wmantly
a917915037
Unifies the GitHub Pages docs site: the SSO/Proxy/Jump Host pages, their
nav labels, and each component's own README now consistently say Theta
Directory / Theta Proxy / Theta Gateway, drop marketing sections ("Why this
over the alternatives", "Get it", "Related projects") that don't apply to a
suite component, remove every standalone/bare-metal install path, and link
to theta42.github.io/theta-suite/... instead of the old per-repo Pages sites.
Bumps submodules: theta-directory v2.0.2, proxy v2.0.1, jump-host v2.0.1.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
3.8 KiB
layout, title, description
| layout | title | description |
|---|---|---|
| default | Home | Theta Gateway — an SSH jump host for theta-suite, giving directory-driven access to every downstream machine you're entitled to from one public host. |
Theta Gateway
The SSH jump host component of theta-suite. Users SSH into one public host and land on any downstream host they're entitled to — authenticated against the shared LDAP directory, authorized from Theta Directory's inventory graph, and audited end to end.
No per-host accounts, no distributing keys, no VPN. The same people who log in to Theta Directory are the people who can reach your machines — and only the machines their directory groups grant.
Theta Gateway is deployed as part of theta-suite, alongside Theta Directory and Theta Proxy — it isn't installed or run on its own. See the Quickstart to stand up the whole stack with one command.
Screenshots
(click any screenshot to view full size)
Two ways to connect
Direct (WinSCP/SFTP-friendly):
ssh alice_-_web01@jump.example.com
sftp -P 2222 alice_-_web01@jump.example.com
The username grammar is {uid}_-_{target} — target is a directory host slug
(with or without the host_ prefix), a bare hostname, or an IP. One username
string, no interactive step, so it works cleanly in WinSCP and scripts.
Interactive picker:
ssh alice@jump.example.com
A plain login shows a TUI list of the hosts you can reach; arrow-key or type to filter, Enter to connect.
See Connecting for the full usage guide.
Why a jump host (and why this one)
A bastion/jump host is the standard way to give SSH access to internal machines through a single audited entry point. What's usually painful is authorization and credentials: who may reach which host, and how the bastion authenticates onward without you copying keys everywhere.
Theta Gateway answers both from your directory:
- Authorization is your directory graph. The hosts you can reach are the
union of your LDAP groups × Theta Directory's inventory (the
host_<name>_accessgroups the directory already auto-creates). Add someone to a group; they can reach the host. No bastion-side allow-list to maintain. - Onward auth is automatic. Theta Gateway holds one key and injects its
public half into your
sshPublicKeyon first use, then connects downstream as you. Downstream hosts already serve keys from LDAP (via ldap-client'sAuthorizedKeysCommand), so nothing downstream needs configuring.
Features
- Username-grammar routing (
uid_-_target) — straight-through to the host, SFTP included (WinSCP works) - Interactive TUI host picker on plain login, scoped to your access
- LDAP inbound auth — public key or password (keys-only policy recommended for a public host)
- Directory-driven access — reachable hosts come from the Theta Directory inventory, not a static list
- Per-user key injection — no downstream changes, no key distribution
- Shell, exec, and SFTP bridging
- WireGuard mesh routing — cross-site network access alongside SSH
- Web UI + HTTP API for auditing and metrics — active sessions, a searchable audit log, per-user/per-host counters
- Full audit trail — who, target, method, result, bytes, duration, and the downstream host-key fingerprint