Warpgate on Ubuntu 24.04 LTS

Warpgate is a self-hosted, transparent bastion / access gateway for SSH, HTTPS, MySQL and PostgreSQL: one recorded, audited entry point into your infrastructure, managed from Warpgate's own built-in web admin console. Administrators define targets (the servers and services users connect to), roles and users, and every session is logged - with optional full session recording and playback - for compliance and incident response.

The image installs the pinned Warpgate 0.26.1 single-binary release and runs it as a dedicated `warpgate` system user under systemd. Warpgate is HTTPS-native: its admin console and HTTPS target proxying are served directly on port 443 with a self-signed TLS certificate generated fresh on every VM - nginx is not in front of it. A separate SSH bastion gateway listens on port 2222 (Warpgate's own documented default), completely distinct from this VM's own OS management SSH on port 22. MySQL and PostgreSQL wire proxies listen on ports 33306 and 55432 for database targets. A tiny nginx instance only serves an unauthenticated health-check endpoint on port 80 and redirects everything else to HTTPS.

On first boot, Warpgate's own non-interactive `unattended-setup` bootstrap runs once: it generates a unique per-VM admin password (argon2id-hashed, never stored in plaintext), a fresh self-signed TLS certificate, and fresh SSH host and client keys, then writes the configuration and starts the service. Warpgate's audit database, session recordings, TLS certificate and SSH keys all live on a dedicated, independently resizable Azure data disk, separate from the OS disk and re-provisioned with every VM.

Licensing - Apache-2.0, free and open source: there is no per-seat or per-target licence fee. The cloudimg charge covers packaging, security patching, image maintenance and 24/7 expert support. Recommended: Standard_B2s for a small team; scale up for larger fleets or heavier session-recording workloads. Target: platform, security and DevOps teams who want one recorded, audited entry point into SSH, web, and database infrastructure without installing client software. Prerequisites: an Azure subscription, a VNet, and an SSH key pair. NSG should permit port 22 (this VM's own management SSH), port 443 (the Warpgate admin console and HTTPS targets), port 2222 (the Warpgate SSH bastion gateway), and ports 33306 / 55432 if you plan to add MySQL or PostgreSQL targets.