Access

Access is a privileged access control plane: short-lived SSH access, recorded sessions, and auditable just-in-time host entry. It replaces standing keys and permanent admin accounts with time-bound certificates, identity-gated login, and host agents that enforce policy where the shell actually runs.

In the same category as CyberArk, HashiCorp Boundary, or Teleport — built as an end-to-end product: identity, policy, session brokerage, recording, and host enforcement in one system.

Operators sign in through an OIDC identity provider (Keycloak by default). From there they request access, open browser or CLI sessions, and leave an audit trail — without copying long-lived SSH keys around.

Short-lived SSH certificates

An internal SSH certificate authority issues time-bound credentials instead of relying on static keys. Stolen credentials have a short blast radius because they expire with the access window.

Just-in-time host provisioning

Users are provisioned on target hosts for approved windows as temporary identities, then cleaned up. No permanent local admin accounts left behind after the job is done.

Session recording and audit

Interactive sessions are recorded for replay. Access events, agent telemetry, and control-plane audit trails give compliance and incident review something firmer than trust-on-faith logs.

Browser and CLI terminals

A WebSocket terminal gateway brokers browser terminals and SSH flows through the control plane. Operators can work from the Access UI or from CLI tooling without bypassing policy.

Identity-first authentication

Password login is disabled on the public surface. Sign-in goes through OIDC (Keycloak, with Okta-ready plumbing when needed). Session cookies are hardened; stale sessions can be cleared cleanly at the edge.

Host agents and secrets

A host agent enrolls machines, heartbeats, reports telemetry and access events, records shells, handles elevated file edits, and supports secret checkout — so policy is enforced on the machine, not only in the browser.

Hardware-backed and FIDO session paths

Agent APIs cover hardware keys and FIDO sessions so phishing-resistant authentication can participate in privileged workflows, not just the UI login.

Edge proxy

TLS terminates at an nginx edge that proxies the control plane and terminal websockets, rate-limits login, and protects internal agent paths so enroll, heartbeat, telemetry, and JIT calls keep private-path semantics.

Control plane

Next.js + TypeScript app for policy, approvals, session visibility, findings, and operator workflows. PostgreSQL for durable state; Redis for ephemeral coordination.

Terminal gateway

/ws/terminal and /ws/ssh terminate on a dedicated gateway process — long-lived websocket sessions stay off the main UI workers so interactive shells do not starve the control plane.

Host agent

The agent on each enrolled host talks to the control plane for install/enroll, heartbeats, JIT lifecycle, recordings ingest, principal audit, and secret requests. That is the enforcement point for certificate trust and session reality.

1. Sign in with OIDC SSO.

2. Request or open an approved access window to a host.

3. Connect through the browser terminal or SSH path; short-lived credentials and JIT identity are minted for that window.

4. Work under recording and audit; when the window ends, access and temporary accounts go away.

Admins monitor hosts, sessions, findings, and agent health from the same control plane — one place for who got in, for how long, and what they did.

• No standing SSH keys as the primary path — prefer short-lived certificates.

• No permanent local admin accounts for day-to-day ops — JIT users for the window only.

• Sessions are brokered and recorded; terminal ticket redemption is not exposed as a public shortcut.

• Agent APIs are carved out at the edge so internal service calls cannot be trivially spoofed via forwarded client IPs.

• Identity lives with the IdP; Access owns the privilege session, not the password store.

Next.js · TypeScript · PostgreSQL · Redis · SSH certificates · WebSockets · Keycloak/OIDC · WebAuthn/FIDO2 · Go host agent · nginx edge · containerized control plane

Access is built for getting onto production hosts safely. It bridges systems administration, security engineering, and full-stack development — certificates, recording, identity, agents, and an operator UI in one control plane.

Reach out via the contact page if you want a walkthrough of the architecture or deployment model.