webgate 0.2.1__tar.gz → 0.3.0__tar.gz

{webgate-0.2.1 → webgate-0.3.0}/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## v0.3.0 (2026-04-15)
+
+### Features
+
+- **SSH jump host / bastion** -- per-server `jump_via_id` field. Webgate opens a tunneled SSH connection through the bastion using `asyncssh`'s `tunnel=` parameter. Works for both the terminal WebSocket and the SFTP browser. Solves the common "internal servers reachable only through one public bastion" scenario.
+- **SSH command snippets** -- per-user library of named commands. Click a snippet button in the terminal toolbar to send the command (with Enter) to the active session. Right-click to delete, `+` to create.
+- **PostgreSQL support** -- install with `pip install 'webgate[postgres]'` and set `WEBGATE_DB_URL=postgresql+asyncpg://...`. SQLite remains the default. Lightweight migrations are now dialect-aware.
+
+### Details
+
+- New `Server.jump_via_id` (FK to `servers.id`, nullable) + `resolve_jump_creds()` helper
+- New `Snippet` model + REST CRUD at `/api/snippets`
+- Frontend: dropdown to pick a jump host in the Add/Edit Server modal; `↺` badge in the server card when a jump is configured
+- Frontend: snippet toolbar in the terminal tab (hidden when there are no snippets)
+- Demo seed pre-populates `bastion` + `internal-app` (jump-host pair) and 4 example snippets
+
+---
+
+## v0.2.2 (2026-04-15)
+
+### Features
+
+- **Demo mode** (`WEBGATE_DEMO_MODE=true`) -- read-only public demo deployments. Blocks every write request on `/api/*` (except login), disables the WebSocket quick-connect endpoint, seeds a `demo`/`demo` user with a sample server, and shows a top banner in the UI.
+- **`Dockerfile.demo`** -- single-container image bundling webgate + a sandboxed `sshd` target via supervisord. Ready for free hosting tiers.
+- **`fly.toml`** -- Fly.io configuration for one-command demo deployments (`flyctl deploy`).
+
+### Details
+
+- New public endpoint `GET /api/config` exposes `{"demo_mode": bool}` for the frontend to render the banner before login
+- `WEBGATE_DEMO_MODE=true` adds an HTTP middleware that returns `403` for any `POST/PUT/PATCH/DELETE` on `/api/*` (allowlist: `/api/auth/login`, `/api/auth/totp/verify`)
+- Demo seed (`webgate.demo`) is idempotent and only runs when the flag is on
+- Hourly state reset for the public demo can be done with a cron pinging the container restart, so DB returns to seed state
+
+---
+
 ## v0.2.1 (2026-04-15)
 
 ### Features

webgate-0.3.0/Dockerfile.demo

@@ -0,0 +1,63 @@
+# Single-container demo image: webgate + a sandboxed SSH/SFTP target
+# managed by supervisord. Suitable for free tiers (Fly.io, Render) where
+# spinning a sidecar VM isn't ideal.
+#
+# Build:  docker build -f Dockerfile.demo -t webgate-demo .
+# Run:    docker run -p 8443:8443 -e WEBGATE_SECRET_KEY=demo webgate-demo
+
+# --- Stage 1: build webgate ---
+FROM python:3.13-slim AS builder
+WORKDIR /app
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+COPY pyproject.toml uv.lock README.md ./
+RUN uv sync --frozen --no-dev --no-editable
+COPY src/ src/
+
+# --- Stage 2: runtime with webgate + sshd + supervisord ---
+FROM python:3.13-slim
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        openssh-server supervisor procps curl nano htop tree && \
+    rm -rf /var/lib/apt/lists/*
+
+# sshd config: only the demo user, password auth allowed for the demo
+RUN mkdir -p /run/sshd && \
+    sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && \
+    sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config && \
+    useradd -m -s /bin/bash demo && \
+    echo 'demo:demo' | chpasswd
+
+# Sample tree so SFTP browsing has something to show
+RUN mkdir -p /home/demo/projects/webgate /home/demo/projects/api-server \
+             /home/demo/documents /home/demo/logs /home/demo/scripts && \
+    printf '# webgate\nSelf-hosted SSH + SFTP manager\n' > /home/demo/projects/webgate/README.md && \
+    printf '{"name":"api-server","version":"2.1.0"}\n' > /home/demo/projects/api-server/package.json && \
+    printf 'Hello from the webgate demo!\n' > /home/demo/documents/welcome.txt && \
+    printf '2026-04-08 10:00:00 INFO  Server started on port 8080\n' > /home/demo/logs/app.log && \
+    printf '#!/bin/bash\necho "Deploy complete"\n' > /home/demo/scripts/deploy.sh && \
+    chmod +x /home/demo/scripts/deploy.sh && \
+    chown -R demo:demo /home/demo
+
+# webgate
+WORKDIR /app
+COPY --from=builder /app/.venv /app/.venv
+COPY --from=builder /app/src /app/src
+RUN mkdir -p /data
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONPATH="/app/src" \
+    WEBGATE_HOST=0.0.0.0 \
+    WEBGATE_PORT=8443 \
+    WEBGATE_DB_URL=sqlite+aiosqlite:////data/webgate.db \
+    WEBGATE_LOG_LEVEL=info \
+    WEBGATE_DEMO_MODE=true
+
+# supervisord config
+RUN printf '[supervisord]\nnodaemon=true\nuser=root\nlogfile=/dev/stdout\nlogfile_maxbytes=0\n\n[program:sshd]\ncommand=/usr/sbin/sshd -D -e\nautorestart=true\nstdout_logfile=/dev/stdout\nstdout_logfile_maxbytes=0\nstderr_logfile=/dev/stderr\nstderr_logfile_maxbytes=0\n\n[program:webgate]\ncommand=python -m webgate\nautorestart=true\nstdout_logfile=/dev/stdout\nstdout_logfile_maxbytes=0\nstderr_logfile=/dev/stderr\nstderr_logfile_maxbytes=0\n' > /etc/supervisor/conf.d/webgate.conf
+
+EXPOSE 8443
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+    CMD curl -fsS http://localhost:8443/api/health || exit 1
+
+CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/webgate.conf"]

{webgate-0.2.1 → webgate-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webgate
-Version: 0.2.1
+Version: 0.3.0
 Summary: Self-hosted web application for remote server management via SSH terminal and SFTP file browser
 Project-URL: Homepage, https://github.com/kalexnolasco/webgate
 Project-URL: Documentation, https://kalexnolasco.github.io/webgate/
@@ -42,6 +42,8 @@ Requires-Dist: slowapi>=0.1.9
 Requires-Dist: sqlalchemy>=2.0.36
 Requires-Dist: uvicorn[standard]>=0.34.0
 Requires-Dist: websockets>=14.0
+Provides-Extra: postgres
+Requires-Dist: asyncpg>=0.30.0; extra == 'postgres'
 Description-Content-Type: text/markdown
 
 # webgate
@@ -58,6 +60,8 @@ Description-Content-Type: text/markdown
 Self-hosted web application for remote server management via **SSH terminal** and **SFTP file browser**. A modern Python replacement combining the best of [webssh](https://github.com/huashengdun/webssh) and [filebrowser](https://github.com/filebrowser/filebrowser) into a single unified tool with a FileZilla-inspired interface.
 
 > **Documentation: [kalexnolasco.github.io/webgate](https://kalexnolasco.github.io/webgate/)**
+>
+> **🎮 Live demo: [webgate-demo.fly.dev](https://webgate-demo.fly.dev/)** — login `demo` / `demo` (read-only, resets hourly)
 
 ---
 
@@ -449,6 +453,26 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_DB_URL` | `sqlite+aiosqlite:///./webgate.db` | Database URL |
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
 | `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
+| `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
+
+### PostgreSQL
+
+SQLite is the default. To use PostgreSQL instead:
+
+```bash
+pip install 'webgate[postgres]'   # adds asyncpg
+export WEBGATE_DB_URL='postgresql+asyncpg://user:pass@host:5432/webgate'
+```
+
+Lightweight migrations are dialect-aware. Schema is created automatically on first start.
+
+### Jump host / bastion
+
+When adding a server, pick another server from the **Jump Via** dropdown to tunnel the SSH and SFTP connections through it. Useful when the target server is only reachable from a specific bastion. Stored as `jump_via_id` (FK to another `Server` row); `asyncssh`'s native `tunnel=` parameter does the actual chaining.
+
+### SSH command snippets
+
+Each user has a personal library of named commands. They appear as buttons in the terminal toolbar -- click to send `command + Enter`. Right-click to delete, `+` to create. Stored in the `snippets` table.
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

{webgate-0.2.1 → webgate-0.3.0}/README.md

@@ -12,6 +12,8 @@
 Self-hosted web application for remote server management via **SSH terminal** and **SFTP file browser**. A modern Python replacement combining the best of [webssh](https://github.com/huashengdun/webssh) and [filebrowser](https://github.com/filebrowser/filebrowser) into a single unified tool with a FileZilla-inspired interface.
 
 > **Documentation: [kalexnolasco.github.io/webgate](https://kalexnolasco.github.io/webgate/)**
+>
+> **🎮 Live demo: [webgate-demo.fly.dev](https://webgate-demo.fly.dev/)** — login `demo` / `demo` (read-only, resets hourly)
 
 ---
 
@@ -403,6 +405,26 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_DB_URL` | `sqlite+aiosqlite:///./webgate.db` | Database URL |
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
 | `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
+| `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
+
+### PostgreSQL
+
+SQLite is the default. To use PostgreSQL instead:
+
+```bash
+pip install 'webgate[postgres]'   # adds asyncpg
+export WEBGATE_DB_URL='postgresql+asyncpg://user:pass@host:5432/webgate'
+```
+
+Lightweight migrations are dialect-aware. Schema is created automatically on first start.
+
+### Jump host / bastion
+
+When adding a server, pick another server from the **Jump Via** dropdown to tunnel the SSH and SFTP connections through it. Useful when the target server is only reachable from a specific bastion. Stored as `jump_via_id` (FK to another `Server` row); `asyncssh`'s native `tunnel=` parameter does the actual chaining.
+
+### SSH command snippets
+
+Each user has a personal library of named commands. They appear as buttons in the terminal toolbar -- click to send `command + Enter`. Right-click to delete, `+` to create. Stored in the `snippets` table.
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

{webgate-0.2.1 → webgate-0.3.0}/ROADMAP.md

@@ -45,25 +45,39 @@ This document tracks the development plan for **webgate**. Items are organized b
 - [x] Drag & drop upload progress bar (XHR with progress events, percentage display)
 - [x] Folder download as ZIP (server-side zip compression, right-click context menu)
 
-## v0.3.0 -- Collaboration & Operations
+## v0.2.1 -- Reverse Proxy Sub-Path (Released 2026-04-15)
+
+- [x] Serve webgate behind a reverse proxy at any URL prefix (`WEBGATE_ROOT_PATH`)
+- [x] nginx, Apache and Traefik examples in README
+
+## v0.2.2 -- Demo Mode (Released 2026-04-15)
+
+- [x] `WEBGATE_DEMO_MODE` middleware blocks writes for public read-only deployments
+- [x] `Dockerfile.demo` (webgate + sshd via supervisord) and `fly.toml` for one-command Fly.io deploys
+- [x] Live demo at https://webgate-demo.fly.dev/
+
+## v0.3.0 -- Operations Pack (Released 2026-04-15)
+
+- [x] **SSH jump host / bastion** (per-server `jump_via_id`, asyncssh tunneling)
+- [x] **SSH command snippets** (per-user library, terminal toolbar, click to send)
+- [x] **PostgreSQL support** (`pip install 'webgate[postgres]'`, dialect-aware migrations)
+- [x] Two-factor authentication (TOTP) -- already in v0.2.x
+- [x] API key authentication -- already in v0.2.x
+
+## v0.3.x -- Planned
 
 | Feature | Priority | Description |
 |---------|----------|-------------|
 | Shared terminal sessions | High | Multiple users can watch/interact with the same SSH session in real time |
 | Session recording & playback | High | Record terminal sessions for audit trail and training; replay in browser |
-| SSH command snippets | Medium | Save and execute common commands per server or globally; share across team |
 | Webhook notifications | Medium | Fire webhooks on events: user login, SSH connect, file upload, server added |
-| Two-factor authentication (TOTP) | High | Optional TOTP (Google Authenticator, Authy) for user accounts |
 | LDAP / Active Directory | Medium | Authenticate users against corporate LDAP/AD; auto-map groups |
-| API key authentication | Low | Generate API keys for programmatic access (automation, scripts, CI/CD) |
 
 ## v0.4.0 -- Enterprise & Scale
 
 | Feature | Priority | Description |
 |---------|----------|-------------|
-| PostgreSQL support | High | Test, document, and CI-verify PostgreSQL as alternative to SQLite |
 | Multi-instance deployment | Medium | Multiple webgate instances sharing a single database (stateless workers behind LB) |
-| SSH jump host / bastion | High | Connect through a bastion/jump host to reach servers not directly reachable |
 | Custom branding | Low | Configurable logo, application name, and color scheme |
 | Backup/restore UI | Medium | Export/import full application state (users, servers, audit log) from admin panel |
 | Internationalization (i18n) | Low | Multi-language support for the UI (starting with English and Spanish) |

webgate-0.3.0/fly.toml

@@ -0,0 +1,48 @@
+# Fly.io deployment for the public webgate demo.
+# Edit `app` to your fly app name, then:
+#   flyctl launch --no-deploy --copy-config
+#   flyctl secrets set WEBGATE_SECRET_KEY=$(openssl rand -hex 32)
+#   flyctl deploy
+#
+# Free tier (1x shared-cpu, 256-512 MB) is enough for light demo traffic.
+
+app = "webgate-demo"
+primary_region = "cdg"  # Paris; closest EU region to Spain
+
+[build]
+  dockerfile = "Dockerfile.demo"
+
+[env]
+  WEBGATE_DEMO_MODE = "true"
+  WEBGATE_LOG_LEVEL = "info"
+
+[http_service]
+  internal_port = 8443
+  force_https = true
+  auto_stop_machines = "stop"     # save free-tier hours when idle
+  auto_start_machines = true
+  min_machines_running = 0
+
+  [http_service.concurrency]
+    type = "requests"
+    soft_limit = 50
+    hard_limit = 100
+
+  [[http_service.checks]]
+    interval = "30s"
+    timeout = "5s"
+    grace_period = "15s"
+    method = "get"
+    path = "/api/health"
+
+[[vm]]
+  cpu_kind = "shared"
+  cpus = 1
+  memory_mb = 512
+
+# Persistent volume so the demo seed survives restarts. The hourly reset
+# (see scripts/demo-reset.sh) wipes the DB inside the container, not the
+# whole volume, so this stays cheap.
+[mounts]
+  source = "webgate_demo_data"
+  destination = "/data"

{webgate-0.2.1 → webgate-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webgate"
-version = "0.2.1"
+version = "0.3.0"
 description = "Self-hosted web application for remote server management via SSH terminal and SFTP file browser"
 readme = "README.md"
 license = "MIT"
@@ -42,6 +42,9 @@ dependencies = [
     "qrcode[pil]>=8.2",
 ]
 
+[project.optional-dependencies]
+postgres = ["asyncpg>=0.30.0"]
+
 [project.urls]
 Homepage = "https://github.com/kalexnolasco/webgate"
 Documentation = "https://kalexnolasco.github.io/webgate/"

{webgate-0.2.1 → webgate-0.3.0}/src/webgate/app.py

@@ -1,8 +1,9 @@
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
 from fastapi.staticfiles import StaticFiles
 from slowapi import _rate_limit_exceeded_handler
 from slowapi.errors import RateLimitExceeded
@@ -12,10 +13,12 @@ from webgate.auth.routes import router as auth_router
 from webgate.auth.service import seed_admin
 from webgate.config import settings
 from webgate.db.engine import async_session_factory, close_db, init_db
+from webgate.demo import seed_demo
 from webgate.files.pool import sftp_pool
 from webgate.files.routes import router as files_router
 from webgate.servers.monitor import server_monitor
 from webgate.servers.routes import router as servers_router
+from webgate.snippets.routes import router as snippets_router
 from webgate.terminal.routes import router as terminal_router
 
 
@@ -24,6 +27,8 @@ async def lifespan(app: FastAPI) -> AsyncGenerator[None]:
     await init_db()
     async with async_session_factory() as session:
         await seed_admin(session)
+        if settings.demo_mode:
+            await seed_demo(session)
     await sftp_pool.start()
     await server_monitor.start()
     yield
@@ -55,10 +60,37 @@ def create_app() -> FastAPI:
     async def health() -> dict[str, str]:  # pyright: ignore[reportUnusedFunction]
         return {"status": "ok"}
 
+    @app.get("/api/config")
+    async def public_config() -> dict[str, object]:  # pyright: ignore[reportUnusedFunction]
+        # Public flags consumed by the frontend before login.
+        return {"demo_mode": settings.demo_mode}
+
+    if settings.demo_mode:
+        # In demo mode block any state-changing request on /api/* except login
+        # and the WS quick-connect endpoint (no arbitrary SSH targets allowed).
+        WRITE_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
+        WRITE_ALLOWLIST = {"/api/auth/login", "/api/auth/totp/verify"}
+
+        @app.middleware("http")
+        async def _demo_readonly(request: Request, call_next):  # pyright: ignore[reportUnusedFunction]
+            path = request.url.path
+            if request.method in WRITE_METHODS and path.startswith("/api/") and path not in WRITE_ALLOWLIST:
+                return JSONResponse(
+                    status_code=403,
+                    content={"detail": "Demo mode: write operations are disabled"},
+                )
+            if path.endswith("/api/ws/terminal/quick"):
+                return JSONResponse(
+                    status_code=403,
+                    content={"detail": "Demo mode: quick-connect is disabled"},
+                )
+            return await call_next(request)
+
     app.include_router(auth_router)
     app.include_router(servers_router)
     app.include_router(terminal_router)
     app.include_router(files_router)
+    app.include_router(snippets_router)
 
     app.mount("/", StaticFiles(directory=str(settings.static_dir), html=True), name="static")
 

{webgate-0.2.1 → webgate-0.3.0}/src/webgate/config.py

@@ -12,6 +12,7 @@ class Settings(BaseSettings):
     db_url: str = "sqlite+aiosqlite:///./webgate.db"
     allowed_origins: str = "*"
     root_path: str = ""  # URL prefix when served behind a reverse proxy (e.g. "/webgate")
+    demo_mode: bool = False  # Read-only public demo: blocks writes, hides admin UI
     log_level: str = "info"
     session_timeout: int = 3600
     max_upload_size: int = 104857600  # 100MB

{webgate-0.2.1 → webgate-0.3.0}/src/webgate/db/engine.py

@@ -30,21 +30,31 @@ async def get_session() -> AsyncGenerator[AsyncSession]:
         yield session
 
 
-_MIGRATIONS = [
-    "ALTER TABLE servers ADD COLUMN sftp_read_only BOOLEAN DEFAULT 0",
-    "ALTER TABLE users ADD COLUMN totp_secret VARCHAR(255) DEFAULT ''",
-    "ALTER TABLE users ADD COLUMN totp_enabled BOOLEAN DEFAULT 0",
+# (table, column, sqlite_def, postgres_def)
+_MIGRATIONS: list[tuple[str, str, str, str]] = [
+    ("servers", "sftp_read_only", "BOOLEAN DEFAULT 0", "BOOLEAN DEFAULT FALSE"),
+    ("users", "totp_secret", "VARCHAR(255) DEFAULT ''", "VARCHAR(255) DEFAULT ''"),
+    ("users", "totp_enabled", "BOOLEAN DEFAULT 0", "BOOLEAN DEFAULT FALSE"),
+    (
+        "servers",
+        "jump_via_id",
+        "INTEGER REFERENCES servers(id)",
+        "INTEGER REFERENCES servers(id)",
+    ),
 ]
 
 
 async def init_db() -> None:
+    dialect = engine.dialect.name  # "sqlite", "postgresql", ...
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)
         # Lightweight migrations for columns added after initial release
-        for sql in _MIGRATIONS:
+        for table, column, sqlite_def, pg_def in _MIGRATIONS:
+            col_def = pg_def if dialect == "postgresql" else sqlite_def
+            sql = f"ALTER TABLE {table} ADD COLUMN {column} {col_def}"
             try:
                 await conn.execute(text(sql))
-                logger.info("Migration applied: %s", sql.split("ADD COLUMN ")[1].split()[0])
+                logger.info("Migration applied: %s.%s", table, column)
             except Exception:
                 pass  # Column already exists
 

webgate-0.3.0/src/webgate/demo.py

@@ -0,0 +1,90 @@
+"""Demo mode seeding: pre-populates the demo user and showcase servers.
+
+Activated when WEBGATE_DEMO_MODE=true. Idempotent — safe to call on every startup.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from webgate.auth.service import create_user, get_user_by_username
+from sqlalchemy import select
+
+from webgate.servers.models import ServerCreate
+from webgate.servers.service import create_server, list_servers
+from webgate.snippets.models import Snippet
+
+logger = logging.getLogger(__name__)
+
+
+DEMO_USERNAME = "demo"
+DEMO_PASSWORD = "demo"
+
+def _bastion() -> ServerCreate:
+    return ServerCreate(
+        name="bastion",
+        hostname="127.0.0.1",
+        port=22,
+        username="demo",
+        password="demo",
+        group="demo",
+        tags=["demo", "bastion"],
+        description="Public SSH bastion. Other servers proxy through this one.",
+        sftp_read_only=True,
+    )
+
+
+def _internal(jump_via_id: int) -> ServerCreate:
+    return ServerCreate(
+        name="internal-app",
+        hostname="127.0.0.1",
+        port=22,
+        username="demo",
+        password="demo",
+        group="demo",
+        tags=["demo", "internal"],
+        description="App server reachable only via the bastion (jump-host demo).",
+        sftp_read_only=True,
+        jump_via_id=jump_via_id,
+    )
+
+
+async def seed_demo(session: AsyncSession) -> None:
+    user = await get_user_by_username(session, DEMO_USERNAME)
+    if user is None:
+        user = await create_user(session, DEMO_USERNAME, DEMO_PASSWORD, is_admin=False)
+        user.must_change_password = False
+        user.allowed_groups = json.dumps(["demo"])
+        await session.commit()
+        logger.info("Created demo user (%s/%s)", DEMO_USERNAME, DEMO_PASSWORD)
+
+    existing = await list_servers(session, user.id, is_admin=True)
+    existing_names = {s.name for s in existing}
+
+    bastion_id: int | None = next((s.id for s in existing if s.name == "bastion"), None)
+    if "bastion" not in existing_names:
+        bastion = await create_server(session, _bastion(), user.id)
+        bastion_id = bastion.id
+        logger.info("Seeded demo bastion (id=%s)", bastion_id)
+
+    if "internal-app" not in existing_names and bastion_id is not None:
+        await create_server(session, _internal(bastion_id), user.id)
+        logger.info("Seeded internal-app via bastion id=%s", bastion_id)
+
+    # Seed a few example snippets so the toolbar isn't empty
+    existing_snippets = (
+        await session.execute(select(Snippet).where(Snippet.user_id == user.id))
+    ).scalars().all()
+    if not existing_snippets:
+        for name, cmd, desc in [
+            ("ls -lah", "ls -lah", "List files (long, human sizes, hidden)"),
+            ("disk usage", "df -h", "Mounted filesystems with sizes"),
+            ("top procs", "ps aux --sort=-%mem | head", "Top memory-consuming processes"),
+            ("uptime", "uptime && uname -a", "Uptime + kernel info"),
+        ]:
+            session.add(Snippet(name=name, command=cmd, description=desc, user_id=user.id))
+        await session.commit()
+        logger.info("Seeded %d demo snippets", 4)

{webgate-0.2.1 → webgate-0.3.0}/src/webgate/files/pool.py

@@ -25,6 +25,7 @@ class _PoolEntry:
     client: SFTPClient
     last_used: float = field(default_factory=time.monotonic)
     in_use: int = 0
+    jump_conn: asyncssh.SSHClientConnection | None = None
 
 
 class SFTPPool:
@@ -63,6 +64,7 @@ class SFTPPool:
         username: str,
         password: str | None = None,
         private_key: str | None = None,
+        jump_kwargs: dict[str, object] | None = None,
     ) -> SFTPClient:
         key = self._key(server_id)
         if key not in self._locks:
@@ -96,10 +98,15 @@ class SFTPPool:
             elif password:
                 kwargs["password"] = password
 
+            jump_conn: asyncssh.SSHClientConnection | None = None
+            if jump_kwargs:
+                jump_conn = await asyncssh.connect(**jump_kwargs)  # type: ignore[arg-type]
+                kwargs["tunnel"] = jump_conn
+
             conn = await asyncssh.connect(**kwargs)  # type: ignore[arg-type]
             client = SFTPClient(conn)
             await client.connect()
-            entry = _PoolEntry(conn=conn, client=client, in_use=1)
+            entry = _PoolEntry(conn=conn, client=client, in_use=1, jump_conn=jump_conn)
             self._pool[key] = entry
             logger.info("SFTP pool: new connection to %s:%s (server_id=%s)", hostname, port, server_id)
             return client
@@ -120,6 +127,11 @@ class SFTPPool:
             entry.conn.close()
         except Exception:
             pass
+        if entry.jump_conn is not None:
+            try:
+                entry.jump_conn.close()
+            except Exception:
+                pass
 
     async def _cleanup_loop(self) -> None:
         while True:

{webgate-0.2.1 → webgate-0.3.0}/src/webgate/files/routes.py

@@ -25,7 +25,7 @@ from webgate.files.models import (
 from webgate.files.pool import sftp_pool
 from webgate.files.sftp_service import SFTPClient, validate_path
 from webgate.servers.models import Server
-from webgate.servers.service import get_server, get_server_credentials
+from webgate.servers.service import get_server, get_server_credentials, resolve_jump_creds
 
 router = APIRouter(prefix="/api/files", tags=["files"])
 
@@ -88,6 +88,7 @@ async def _sftp(
     allowed_paths = _get_allowed_paths(server)
     read_only = server.sftp_read_only
     password, private_key = get_server_credentials(server)
+    jump_kwargs = await resolve_jump_creds(session, server)
     try:
         client = await sftp_pool.acquire(
             server_id,
@@ -96,6 +97,7 @@ async def _sftp(
             username=server.username,
             password=password,
             private_key=private_key,
+            jump_kwargs=jump_kwargs,
         )
         yield client, allowed_paths, read_only
     finally:

{webgate-0.2.1 → webgate-0.3.0}/src/webgate/servers/models.py

@@ -25,6 +25,9 @@ class Server(Base):
     sftp_enabled: Mapped[bool] = mapped_column(Boolean, default=True)
     sftp_allowed_paths: Mapped[str] = mapped_column(Text, default="[]")  # JSON array of paths
     sftp_read_only: Mapped[bool] = mapped_column(Boolean, default=False)
+    jump_via_id: Mapped[int | None] = mapped_column(
+        Integer, ForeignKey("servers.id"), nullable=True
+    )
     last_connected_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
     created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
     user_id: Mapped[int] = mapped_column(Integer, ForeignKey("users.id"))
@@ -45,6 +48,7 @@ class ServerCreate(BaseModel):
     sftp_enabled: bool = True
     sftp_allowed_paths: list[str] = []
     sftp_read_only: bool = False
+    jump_via_id: int | None = None
 
 
 class ServerUpdate(BaseModel):
@@ -62,6 +66,7 @@ class ServerUpdate(BaseModel):
     sftp_enabled: bool | None = None
     sftp_allowed_paths: list[str] | None = None
     sftp_read_only: bool | None = None
+    jump_via_id: int | None = None
 
 
 class ServerOut(BaseModel):
@@ -78,6 +83,7 @@ class ServerOut(BaseModel):
     sftp_enabled: bool
     sftp_allowed_paths: list[str]
     sftp_read_only: bool
+    jump_via_id: int | None = None
     last_connected_at: datetime | None
     created_at: datetime
 

{webgate-0.2.1 → webgate-0.3.0}/src/webgate/servers/routes.py

@@ -154,7 +154,7 @@ async def test_connectivity(
     server = await get_server(session, server_id, current_user.id, **_user_kwargs(current_user))
     if not server:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Server not found")
-    success, message = await test_server_connectivity(server)
+    success, message = await test_server_connectivity(server, session)
     if success:
         await update_last_connected(session, server)
     return {"success": success, "message": message}