Bastion LogoBastion
Quick install

One gateway.
Every server you manage.

From a production fleet to a rack of Raspberry Pis - Bastion gives you secure terminal access from any browser, with nothing to install and no key to lose.

Quick install Read docs
Self-Hosted
Private Infra
Drag & Drop
File Transfers
Asciicast v2
Session Audit
BrowserBastion Proxy Server Fleet
$|

Experience the Workspace.

Interact with the actual Bastion UI below. Select a server and drop into a live-mock terminal environment directly from your browser.

Servers

Manage your organization's servers and access

ActionsNameHostUserOSStatus
prod-db-primary		10.0.1.45postgresUbuntu UbuntuConnected
api-gateway-01		10.0.2.12deployDebian DebianConnected
cache-redis-cluster		10.0.3.88redisCentOS CentOSOffline
staging-worker-queue		10.0.4.15ubuntuUbuntu UbuntuConnected
$|

Engineered for absolute workload isolation

ROOT / KERNEL LEVELIsolated User Space (UID 1000)

Unprivileged Execution

Operates entirely as a non-root process. Enforces a strict least-privilege model by default.

$|

Get started with Bastion.

Use the official installation script to deploy securely in minutes via Docker Compose.

Step 1

Install

Pull the published images and scaffold the deployment directory. Uses the official installation script.

# Linux & MacOS (bash/zsh):
curl -fsSL https://bastion.skpy.in/install.sh | sh
# Windows (PowerShell):
irm https://bastion.skpy.in/install.ps1 | iex
Step 2

Configure

Review .env. A secure random encryption key (64 hex characters) is generated automatically on first run.

cd bastion
# ENCRYPTION_KEY generated automatically
$EDITOR .env
Step 3

Launch

Bastion brings the PostgreSQL schema up to date and creates the bootstrap owner account.

docker compose up -d
# open http://127.0.0.1:18401
$|

Reachable only by the people you trust.

Bastion enforces a zero-trust perimeter by binding exclusively to 127.0.0.1. Access requires a private overlay network (e.g., Tailscale) terminating at an Nginx proxy. Buffering is explicitly disabled to allow massive file transfers to stream directly to the target host.

Overlay Network (100.xxx.xxx.110)TLS Proxy (:443)127.0.0.1:18401
/etc/nginx/sites-available/bastion
server {
listen 100.xxx.xxx.110:443 ssl;
server_name bastion.domain.com;
 
location / {
proxy_pass http://127.0.0.1:18401;
proxy_http_version 1.1;
 
# Preserve original client IP & protocol
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
 
# Required for terminal WebSocket streams
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
 
# Allow large direct file transfers
client_max_body_size 1000M;
client_body_timeout 3600s;
proxy_request_buffering off; # Bypass disk buffer
proxy_send_timeout 300s;
proxy_read_timeout 1800s;
}
}
$|

Everything routed through
one governed entry point.

Each of these capabilities ships as the default behavior out of the box, not as an add-on configured after the fact.

A real terminal that holds its place

Full xterm.js SSH access from any device, phone included, with a purpose-built mobile input layer. Close the tab, lock the phone, drop the WiFi, the session is exactly where it was on reconnect.

Nobody ever sees a credential

Server passwords and private keys stay encrypted and are never exposed to the people using them. Access goes to servers, not to secrets.

Every session, recorded and replayable

Terminal sessions are captured automatically in a compact, open format and replay frame-by-frame, file transfers marked directly on the timeline. No setup, no opt-in.

File transfer without leaving the terminal

Drag a file onto the terminal and it streams straight to the remote host, no disk buffering, no separate FTP client, no context switch. It shows up in the audit trail like everything else.

Workspaces and roles that mean something

One workspace per deployment, three roles. Owners and admins manage servers and users and can review anyone's session history; everyone else sees only what they've been given.

Revocation that's actually immediate

Pull someone's access and any terminal session they had open is severed on the spot, not next time they reconnect, not eventually.

$|

Built for modern infrastructure teams.

DevOps & Platform Engineering

Eliminate credential sprawl and unmanaged .pem files. Onboard engineers instantly with centralized RBAC, giving them browser-based access to the fleet without ever seeing a private key.

Security & Compliance Teams

Turn infrastructure access into an immutable audit trail. Every keystroke, terminal session, and file transfer is automatically recorded in asciicast v2 format for post-incident review.

Self-Hosters & Homelabs

An enterprise-grade access control layer packaged into an ~60MB footprint. Free, open-source under the MIT license, and deployed securely via Docker Compose in a single command.

$|

Engineered for low overhead.

~60 MB
Combined Idle Memory
Node.js 22+
Single Runtime
No ORM
Raw PostgreSQL
System Internals

Frontend & Terminal Stack

React & TypeScript

Strictly typed UI components

Vite

Fast HMR and optimized production builds

xterm.js

Hardware-accelerated terminal rendering

asciinema-player

Native playback of asciicast v2 audit files

Tailwind & shadcn/ui

Utility-first styling with accessible primitives

$|

Not a clean sweep. A lighter stack.

Bastion isn't the only self-hosted gateway. A couple of these alternatives are incredibly well-engineered and represent close calls, not a landslide. Here is the factual breakdown.

System Attribute
Bastion LogoBastion
Bastillion
Apache Guacamole
Warpgate
License
MITFree and unrestricted forever
ProsperityPaid for commercial use
Apache 2.0Free and unrestricted
Apache 2.0Free and unrestricted
Runtime Architecture
~60 MB IdleSingle Node.js backend
JVM / JettyFixed heap & GC overhead
3 Separate RuntimesC proxy, Java Tomcat, Database
LeanSingle compiled Rust binary
Setup Complexity
Single Commanddocker compose up -d
Manual BuildRequires JDK, Maven, Env vars
ComplexManual chown for recording dirs
SimpleSingle binary, no dependencies
Audit Format
asciicast v2Open, portable format
ProprietaryUndocumented internal format
Protocol DumpPlayed natively in their UI
InternalReplayed in its own admin UI
$|

Future Infrastructure.

Bastion is actively evolving. These features represent the next phases of development. Open-source contributions toward any of these initiatives are explicitly welcome.

Session Sharing

Share a recorded session via a unique link for debugging, onboarding, or post-mortems.

Live Session Shadowing

Allow admins to silently observe an active terminal session in real-time.

Zero-Downtime Key Rotation

Rotate the encryption key across every stored credential atomically, with automatic rollback.

Govern your access.
Build operational trust.

Deploy a highly secure, private access plane in minutes. Hardened out of the box.

Quick install