System Architecture Overview

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• warpgate/src/main.rs
• warpgate/src/commands/setup.rs
• warpgate-core/Cargo.toml
• warpgate-common/Cargo.toml
• warpgate-admin/src/api/users.rs
• warpgate-web/package.json

Warpgate is a smart bastion host designed for Linux that facilitates secure access to SSH, HTTPS, MySQL, and PostgreSQL targets. It operates as a high-performance proxy that authenticates users locally before forwarding connections directly to the intended targets, eliminating the need for jump hosts or specialized client software.

The system is written in 100% safe Rust and follows a modular architecture. It includes a core service for connection handling, a database layer for session and configuration persistence, and a web-based administrative interface for management and session replay.

Sources: README.md:1-15, README.md:76-80

Component Architecture

Warpgate's architecture is divided into a Rust backend and a Svelte-based frontend. The backend handles protocol-specific logic, authentication, and session recording, while the frontend provides an administrative UI.

High-Level Component Interaction

Core Modules and Libraries

The project is structured as a workspace with several specialized crates:

Crate	Responsibility
warpgate	Main CLI entry point and command orchestration.
warpgate-core	Core business logic, service management, and dependency injection.
warpgate-common	Shared data structures, configuration models, and helpers.
warpgate-protocol-*	Individual protocol implementations (SSH, HTTP, MySQL, Postgres).
warpgate-db-entities	Database models and ORM entities using Sea-ORM.
warpgate-admin	Backend API for the administrative interface.

Sources: warpgate/Cargo.toml:25-31, warpgate-core/Cargo.toml:7-9, warpgate-admin/Cargo.toml:25-27

Data Flow and Connection Logic

When a connection arrives, Warpgate intercepts the credentials to perform local authentication. If successful, it establishes a secondary connection to the target and bridges the two.

Connection Sequence

Database Schema and Persistence

Warpgate uses SQLite via sea-orm as its default database engine. It stores user accounts, roles, target configurations, and session metadata.

Entity Relationship Model

Administrative Interface

The admin interface is a Single Page Application (SPA) built with Svelte and Vite. It communicates with the backend via an autogenerated OpenAPI client.

Admin UI Tech Stack

• Frontend Framework: Svelte 5
• Styling: Bootstrap with Sveltestrap
• Icons: FontAwesome
• API Client: Generated via openapi-generator-cli from the Rust backend definitions.

Sources: warpgate-web/package.json:20-55, README.md:94-98

Configuration and Setup

Warpgate is configured via a YAML file (typically /etc/warpgate.yaml). The setup process handles initial database migration, admin user creation, and TLS certificate generation.

Setup Process Flow

Default Configuration Parameters

Parameter	Type	Default / Example	Description
database_url	Secret	sqlite:/var/lib/warpgate/db	Connection string for the metadata DB.
http.listen	SocketAddr	[::]:8888	Port for the web UI and HTTP proxy.
ssh.enable	Boolean	true	Whether to accept SSH connections.
recordings.path	Path	/var/lib/warpgate/recordings	Storage location for session logs.

Sources: warpgate/src/commands/setup.rs:104-140, warpgate/src/commands/setup.rs:194-205

Conclusion

Warpgate provides a unified entry point for infrastructure access by combining protocol-specific proxying with a centralized identity and policy management system. Its architecture ensures that security features like 2FA and session recording are applied consistently across SSH, Web, and Database protocols without modifying target environments.

Sources: README.md:1-12, README.md:76-88