feat: initial jump-host — SSH jump host for the theta42 stack

An SSH jump host that authenticates users against the shared LDAP directory, authorizes them from the SSO Manager's inventory graph, and bridges them to downstream hosts — auditing everything. - Username-grammar routing (uid_-_target@jump) + interactive TUI picker - Inbound LDAP auth (publickey / password with off|local|all policy) - Directory-driven access (LDAP groups x /api/discovery/resources?group=) - Per-user key injection into sshPublicKey, connects downstream as the user - Shell / exec / SFTP-subsystem bridging (WinSCP works) - Web UI + HTTP API (:3002) for audit + metrics; LDAP-admin gated - Packaged like proxy: ops/install.sh + systemd, all-in-one Docker, compose - Tests: 23 unit + 3 integration (node --test), all green Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-23 15:46:19 -04:00
commit 36e9d5b0b3
51 changed files with 4291 additions and 0 deletions
@@ -0,0 +1,21 @@
+<!doctype html>
+<html lang="en">
+<head>
+	<meta charset="utf-8">
+	<meta name="viewport" content="width=device-width, initial-scale=1">
+	<title><%= name %> — Jump Host</title>
+	<link rel="stylesheet" href="/public/css/app.css">
+</head>
+<body>
+<nav class="nav">
+	<span class="brand"><%= name %> <small>jump host</small></span>
+	<% if (typeof user !== 'undefined' && user) { %>
+	<span class="spacer"></span>
+	<a href="/">Dashboard</a>
+	<a href="/sessions">Sessions</a>
+	<a href="/audit">Audit</a>
+	<span class="who"><%= user.uid %></span>
+	<form method="post" action="/logout" class="inline"><button class="link">logout</button></form>
+	<% } %>
+</nav>
+<main class="wrap">