS authentication for agent connections
TLS / ACMEAutomatic certificate provisioning via Let's Encrypt

⁠Configuration

Generate a default configuration file:

docker run --rm onepam/gateway:latest -generate-config > gateway.env

Key environment variables:

VariableDescriptionDefault
ONEPAM_API_URLOnePAM control plane URL(required)
GATEWAY_TOKENGateway registration token(required)
TLS_CERT_FILEPath to TLS certificate(auto ACME)
TLS_KEY_FILEPath to TLS private key(auto ACME)
DATA_DIRPersistent data directory/app/data
VPN_ENABLEDEnable WireGuard VPNfalse

⁠Ports

PortProtocolDescription
443TCPHTTPS — gateway API and session proxying
51820UDPWireGuard VPN tunnel (optional)

⁠Architecture

┌─────────────┐       ┌──────────────────┐       ┌──────────────┐
│  OnePAM     │◄─WSS─►│  OnePAM Gateway  │◄─────►│ Target       │
│  Console    │       │  (this image)    │  SSH   │ Servers      │
│             │       │                  │  RDP   │ Databases    │
└─────────────┘       │  ┌────────────┐  │  HTTP  │ Web Apps     │
                      │  │ WireGuard  │  │  DB    └──────────────┘
                      │  │ (optional) │  │
                      │  └────────────┘  │
                      └──────────────────┘

⁠Requirements

  • Docker 20.10+ or compatible runtime
  • Network access to the OnePAM control plane
  • Network access to target servers/databases

⁠Documentation

Full documentation: https://onepam.com/docs⁠

⁠License

Proprietary — https://onepam.com/terms⁠

Tag summary

Content type

Image

Digest

sha256:324212e36…

Size

110.9 MB

Last updated

5 months ago

docker pull onepam/gateway