Files

T

wmantly ace7b441c2 docs(site): publish multi-site + gateway mesh to the actual docs website

Everything shipped this pass (live replication, master/spoke join,
gateway-to-gateway WireGuard mesh) had real spec docs in the repo
(docs/MULTI_SITE_SPEC.md, sso-manager-node's docs/site-join.md) but
nothing on the actual published docs site (theta42.github.io/theta-suite/)
-- a reader landing there would find no mention of it at all beyond a
vague, unlinked "multi-site replication" bullet on the homepage.

- New docs/sso/multi-site.md: the operator-facing master/spoke join guide
  (why, how, promoting a spoke, what replicates, current limits), with an
  explicit section distinguishing it from the pre-existing N-way LDAP MMR
  replication page (replication.html) -- two different mechanisms that
  were at real risk of being conflated with nothing to tell them apart.
- New docs/jump-host/mesh.md: the gateway-to-gateway WireGuard mesh guide,
  linked from a "WireGuard mesh routing" bullet that already existed on
  the jump-host homepage but pointed nowhere.
- docs/sso/index.md, docs/jump-host/index.md: link the new pages from
  each component's Features list.
- docs/index.md: replaced the oversold, unlinked "multi-site replication
  running in seconds" homepage copy with an accurate, linked claim.

2026-08-10 19:54:25 -04:00

3.8 KiB

Raw Permalink Blame History

layout, title, description

layout	title	description
default	Home	Theta Gateway — an SSH jump host for theta-suite, giving directory-driven access to every downstream machine you're entitled to from one public host.

Theta Gateway

The SSH jump host component of theta-suite. Users SSH into one public host and land on any downstream host they're entitled to — authenticated against the shared LDAP directory, authorized from Theta Directory's inventory graph, and audited end to end.

No per-host accounts, no distributing keys, no VPN. The same people who log in to Theta Directory are the people who can reach your machines — and only the machines their directory groups grant.

Theta Gateway is deployed as part of theta-suite, alongside Theta Directory and Theta Proxy — it isn't installed or run on its own. See the Quickstart to stand up the whole stack with one command.

Screenshots

(click any screenshot to view full size)

Two ways to connect

Direct (WinSCP/SFTP-friendly):

ssh alice_-_web01@jump.example.com
sftp -P 2222 alice_-_web01@jump.example.com

The username grammar is {uid}_-_{target} — target is a directory host slug (with or without the host_ prefix), a bare hostname, or an IP. One username string, no interactive step, so it works cleanly in WinSCP and scripts.

Interactive picker:

ssh alice@jump.example.com

A plain login shows a TUI list of the hosts you can reach; arrow-key or type to filter, Enter to connect.

See Connecting for the full usage guide.

Why a jump host (and why this one)

A bastion/jump host is the standard way to give SSH access to internal machines through a single audited entry point. What's usually painful is authorization and credentials: who may reach which host, and how the bastion authenticates onward without you copying keys everywhere.

Theta Gateway answers both from your directory:

Authorization is your directory graph. The hosts you can reach are the union of your LDAP groups × Theta Directory's inventory (the host_<name>_access groups the directory already auto-creates). Add someone to a group; they can reach the host. No bastion-side allow-list to maintain.
Onward auth is automatic. Theta Gateway holds one key and injects its public half into your sshPublicKey on first use, then connects downstream as you. Downstream hosts already serve keys from LDAP (via ldap-client's AuthorizedKeysCommand), so nothing downstream needs configuring.

Features

Username-grammar routing (uid_-_target) — straight-through to the host, SFTP included (WinSCP works)
Interactive TUI host picker on plain login, scoped to your access
LDAP inbound auth — public key or password (keys-only policy recommended for a public host)
Directory-driven access — reachable hosts come from the Theta Directory inventory, not a static list
Per-user key injection — no downstream changes, no key distribution
Shell, exec, and SFTP bridging
WireGuard mesh routing — cross-site network access alongside SSH
Web UI + HTTP API for auditing and metrics — active sessions, a searchable audit log, per-user/per-host counters
Full audit trail — who, target, method, result, bytes, duration, and the downstream host-key fingerprint

3.8 KiB Raw Permalink Blame History Unescape Escape