webgate 0.2.1__tar.gz → 0.2.2__tar.gz

{webgate-0.2.1 → webgate-0.2.2}/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## v0.2.2 (2026-04-15)
+
+### Features
+
+- **Demo mode** (`WEBGATE_DEMO_MODE=true`) -- read-only public demo deployments. Blocks every write request on `/api/*` (except login), disables the WebSocket quick-connect endpoint, seeds a `demo`/`demo` user with a sample server, and shows a top banner in the UI.
+- **`Dockerfile.demo`** -- single-container image bundling webgate + a sandboxed `sshd` target via supervisord. Ready for free hosting tiers.
+- **`fly.toml`** -- Fly.io configuration for one-command demo deployments (`flyctl deploy`).
+
+### Details
+
+- New public endpoint `GET /api/config` exposes `{"demo_mode": bool}` for the frontend to render the banner before login
+- `WEBGATE_DEMO_MODE=true` adds an HTTP middleware that returns `403` for any `POST/PUT/PATCH/DELETE` on `/api/*` (allowlist: `/api/auth/login`, `/api/auth/totp/verify`)
+- Demo seed (`webgate.demo`) is idempotent and only runs when the flag is on
+- Hourly state reset for the public demo can be done with a cron pinging the container restart, so DB returns to seed state
+
+---
+
 ## v0.2.1 (2026-04-15)
 
 ### Features

webgate-0.2.2/Dockerfile.demo

@@ -0,0 +1,63 @@
+# Single-container demo image: webgate + a sandboxed SSH/SFTP target
+# managed by supervisord. Suitable for free tiers (Fly.io, Render) where
+# spinning a sidecar VM isn't ideal.
+#
+# Build:  docker build -f Dockerfile.demo -t webgate-demo .
+# Run:    docker run -p 8443:8443 -e WEBGATE_SECRET_KEY=demo webgate-demo
+
+# --- Stage 1: build webgate ---
+FROM python:3.13-slim AS builder
+WORKDIR /app
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY pyproject.toml uv.lock README.md ./
+RUN uv sync --frozen --no-dev --no-editable
+COPY src/ src/
+
+# --- Stage 2: runtime with webgate + sshd + supervisord ---
+FROM python:3.13-slim
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        openssh-server supervisor procps curl nano htop tree && \
+    rm -rf /var/lib/apt/lists/*
+
+# sshd config: only the demo user, password auth allowed for the demo
+RUN mkdir -p /run/sshd && \
+    sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && \
+    sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config && \
+    useradd -m -s /bin/bash demo && \
+    echo 'demo:demo' | chpasswd
+
+# Sample tree so SFTP browsing has something to show
+RUN mkdir -p /home/demo/projects/webgate /home/demo/projects/api-server \
+             /home/demo/documents /home/demo/logs /home/demo/scripts && \
+    printf '# webgate\nSelf-hosted SSH + SFTP manager\n' > /home/demo/projects/webgate/README.md && \
+    printf '{"name":"api-server","version":"2.1.0"}\n' > /home/demo/projects/api-server/package.json && \
+    printf 'Hello from the webgate demo!\n' > /home/demo/documents/welcome.txt && \
+    printf '2026-04-08 10:00:00 INFO  Server started on port 8080\n' > /home/demo/logs/app.log && \
+    printf '#!/bin/bash\necho "Deploy complete"\n' > /home/demo/scripts/deploy.sh && \
+    chmod +x /home/demo/scripts/deploy.sh && \
+    chown -R demo:demo /home/demo
+
+# webgate
+WORKDIR /app
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/src /app/src
+RUN mkdir -p /data
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONPATH="/app/src" \
+    WEBGATE_HOST=0.0.0.0 \
+    WEBGATE_PORT=8443 \
+    WEBGATE_DB_URL=sqlite+aiosqlite:////data/webgate.db \
+    WEBGATE_LOG_LEVEL=info \
+    WEBGATE_DEMO_MODE=true
+
+# supervisord config
+RUN printf '[supervisord]\nnodaemon=true\nuser=root\nlogfile=/dev/stdout\nlogfile_maxbytes=0\n\n[program:sshd]\ncommand=/usr/sbin/sshd -D -e\nautorestart=true\nstdout_logfile=/dev/stdout\nstdout_logfile_maxbytes=0\nstderr_logfile=/dev/stderr\nstderr_logfile_maxbytes=0\n\n[program:webgate]\ncommand=python -m webgate\nautorestart=true\nstdout_logfile=/dev/stdout\nstdout_logfile_maxbytes=0\nstderr_logfile=/dev/stderr\nstderr_logfile_maxbytes=0\n' > /etc/supervisor/conf.d/webgate.conf
+
+EXPOSE 8443
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+    CMD curl -fsS http://localhost:8443/api/health || exit 1
+
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/webgate.conf"]

{webgate-0.2.1 → webgate-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webgate
-Version: 0.2.1
+Version: 0.2.2
 Summary: Self-hosted web application for remote server management via SSH terminal and SFTP file browser
 Project-URL: Homepage, https://github.com/kalexnolasco/webgate
 Project-URL: Documentation, https://kalexnolasco.github.io/webgate/
@@ -58,6 +58,8 @@ Description-Content-Type: text/markdown
 Self-hosted web application for remote server management via **SSH terminal** and **SFTP file browser**. A modern Python replacement combining the best of [webssh](https://github.com/huashengdun/webssh) and [filebrowser](https://github.com/filebrowser/filebrowser) into a single unified tool with a FileZilla-inspired interface.
 
 > **Documentation: [kalexnolasco.github.io/webgate](https://kalexnolasco.github.io/webgate/)**
+>
+> **🎮 Live demo: [webgate-demo.fly.dev](https://webgate-demo.fly.dev/)** — login `demo` / `demo` (read-only, resets hourly)
 
 ---
 
@@ -449,6 +451,7 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_DB_URL` | `sqlite+aiosqlite:///./webgate.db` | Database URL |
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
 | `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
+| `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

{webgate-0.2.1 → webgate-0.2.2}/README.md

@@ -12,6 +12,8 @@
 Self-hosted web application for remote server management via **SSH terminal** and **SFTP file browser**. A modern Python replacement combining the best of [webssh](https://github.com/huashengdun/webssh) and [filebrowser](https://github.com/filebrowser/filebrowser) into a single unified tool with a FileZilla-inspired interface.
 
 > **Documentation: [kalexnolasco.github.io/webgate](https://kalexnolasco.github.io/webgate/)**
+>
+> **🎮 Live demo: [webgate-demo.fly.dev](https://webgate-demo.fly.dev/)** — login `demo` / `demo` (read-only, resets hourly)
 
 ---
 
@@ -403,6 +405,7 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_DB_URL` | `sqlite+aiosqlite:///./webgate.db` | Database URL |
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
 | `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
+| `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

webgate-0.2.2/fly.toml

@@ -0,0 +1,48 @@
+# Fly.io deployment for the public webgate demo.
+# Edit `app` to your fly app name, then:
+#   flyctl launch --no-deploy --copy-config
+#   flyctl secrets set WEBGATE_SECRET_KEY=$(openssl rand -hex 32)
+#   flyctl deploy
+#
+# Free tier (1x shared-cpu, 256-512 MB) is enough for light demo traffic.
+
+app = "webgate-demo"
+primary_region = "cdg"  # Paris; closest EU region to Spain
+
+[build]
+  dockerfile = "Dockerfile.demo"
+
+[env]
+  WEBGATE_DEMO_MODE = "true"
+  WEBGATE_LOG_LEVEL = "info"
+
+[http_service]
+  internal_port = 8443
+  force_https = true
+  auto_stop_machines = "stop"     # save free-tier hours when idle
+  auto_start_machines = true
+  min_machines_running = 0
+
+  [http_service.concurrency]
+    type = "requests"
+    soft_limit = 50
+    hard_limit = 100
+
+  [[http_service.checks]]
+    interval = "30s"
+    timeout = "5s"
+    grace_period = "15s"
+    method = "get"
+    path = "/api/health"
+
+[[vm]]
+  cpu_kind = "shared"
+  cpus = 1
+  memory_mb = 512
+
+# Persistent volume so the demo seed survives restarts. The hourly reset
+# (see scripts/demo-reset.sh) wipes the DB inside the container, not the
+# whole volume, so this stays cheap.
+[mounts]
+  source = "webgate_demo_data"
+  destination = "/data"

{webgate-0.2.1 → webgate-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webgate"
-version = "0.2.1"
+version = "0.2.2"
 description = "Self-hosted web application for remote server management via SSH terminal and SFTP file browser"
 readme = "README.md"
 license = "MIT"

{webgate-0.2.1 → webgate-0.2.2}/src/webgate/app.py

@@ -1,8 +1,9 @@
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
 from fastapi.staticfiles import StaticFiles
 from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
@@ -12,6 +13,7 @@ from webgate.auth.routes import router as auth_router
 from webgate.auth.service import seed_admin
 from webgate.config import settings
 from webgate.db.engine import async_session_factory, close_db, init_db
+from webgate.demo import seed_demo
 from webgate.files.pool import sftp_pool
 from webgate.files.routes import router as files_router
 from webgate.servers.monitor import server_monitor
@@ -24,6 +26,8 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None]:
     await init_db()
     async with async_session_factory() as session:
         await seed_admin(session)
+        if settings.demo_mode:
+            await seed_demo(session)
     await sftp_pool.start()
     await server_monitor.start()
     yield
@@ -55,6 +59,32 @@ def create_app() -> FastAPI:
     async def health() -> dict[str, str]:  # pyright: ignore[reportUnusedFunction]
         return {"status": "ok"}
 
+    @app.get("/api/config")
+    async def public_config() -> dict[str, object]:  # pyright: ignore[reportUnusedFunction]
+        # Public flags consumed by the frontend before login.
+        return {"demo_mode": settings.demo_mode}
+
+    if settings.demo_mode:
+        # In demo mode block any state-changing request on /api/* except login
+        # and the WS quick-connect endpoint (no arbitrary SSH targets allowed).
+        WRITE_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
+        WRITE_ALLOWLIST = {"/api/auth/login", "/api/auth/totp/verify"}
+
+        @app.middleware("http")
+        async def _demo_readonly(request: Request, call_next):  # pyright: ignore[reportUnusedFunction]
+            path = request.url.path
+            if request.method in WRITE_METHODS and path.startswith("/api/") and path not in WRITE_ALLOWLIST:
+                return JSONResponse(
+                    status_code=403,
+                    content={"detail": "Demo mode: write operations are disabled"},
+                )
+            if path.endswith("/api/ws/terminal/quick"):
+                return JSONResponse(
+                    status_code=403,
+                    content={"detail": "Demo mode: quick-connect is disabled"},
+                )
+            return await call_next(request)
+
     app.include_router(auth_router)
     app.include_router(servers_router)
     app.include_router(terminal_router)

{webgate-0.2.1 → webgate-0.2.2}/src/webgate/config.py

@@ -12,6 +12,7 @@ class Settings(BaseSettings):
     db_url: str = "sqlite+aiosqlite:///./webgate.db"
     allowed_origins: str = "*"
     root_path: str = ""  # URL prefix when served behind a reverse proxy (e.g. "/webgate")
+    demo_mode: bool = False  # Read-only public demo: blocks writes, hides admin UI
     log_level: str = "info"
     session_timeout: int = 3600
     max_upload_size: int = 104857600  # 100MB

webgate-0.2.2/src/webgate/demo.py

@@ -0,0 +1,55 @@
+"""Demo mode seeding: pre-populates the demo user and showcase servers.
+
+Activated when WEBGATE_DEMO_MODE=true. Idempotent — safe to call on every startup.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from webgate.auth.service import create_user, get_user_by_username
+from webgate.servers.models import ServerCreate
+from webgate.servers.service import create_server, list_servers
+
+logger = logging.getLogger(__name__)
+
+
+DEMO_USERNAME = "demo"
+DEMO_PASSWORD = "demo"
+
+# Servers pre-registered for the demo. Hostnames must be reachable from the
+# webgate container. In Fly.io they resolve via *.internal DNS.
+DEMO_SERVERS: list[ServerCreate] = [
+    ServerCreate(
+        name="demo-server",
+        hostname="127.0.0.1",
+        port=22,
+        username="demo",
+        password="demo",
+        group="demo",
+        tags=["demo", "debian"],
+        description="Sandbox SSH/SFTP server (debian). Try `ls`, `htop`, browse /home/demo.",
+        sftp_read_only=True,
+    ),
+]
+
+
+async def seed_demo(session: AsyncSession) -> None:
+    user = await get_user_by_username(session, DEMO_USERNAME)
+    if user is None:
+        user = await create_user(session, DEMO_USERNAME, DEMO_PASSWORD, is_admin=False)
+        user.must_change_password = False
+        user.allowed_groups = json.dumps(["demo"])
+        await session.commit()
+        logger.info("Created demo user (%s/%s)", DEMO_USERNAME, DEMO_PASSWORD)
+
+    existing = await list_servers(session, user.id, is_admin=True)
+    existing_names = {s.name for s in existing}
+    for srv in DEMO_SERVERS:
+        if srv.name in existing_names:
+            continue
+        await create_server(session, srv, user.id)
+        logger.info("Seeded demo server: %s -> %s:%s", srv.name, srv.hostname, srv.port)

{webgate-0.2.1 → webgate-0.2.2}/src/webgate/static/index.html

@@ -118,6 +118,9 @@
         .cm-editor .cm-scroller { overflow: auto; }
 
         /* Login overlay */
+        .fz-demo-banner { position: fixed; top: 0; left: 0; right: 0; z-index: 200; background: linear-gradient(90deg, #f59e0b, #ef4444); color: #fff; text-align: center; font-size: 12px; padding: 6px 12px; box-shadow: 0 2px 8px rgba(0,0,0,0.2); }
+        .fz-demo-banner code { background: rgba(255,255,255,0.25); padding: 1px 5px; border-radius: 3px; font-family: monospace; }
+        .fz-demo-banner a { color: #fff; text-decoration: underline; }
         .fz-login-overlay { position: fixed; inset: 0; background: var(--bg-tertiary); display: flex; align-items: center; justify-content: center; z-index: 100; }
         .fz-login-box { background: var(--modal-bg); border: 1px solid var(--border); border-radius: 12px; padding: 32px; width: 380px; box-shadow: 0 16px 48px rgba(0,0,0,0.4); }
         .fz-login-box h1 { text-align: center; font-size: 24px; margin-bottom: 4px; color: var(--text-primary); font-weight: 700; }
@@ -191,6 +194,12 @@ window._showToastImpl = function(message, type) {
 
 <div x-data="app()" x-cloak @keydown.window="handleKeyboard($event)">
 
+<!-- Demo banner (shown when WEBGATE_DEMO_MODE=true) -->
+<div x-show="demoMode" class="fz-demo-banner">
+    🎮 <strong>Demo mode</strong> &mdash; login with <code>demo</code> / <code>demo</code> &middot; read-only (servers cannot be added or modified) &middot; state resets hourly &middot;
+    <a href="https://github.com/kalexnolasco/webgate" target="_blank" rel="noopener">GitHub</a>
+</div>
+
 <!-- ======================== LOGIN ======================== -->
 <div x-show="!token" class="fz-login-overlay">
     <div class="fz-login-box">
@@ -807,6 +816,7 @@ const BASE = location.pathname.replace(/\/(index\.html)?$/, '');
 function app() {
     return {
         theme: localStorage.getItem('webgate_theme') || 'dark',
+        demoMode: false,
         uploadProgress: { active: false, percent: 0, fileName: '', total: 0, loaded: 0 },
         token: localStorage.getItem('webgate_token') || '',
         currentUser: null, username: '', password: '',
@@ -879,6 +889,7 @@ function app() {
 
         async init() {
             document.documentElement.dataset.theme = this.theme;
+            try { const cfg = await this.apiCall('/api/config'); this.demoMode = !!cfg.demo_mode; } catch {}
             if (this.token) {
                 await this.fetchMe();
                 if (this.currentUser?.must_change_password) return;