webgate 0.2.2__tar.gz → 0.3.0__tar.gz

{webgate-0.2.2 → webgate-0.3.0}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## v0.3.0 (2026-04-15)
+
+### Features
+
+- **SSH jump host / bastion** -- per-server `jump_via_id` field. Webgate opens a tunneled SSH connection through the bastion using `asyncssh`'s `tunnel=` parameter. Works for both the terminal WebSocket and the SFTP browser. Solves the common "internal servers reachable only through one public bastion" scenario.
+- **SSH command snippets** -- per-user library of named commands. Click a snippet button in the terminal toolbar to send the command (with Enter) to the active session. Right-click to delete, `+` to create.
+- **PostgreSQL support** -- install with `pip install 'webgate[postgres]'` and set `WEBGATE_DB_URL=postgresql+asyncpg://...`. SQLite remains the default. Lightweight migrations are now dialect-aware.
+
+### Details
+
+- New `Server.jump_via_id` (FK to `servers.id`, nullable) + `resolve_jump_creds()` helper
+- New `Snippet` model + REST CRUD at `/api/snippets`
+- Frontend: dropdown to pick a jump host in the Add/Edit Server modal; `↺` badge in the server card when a jump is configured
+- Frontend: snippet toolbar in the terminal tab (hidden when there are no snippets)
+- Demo seed pre-populates `bastion` + `internal-app` (jump-host pair) and 4 example snippets
+
+---
+
 ## v0.2.2 (2026-04-15)
 
 ### Features

{webgate-0.2.2 → webgate-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webgate
-Version: 0.2.2
+Version: 0.3.0
 Summary: Self-hosted web application for remote server management via SSH terminal and SFTP file browser
 Project-URL: Homepage, https://github.com/kalexnolasco/webgate
 Project-URL: Documentation, https://kalexnolasco.github.io/webgate/
@@ -42,6 +42,8 @@ Requires-Dist: slowapi>=0.1.9
 Requires-Dist: sqlalchemy>=2.0.36
 Requires-Dist: uvicorn[standard]>=0.34.0
 Requires-Dist: websockets>=14.0
+Provides-Extra: postgres
+Requires-Dist: asyncpg>=0.30.0; extra == 'postgres'
 Description-Content-Type: text/markdown
 
 # webgate
@@ -452,6 +454,25 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
 | `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
 | `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
+
+### PostgreSQL
+
+SQLite is the default. To use PostgreSQL instead:
+
+```bash
+pip install 'webgate[postgres]'   # adds asyncpg
+export WEBGATE_DB_URL='postgresql+asyncpg://user:pass@host:5432/webgate'
+```
+
+Lightweight migrations are dialect-aware. Schema is created automatically on first start.
+
+### Jump host / bastion
+
+When adding a server, pick another server from the **Jump Via** dropdown to tunnel the SSH and SFTP connections through it. Useful when the target server is only reachable from a specific bastion. Stored as `jump_via_id` (FK to another `Server` row); `asyncssh`'s native `tunnel=` parameter does the actual chaining.
+
+### SSH command snippets
+
+Each user has a personal library of named commands. They appear as buttons in the terminal toolbar -- click to send `command + Enter`. Right-click to delete, `+` to create. Stored in the `snippets` table.
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

{webgate-0.2.2 → webgate-0.3.0}/README.md

@@ -406,6 +406,25 @@ All settings are configurable via environment variables with the `WEBGATE_` pref
 | `WEBGATE_ALLOWED_ORIGINS` | `*` | CORS origins (comma-separated) |
 | `WEBGATE_ROOT_PATH` | `` (empty) | URL prefix when served behind a reverse proxy at a sub-path (e.g. `/webgate`) |
 | `WEBGATE_DEMO_MODE` | `false` | Read-only public demo: blocks all writes, seeds a `demo`/`demo` user and shows a banner |
+
+### PostgreSQL
+
+SQLite is the default. To use PostgreSQL instead:
+
+```bash
+pip install 'webgate[postgres]'   # adds asyncpg
+export WEBGATE_DB_URL='postgresql+asyncpg://user:pass@host:5432/webgate'
+```
+
+Lightweight migrations are dialect-aware. Schema is created automatically on first start.
+
+### Jump host / bastion
+
+When adding a server, pick another server from the **Jump Via** dropdown to tunnel the SSH and SFTP connections through it. Useful when the target server is only reachable from a specific bastion. Stored as `jump_via_id` (FK to another `Server` row); `asyncssh`'s native `tunnel=` parameter does the actual chaining.
+
+### SSH command snippets
+
+Each user has a personal library of named commands. They appear as buttons in the terminal toolbar -- click to send `command + Enter`. Right-click to delete, `+` to create. Stored in the `snippets` table.
 | `WEBGATE_LOG_LEVEL` | `info` | Log level |
 | `WEBGATE_SESSION_TIMEOUT` | `3600` | SSH session timeout (seconds) |
 | `WEBGATE_MAX_UPLOAD_SIZE` | `104857600` | Max upload size (100 MB) |

{webgate-0.2.2 → webgate-0.3.0}/ROADMAP.md

@@ -45,25 +45,39 @@ This document tracks the development plan for **webgate**. Items are organized b
 - [x] Drag & drop upload progress bar (XHR with progress events, percentage display)
 - [x] Folder download as ZIP (server-side zip compression, right-click context menu)
 
-## v0.3.0 -- Collaboration & Operations
+## v0.2.1 -- Reverse Proxy Sub-Path (Released 2026-04-15)
+
+- [x] Serve webgate behind a reverse proxy at any URL prefix (`WEBGATE_ROOT_PATH`)
+- [x] nginx, Apache and Traefik examples in README
+
+## v0.2.2 -- Demo Mode (Released 2026-04-15)
+
+- [x] `WEBGATE_DEMO_MODE` middleware blocks writes for public read-only deployments
+- [x] `Dockerfile.demo` (webgate + sshd via supervisord) and `fly.toml` for one-command Fly.io deploys
+- [x] Live demo at https://webgate-demo.fly.dev/
+
+## v0.3.0 -- Operations Pack (Released 2026-04-15)
+
+- [x] **SSH jump host / bastion** (per-server `jump_via_id`, asyncssh tunneling)
+- [x] **SSH command snippets** (per-user library, terminal toolbar, click to send)
+- [x] **PostgreSQL support** (`pip install 'webgate[postgres]'`, dialect-aware migrations)
+- [x] Two-factor authentication (TOTP) -- already in v0.2.x
+- [x] API key authentication -- already in v0.2.x
+
+## v0.3.x -- Planned
 
 | Feature | Priority | Description |
 |---------|----------|-------------|
 | Shared terminal sessions | High | Multiple users can watch/interact with the same SSH session in real time |
 | Session recording & playback | High | Record terminal sessions for audit trail and training; replay in browser |
-| SSH command snippets | Medium | Save and execute common commands per server or globally; share across team |
 | Webhook notifications | Medium | Fire webhooks on events: user login, SSH connect, file upload, server added |
-| Two-factor authentication (TOTP) | High | Optional TOTP (Google Authenticator, Authy) for user accounts |
 | LDAP / Active Directory | Medium | Authenticate users against corporate LDAP/AD; auto-map groups |
-| API key authentication | Low | Generate API keys for programmatic access (automation, scripts, CI/CD) |
 
 ## v0.4.0 -- Enterprise & Scale
 
 | Feature | Priority | Description |
 |---------|----------|-------------|
-| PostgreSQL support | High | Test, document, and CI-verify PostgreSQL as alternative to SQLite |
 | Multi-instance deployment | Medium | Multiple webgate instances sharing a single database (stateless workers behind LB) |
-| SSH jump host / bastion | High | Connect through a bastion/jump host to reach servers not directly reachable |
 | Custom branding | Low | Configurable logo, application name, and color scheme |
 | Backup/restore UI | Medium | Export/import full application state (users, servers, audit log) from admin panel |
 | Internationalization (i18n) | Low | Multi-language support for the UI (starting with English and Spanish) |

{webgate-0.2.2 → webgate-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webgate"
-version = "0.2.2"
+version = "0.3.0"
 description = "Self-hosted web application for remote server management via SSH terminal and SFTP file browser"
 readme = "README.md"
 license = "MIT"
@@ -42,6 +42,9 @@ dependencies = [
     "qrcode[pil]>=8.2",
 ]
 
+[project.optional-dependencies]
+postgres = ["asyncpg>=0.30.0"]
+
 [project.urls]
 Homepage = "https://github.com/kalexnolasco/webgate"
 Documentation = "https://kalexnolasco.github.io/webgate/"

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/app.py

@@ -18,6 +18,7 @@ from webgate.files.pool import sftp_pool
 from webgate.files.routes import router as files_router
 from webgate.servers.monitor import server_monitor
 from webgate.servers.routes import router as servers_router
+from webgate.snippets.routes import router as snippets_router
 from webgate.terminal.routes import router as terminal_router
 
 
@@ -89,6 +90,7 @@ def create_app() -> FastAPI:
     app.include_router(servers_router)
     app.include_router(terminal_router)
     app.include_router(files_router)
+    app.include_router(snippets_router)
 
     app.mount("/", StaticFiles(directory=str(settings.static_dir), html=True), name="static")
 

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/db/engine.py

@@ -30,21 +30,31 @@ async def get_session() -> AsyncGenerator[AsyncSession]:
         yield session
 
 
-_MIGRATIONS = [
-    "ALTER TABLE servers ADD COLUMN sftp_read_only BOOLEAN DEFAULT 0",
-    "ALTER TABLE users ADD COLUMN totp_secret VARCHAR(255) DEFAULT ''",
-    "ALTER TABLE users ADD COLUMN totp_enabled BOOLEAN DEFAULT 0",
+# (table, column, sqlite_def, postgres_def)
+_MIGRATIONS: list[tuple[str, str, str, str]] = [
+    ("servers", "sftp_read_only", "BOOLEAN DEFAULT 0", "BOOLEAN DEFAULT FALSE"),
+    ("users", "totp_secret", "VARCHAR(255) DEFAULT ''", "VARCHAR(255) DEFAULT ''"),
+    ("users", "totp_enabled", "BOOLEAN DEFAULT 0", "BOOLEAN DEFAULT FALSE"),
+    (
+        "servers",
+        "jump_via_id",
+        "INTEGER REFERENCES servers(id)",
+        "INTEGER REFERENCES servers(id)",
+    ),
 ]
 
 
 async def init_db() -> None:
+    dialect = engine.dialect.name  # "sqlite", "postgresql", ...
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)
         # Lightweight migrations for columns added after initial release
-        for sql in _MIGRATIONS:
+        for table, column, sqlite_def, pg_def in _MIGRATIONS:
+            col_def = pg_def if dialect == "postgresql" else sqlite_def
+            sql = f"ALTER TABLE {table} ADD COLUMN {column} {col_def}"
             try:
                 await conn.execute(text(sql))
-                logger.info("Migration applied: %s", sql.split("ADD COLUMN ")[1].split()[0])
+                logger.info("Migration applied: %s.%s", table, column)
             except Exception:
                 pass  # Column already exists
 

webgate-0.3.0/src/webgate/demo.py

@@ -0,0 +1,90 @@
+"""Demo mode seeding: pre-populates the demo user and showcase servers.
+
+Activated when WEBGATE_DEMO_MODE=true. Idempotent — safe to call on every startup.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from webgate.auth.service import create_user, get_user_by_username
+from sqlalchemy import select
+
+from webgate.servers.models import ServerCreate
+from webgate.servers.service import create_server, list_servers
+from webgate.snippets.models import Snippet
+
+logger = logging.getLogger(__name__)
+
+
+DEMO_USERNAME = "demo"
+DEMO_PASSWORD = "demo"
+
+def _bastion() -> ServerCreate:
+    return ServerCreate(
+        name="bastion",
+        hostname="127.0.0.1",
+        port=22,
+        username="demo",
+        password="demo",
+        group="demo",
+        tags=["demo", "bastion"],
+        description="Public SSH bastion. Other servers proxy through this one.",
+        sftp_read_only=True,
+    )
+
+
+def _internal(jump_via_id: int) -> ServerCreate:
+    return ServerCreate(
+        name="internal-app",
+        hostname="127.0.0.1",
+        port=22,
+        username="demo",
+        password="demo",
+        group="demo",
+        tags=["demo", "internal"],
+        description="App server reachable only via the bastion (jump-host demo).",
+        sftp_read_only=True,
+        jump_via_id=jump_via_id,
+    )
+
+
+async def seed_demo(session: AsyncSession) -> None:
+    user = await get_user_by_username(session, DEMO_USERNAME)
+    if user is None:
+        user = await create_user(session, DEMO_USERNAME, DEMO_PASSWORD, is_admin=False)
+        user.must_change_password = False
+        user.allowed_groups = json.dumps(["demo"])
+        await session.commit()
+        logger.info("Created demo user (%s/%s)", DEMO_USERNAME, DEMO_PASSWORD)
+
+    existing = await list_servers(session, user.id, is_admin=True)
+    existing_names = {s.name for s in existing}
+
+    bastion_id: int | None = next((s.id for s in existing if s.name == "bastion"), None)
+    if "bastion" not in existing_names:
+        bastion = await create_server(session, _bastion(), user.id)
+        bastion_id = bastion.id
+        logger.info("Seeded demo bastion (id=%s)", bastion_id)
+
+    if "internal-app" not in existing_names and bastion_id is not None:
+        await create_server(session, _internal(bastion_id), user.id)
+        logger.info("Seeded internal-app via bastion id=%s", bastion_id)
+
+    # Seed a few example snippets so the toolbar isn't empty
+    existing_snippets = (
+        await session.execute(select(Snippet).where(Snippet.user_id == user.id))
+    ).scalars().all()
+    if not existing_snippets:
+        for name, cmd, desc in [
+            ("ls -lah", "ls -lah", "List files (long, human sizes, hidden)"),
+            ("disk usage", "df -h", "Mounted filesystems with sizes"),
+            ("top procs", "ps aux --sort=-%mem | head", "Top memory-consuming processes"),
+            ("uptime", "uptime && uname -a", "Uptime + kernel info"),
+        ]:
+            session.add(Snippet(name=name, command=cmd, description=desc, user_id=user.id))
+        await session.commit()
+        logger.info("Seeded %d demo snippets", 4)

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/files/pool.py

@@ -25,6 +25,7 @@ class _PoolEntry:
     client: SFTPClient
     last_used: float = field(default_factory=time.monotonic)
     in_use: int = 0
+    jump_conn: asyncssh.SSHClientConnection | None = None
 
 
 class SFTPPool:
@@ -63,6 +64,7 @@ class SFTPPool:
         username: str,
         password: str | None = None,
         private_key: str | None = None,
+        jump_kwargs: dict[str, object] | None = None,
     ) -> SFTPClient:
         key = self._key(server_id)
         if key not in self._locks:
@@ -96,10 +98,15 @@ class SFTPPool:
             elif password:
                 kwargs["password"] = password
 
+            jump_conn: asyncssh.SSHClientConnection | None = None
+            if jump_kwargs:
+                jump_conn = await asyncssh.connect(**jump_kwargs)  # type: ignore[arg-type]
+                kwargs["tunnel"] = jump_conn
+
             conn = await asyncssh.connect(**kwargs)  # type: ignore[arg-type]
             client = SFTPClient(conn)
             await client.connect()
-            entry = _PoolEntry(conn=conn, client=client, in_use=1)
+            entry = _PoolEntry(conn=conn, client=client, in_use=1, jump_conn=jump_conn)
             self._pool[key] = entry
             logger.info("SFTP pool: new connection to %s:%s (server_id=%s)", hostname, port, server_id)
             return client
@@ -120,6 +127,11 @@ class SFTPPool:
             entry.conn.close()
         except Exception:
             pass
+        if entry.jump_conn is not None:
+            try:
+                entry.jump_conn.close()
+            except Exception:
+                pass
 
     async def _cleanup_loop(self) -> None:
         while True:

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/files/routes.py

@@ -25,7 +25,7 @@ from webgate.files.models import (
 from webgate.files.pool import sftp_pool
 from webgate.files.sftp_service import SFTPClient, validate_path
 from webgate.servers.models import Server
-from webgate.servers.service import get_server, get_server_credentials
+from webgate.servers.service import get_server, get_server_credentials, resolve_jump_creds
 
 router = APIRouter(prefix="/api/files", tags=["files"])
 
@@ -88,6 +88,7 @@ async def _sftp(
     allowed_paths = _get_allowed_paths(server)
     read_only = server.sftp_read_only
     password, private_key = get_server_credentials(server)
+    jump_kwargs = await resolve_jump_creds(session, server)
     try:
         client = await sftp_pool.acquire(
             server_id,
@@ -96,6 +97,7 @@ async def _sftp(
             username=server.username,
             password=password,
             private_key=private_key,
+            jump_kwargs=jump_kwargs,
         )
         yield client, allowed_paths, read_only
     finally:

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/servers/models.py

@@ -25,6 +25,9 @@ class Server(Base):
     sftp_enabled: Mapped[bool] = mapped_column(Boolean, default=True)
     sftp_allowed_paths: Mapped[str] = mapped_column(Text, default="[]")  # JSON array of paths
     sftp_read_only: Mapped[bool] = mapped_column(Boolean, default=False)
+    jump_via_id: Mapped[int | None] = mapped_column(
+        Integer, ForeignKey("servers.id"), nullable=True
+    )
     last_connected_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
     created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
     user_id: Mapped[int] = mapped_column(Integer, ForeignKey("users.id"))
@@ -45,6 +48,7 @@ class ServerCreate(BaseModel):
     sftp_enabled: bool = True
     sftp_allowed_paths: list[str] = []
     sftp_read_only: bool = False
+    jump_via_id: int | None = None
 
 
 class ServerUpdate(BaseModel):
@@ -62,6 +66,7 @@ class ServerUpdate(BaseModel):
     sftp_enabled: bool | None = None
     sftp_allowed_paths: list[str] | None = None
     sftp_read_only: bool | None = None
+    jump_via_id: int | None = None
 
 
 class ServerOut(BaseModel):
@@ -78,6 +83,7 @@ class ServerOut(BaseModel):
     sftp_enabled: bool
     sftp_allowed_paths: list[str]
     sftp_read_only: bool
+    jump_via_id: int | None = None
     last_connected_at: datetime | None
     created_at: datetime
 

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/servers/routes.py

@@ -154,7 +154,7 @@ async def test_connectivity(
     server = await get_server(session, server_id, current_user.id, **_user_kwargs(current_user))
     if not server:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Server not found")
-    success, message = await test_server_connectivity(server)
+    success, message = await test_server_connectivity(server, session)
     if success:
         await update_last_connected(session, server)
     return {"success": success, "message": message}

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/servers/service.py

@@ -53,6 +53,7 @@ def server_to_out(server: Server) -> ServerOut:
         sftp_enabled=server.sftp_enabled,
         sftp_allowed_paths=_paths_from_json(server.sftp_allowed_paths),
         sftp_read_only=server.sftp_read_only,
+        jump_via_id=server.jump_via_id,
         last_connected_at=server.last_connected_at,
         created_at=server.created_at,
     )
@@ -125,6 +126,7 @@ async def create_server(session: AsyncSession, data: ServerCreate, user_id: int)
         sftp_enabled=data.sftp_enabled,
         sftp_allowed_paths=_tags_to_json(data.sftp_allowed_paths),
         sftp_read_only=data.sftp_read_only,
+        jump_via_id=data.jump_via_id,
         user_id=user_id,
     )
     session.add(server)
@@ -166,6 +168,8 @@ async def update_server(
         server.sftp_allowed_paths = _tags_to_json(data.sftp_allowed_paths)
     if data.sftp_read_only is not None:
         server.sftp_read_only = data.sftp_read_only
+    if data.jump_via_id is not None:
+        server.jump_via_id = data.jump_via_id or None  # 0 means "clear"
     await session.commit()
     await session.refresh(server)
     return server
@@ -176,7 +180,9 @@ async def delete_server(session: AsyncSession, server: Server) -> None:
     await session.commit()
 
 
-async def test_server_connectivity(server: Server) -> tuple[bool, str]:
+async def test_server_connectivity(
+    server: Server, session: AsyncSession | None = None
+) -> tuple[bool, str]:
     password = decrypt_value(server.encrypted_password) if server.encrypted_password else None
     private_key_str = (
         decrypt_value(server.encrypted_private_key) if server.encrypted_private_key else None
@@ -193,12 +199,25 @@ async def test_server_connectivity(server: Server) -> tuple[bool, str]:
     elif password:
         kwargs["password"] = password
 
+    jump_conn = None
+    if session is not None:
+        jump_kwargs = await resolve_jump_creds(session, server)
+        if jump_kwargs:
+            try:
+                jump_conn = await asyncssh.connect(**jump_kwargs)  # type: ignore[arg-type]
+                kwargs["tunnel"] = jump_conn
+            except Exception as e:
+                return False, f"Jump host failed: {e}"
+
     try:
         conn = await asyncssh.connect(**kwargs)  # type: ignore[arg-type]
         conn.close()
-        return True, "Connection successful"
+        return True, "Connection successful" + (" (via jump host)" if jump_conn else "")
     except Exception as e:
         return False, str(e)
+    finally:
+        if jump_conn is not None:
+            jump_conn.close()
 
 
 async def update_last_connected(session: AsyncSession, server: Server) -> None:
@@ -219,6 +238,35 @@ async def list_groups(
     return [row[0] for row in result.all()]
 
 
+async def resolve_jump_creds(
+    session: AsyncSession, server: Server
+) -> dict[str, object] | None:
+    """If `server` has a jump_via_id, return connect kwargs for the bastion.
+
+    Returns None when no jump host is configured. Cycles are silently broken
+    (server pointing to itself, or to its own jump, etc.) by following at most
+    one hop.
+    """
+    if server.jump_via_id is None or server.jump_via_id == server.id:
+        return None
+    stmt = select(Server).where(Server.id == server.jump_via_id)
+    jump = (await session.execute(stmt)).scalar_one_or_none()
+    if jump is None:
+        return None
+    password, private_key = get_server_credentials(jump)
+    kwargs: dict[str, object] = {
+        "host": jump.hostname,
+        "port": jump.port,
+        "username": jump.username,
+        "known_hosts": None,
+    }
+    if private_key:
+        kwargs["client_keys"] = [asyncssh.import_private_key(private_key)]
+    elif password:
+        kwargs["password"] = password
+    return kwargs
+
+
 def get_server_credentials(server: Server) -> tuple[str | None, str | None]:
     password = decrypt_value(server.encrypted_password) if server.encrypted_password else None
     private_key = (

webgate-0.3.0/src/webgate/snippets/models.py

@@ -0,0 +1,34 @@
+from datetime import datetime
+
+from pydantic import BaseModel
+from sqlalchemy import DateTime, ForeignKey, Integer, String, Text, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from webgate.db.engine import Base
+
+
+class Snippet(Base):
+    __tablename__ = "snippets"
+
+    id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
+    name: Mapped[str] = mapped_column(String(255))
+    command: Mapped[str] = mapped_column(Text)
+    description: Mapped[str] = mapped_column(Text, default="")
+    user_id: Mapped[int] = mapped_column(Integer, ForeignKey("users.id"))
+    created_at: Mapped[datetime] = mapped_column(DateTime, server_default=func.now())
+
+
+class SnippetCreate(BaseModel):
+    name: str
+    command: str
+    description: str = ""
+
+
+class SnippetOut(BaseModel):
+    id: int
+    name: str
+    command: str
+    description: str
+    created_at: datetime
+
+    model_config = {"from_attributes": True}

webgate-0.3.0/src/webgate/snippets/routes.py

@@ -0,0 +1,45 @@
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from webgate.auth.models import UserOut
+from webgate.auth.routes import get_current_user
+from webgate.db.engine import get_session
+from webgate.snippets.models import Snippet, SnippetCreate, SnippetOut
+
+router = APIRouter(prefix="/api/snippets", tags=["snippets"])
+
+SessionDep = Annotated[AsyncSession, Depends(get_session)]
+CurrentUserDep = Annotated[UserOut, Depends(get_current_user)]
+
+
+@router.get("", response_model=list[SnippetOut])
+async def list_snippets(session: SessionDep, user: CurrentUserDep) -> list[Snippet]:
+    stmt = select(Snippet).where(Snippet.user_id == user.id).order_by(Snippet.name)
+    result = await session.execute(stmt)
+    return list(result.scalars().all())
+
+
+@router.post("", response_model=SnippetOut, status_code=status.HTTP_201_CREATED)
+async def create_snippet(
+    body: SnippetCreate, session: SessionDep, user: CurrentUserDep
+) -> Snippet:
+    snippet = Snippet(
+        name=body.name, command=body.command, description=body.description, user_id=user.id
+    )
+    session.add(snippet)
+    await session.commit()
+    await session.refresh(snippet)
+    return snippet
+
+
+@router.delete("/{snippet_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_snippet(snippet_id: int, session: SessionDep, user: CurrentUserDep) -> None:
+    stmt = select(Snippet).where(Snippet.id == snippet_id, Snippet.user_id == user.id)
+    snippet = (await session.execute(stmt)).scalar_one_or_none()
+    if snippet is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Snippet not found")
+    await session.delete(snippet)
+    await session.commit()

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/static/index.html

@@ -316,6 +316,7 @@ window._showToastImpl = function(message, type) {
                             <div class="srv-host">
                                 <span x-text="srv.username + '@' + srv.hostname + ':' + srv.port"></span>
                                 <span x-show="srv.auth_method==='key'" style="color:#3fb950;margin-left:4px" title="Key auth">&#128273;</span>
+                                <span x-show="srv.jump_via_id" style="color:#a78bfa;margin-left:4px" :title="'Via ' + (servers.find(s => s.id === srv.jump_via_id)?.name || 'jump host')">&#8634;</span>
                             </div>
                             <span x-show="srv.group" class="srv-group" x-text="srv.group"></span>
                             <div class="fz-srv-actions">
@@ -349,7 +350,16 @@ window._showToastImpl = function(message, type) {
             <div x-show="activeTabId===tab.id && view!=='dashboard'" class="fz-flex-col">
 
                 <!-- ---- Terminal tab ---- -->
-                <div x-show="tab.type==='terminal'" style="flex:1;min-height:0" :id="tab.id"></div>
+                <div x-show="tab.type==='terminal'" style="flex:1;min-height:0;display:flex;flex-direction:column">
+                    <div style="padding:4px 8px;background:var(--bg-secondary);border-bottom:1px solid var(--border);display:flex;gap:4px;align-items:center;flex-wrap:wrap">
+                        <span style="font-size:11px;color:var(--text-muted);font-weight:600;margin-right:4px">Snippets:</span>
+                        <template x-for="s in snippets" :key="s.id">
+                            <button @click="runSnippet(tab, s)" @contextmenu.prevent="confirmDeleteSnippet(s)" class="fz-btn" style="font-size:11px;padding:2px 8px" :title="(s.description || s.command) + ' (right-click to delete)'" x-text="s.name"></button>
+                        </template>
+                        <button @click="promptNewSnippet()" class="fz-btn" style="font-size:11px;padding:2px 8px" title="Create new snippet">+</button>
+                    </div>
+                    <div style="flex:1;min-height:0" :id="tab.id"></div>
+                </div>
 
                 <!-- ---- Split tab (terminal + files) ---- -->
                 <div x-show="tab.type==='split'" style="flex:1;display:flex;min-height:0">
@@ -532,6 +542,13 @@ window._showToastImpl = function(message, type) {
                 </div>
                 <label>Description</label>
                 <input type="text" x-model="serverForm.description" placeholder="Primary web server">
+                <label>Jump Via (bastion / SSH proxy)</label>
+                <select x-model.number="serverForm.jump_via_id">
+                    <option :value="null">— direct (no jump) —</option>
+                    <template x-for="s in servers.filter(x => x.id !== editingServerId)" :key="s.id">
+                        <option :value="s.id" x-text="s.name + ' (' + s.hostname + ')'"></option>
+                    </template>
+                </select>
                 <!-- Access Control -->
                 <div style="margin-top:14px;padding-top:12px;border-top:1px solid var(--border)">
                     <label style="font-size:12px;font-weight:600;color:var(--text-primary);margin-bottom:8px">Access Control</label>
@@ -817,6 +834,7 @@ function app() {
     return {
         theme: localStorage.getItem('webgate_theme') || 'dark',
         demoMode: false,
+        snippets: [],
         uploadProgress: { active: false, percent: 0, fileName: '', total: 0, loaded: 0 },
         token: localStorage.getItem('webgate_token') || '',
         currentUser: null, username: '', password: '',
@@ -833,7 +851,7 @@ function app() {
         servers: [], groups: [], selectedGroup: '', searchQuery: '',
         selectedServerId: null,
         showServerModal: false, editingServerId: null, testingServerId: null,
-        serverForm: { name: '', hostname: '', port: 22, username: '', auth_method: 'password', password: '', private_key: '', group: '', tagsStr: '', description: '' },
+        serverForm: { name: '', hostname: '', port: 22, username: '', auth_method: 'password', password: '', private_key: '', group: '', tagsStr: '', description: '', jump_via_id: null },
         tabs: [], activeTabId: null,
         logMessages: [],
         serverStatuses: {},
@@ -893,7 +911,7 @@ function app() {
             if (this.token) {
                 await this.fetchMe();
                 if (this.currentUser?.must_change_password) return;
-                await this.loadServers(); await this.loadGroups(); await this.loadStatuses();
+                await this.loadServers(); await this.loadGroups(); await this.loadStatuses(); await this.loadSnippets();
                 setInterval(() => this.loadStatuses(), 30000);
                 this._restoreTabs();
             }
@@ -993,16 +1011,33 @@ function app() {
 
         // Servers
         async loadServers() { try { let url = '/api/servers'; if (this.searchQuery) url += `?search=${encodeURIComponent(this.searchQuery)}`; this.servers = await this.apiCall(url); } catch (e) { this.showToast(e.message, 'error'); } },
+        async loadSnippets() { try { this.snippets = await this.apiCall('/api/snippets'); } catch {} },
+        async promptNewSnippet() {
+            const name = prompt('Snippet name:'); if (!name) return;
+            const command = prompt('Command (will be sent to terminal + Enter):'); if (!command) return;
+            try { await this.apiCall('/api/snippets', { method: 'POST', body: JSON.stringify({ name, command, description: '' }) }); await this.loadSnippets(); this.showToast('Snippet created'); }
+            catch (e) { this.showToast(e.message, 'error'); }
+        },
+        async confirmDeleteSnippet(s) {
+            if (!confirm(`Delete snippet "${s.name}"?`)) return;
+            try { await this.apiCall(`/api/snippets/${s.id}`, { method: 'DELETE' }); await this.loadSnippets(); this.showToast('Snippet deleted'); }
+            catch (e) { this.showToast(e.message, 'error'); }
+        },
+        runSnippet(tab, s) {
+            if (!tab._ws || tab._ws.readyState !== WebSocket.OPEN) { this.showToast('Terminal not connected', 'error'); return; }
+            tab._ws.send(s.command + '\r');
+            this.log('cmd', `Sent snippet "${s.name}"`);
+        },
         async loadStatuses() { try { this.serverStatuses = await this.apiCall('/api/servers/status'); } catch {} },
         async loadGroups() { try { this.groups = await this.apiCall('/api/servers/groups'); } catch {} },
-        resetServerForm() { this.editingServerId = null; this.serverForm = { name: '', hostname: '', port: 22, username: '', auth_method: 'password', password: '', private_key: '', keyFileName: '', group: '', tagsStr: '', description: '', ssh_enabled: true, sftp_enabled: true, sftp_read_only: false, sftp_allowed_paths_str: '' }; },
+        resetServerForm() { this.editingServerId = null; this.serverForm = { name: '', hostname: '', port: 22, username: '', auth_method: 'password', password: '', private_key: '', keyFileName: '', group: '', tagsStr: '', description: '', ssh_enabled: true, sftp_enabled: true, sftp_read_only: false, sftp_allowed_paths_str: '', jump_via_id: null }; },
         loadKeyFile(event) {
             const file = event.target.files?.[0]; if (!file) return;
             const reader = new FileReader();
             reader.onload = (e) => { this.serverForm.private_key = e.target.result; this.serverForm.keyFileName = file.name; };
             reader.readAsText(file); event.target.value = '';
         },
-        editServer(srv) { this.editingServerId = srv.id; this.serverForm = { name: srv.name, hostname: srv.hostname, port: srv.port, username: srv.username, auth_method: srv.auth_method, password: '', private_key: '', keyFileName: '', group: srv.group, tagsStr: (srv.tags || []).join(', '), description: srv.description, ssh_enabled: srv.ssh_enabled !== false, sftp_enabled: srv.sftp_enabled !== false, sftp_read_only: srv.sftp_read_only || false, sftp_allowed_paths_str: (srv.sftp_allowed_paths || []).join('\n') }; this.showServerModal = true; },
+        editServer(srv) { this.editingServerId = srv.id; this.serverForm = { name: srv.name, hostname: srv.hostname, port: srv.port, username: srv.username, auth_method: srv.auth_method, password: '', private_key: '', keyFileName: '', group: srv.group, tagsStr: (srv.tags || []).join(', '), description: srv.description, ssh_enabled: srv.ssh_enabled !== false, sftp_enabled: srv.sftp_enabled !== false, sftp_read_only: srv.sftp_read_only || false, sftp_allowed_paths_str: (srv.sftp_allowed_paths || []).join('\n'), jump_via_id: srv.jump_via_id || null }; this.showServerModal = true; },
         async saveServer() {
             const tags = this.serverForm.tagsStr.split(',').map(t => t.trim()).filter(Boolean);
             const sftp_allowed_paths = (this.serverForm.sftp_allowed_paths_str || '').split('\n').map(p => p.trim()).filter(Boolean);

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/terminal/routes.py

@@ -6,7 +6,12 @@ from webgate.audit.service import log_action
 from webgate.auth.models import UserOut
 from webgate.auth.service import get_user_by_id
 from webgate.db.engine import async_session_factory
-from webgate.servers.service import get_server, get_server_credentials, update_last_connected
+from webgate.servers.service import (
+    get_server,
+    get_server_credentials,
+    resolve_jump_creds,
+    update_last_connected,
+)
 from webgate.terminal.ws_handler import authenticate_websocket, handle_terminal_ws
 
 router = APIRouter(tags=["terminal"])
@@ -86,6 +91,7 @@ async def ws_terminal_server(ws: WebSocket, server_id: int) -> None:
             return
 
         password, private_key = get_server_credentials(server)
+        jump_kwargs = await resolve_jump_creds(session, server)
 
         await ws.accept()
 
@@ -111,4 +117,5 @@ async def ws_terminal_server(ws: WebSocket, server_id: int) -> None:
         private_key=private_key,
         cols=cols,
         rows=rows,
+        jump_kwargs=jump_kwargs,
     )

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/terminal/ssh_session.py

@@ -18,6 +18,8 @@ class SSHSession:
     username: str
     password: str | None = None
     private_key: str | None = None
+    jump_kwargs: dict[str, Any] | None = None  # connect kwargs for a bastion (optional)
+    _jump_conn: asyncssh.SSHClientConnection | None = field(default=None, repr=False)
     _conn: asyncssh.SSHClientConnection | None = field(default=None, repr=False)
     _process: asyncssh.SSHClientProcess[str] | None = field(default=None, repr=False)
     _closed: bool = field(default=False, repr=False)
@@ -34,6 +36,10 @@ class SSHSession:
         elif self.password:
             connect_kwargs["password"] = self.password
 
+        if self.jump_kwargs:
+            self._jump_conn = await asyncssh.connect(**self.jump_kwargs)
+            connect_kwargs["tunnel"] = self._jump_conn
+
         self._conn = await asyncssh.connect(**connect_kwargs)
         self._process = await self._conn.create_process(
             term_type="xterm-256color",
@@ -77,6 +83,10 @@ class SSHSession:
             self._conn.close()
             with contextlib.suppress(Exception):
                 await asyncio.wait_for(self._conn.wait_closed(), timeout=2.0)
+        if self._jump_conn is not None:
+            self._jump_conn.close()
+            with contextlib.suppress(Exception):
+                await asyncio.wait_for(self._jump_conn.wait_closed(), timeout=2.0)
 
     @property
     def is_closed(self) -> bool:

{webgate-0.2.2 → webgate-0.3.0}/src/webgate/terminal/ws_handler.py

@@ -40,6 +40,7 @@ async def handle_terminal_ws(
     private_key: str | None = None,
     cols: int = 80,
     rows: int = 24,
+    jump_kwargs: dict[str, object] | None = None,
 ) -> None:
     session = SSHSession(
         host=host,
@@ -47,6 +48,7 @@ async def handle_terminal_ws(
         username=username,
         password=password,
         private_key=private_key,
+        jump_kwargs=jump_kwargs,
     )
 
     try:

webgate-0.2.2/src/webgate/demo.py

@@ -1,55 +0,0 @@
-"""Demo mode seeding: pre-populates the demo user and showcase servers.
-
-Activated when WEBGATE_DEMO_MODE=true. Idempotent — safe to call on every startup.
-"""
-
-from __future__ import annotations
-
-import json
-import logging
-
-from sqlalchemy.ext.asyncio import AsyncSession
-
-from webgate.auth.service import create_user, get_user_by_username
-from webgate.servers.models import ServerCreate
-from webgate.servers.service import create_server, list_servers
-
-logger = logging.getLogger(__name__)
-
-
-DEMO_USERNAME = "demo"
-DEMO_PASSWORD = "demo"
-
-# Servers pre-registered for the demo. Hostnames must be reachable from the
-# webgate container. In Fly.io they resolve via *.internal DNS.
-DEMO_SERVERS: list[ServerCreate] = [
-    ServerCreate(
-        name="demo-server",
-        hostname="127.0.0.1",
-        port=22,
-        username="demo",
-        password="demo",
-        group="demo",
-        tags=["demo", "debian"],
-        description="Sandbox SSH/SFTP server (debian). Try `ls`, `htop`, browse /home/demo.",
-        sftp_read_only=True,
-    ),
-]
-
-
-async def seed_demo(session: AsyncSession) -> None:
-    user = await get_user_by_username(session, DEMO_USERNAME)
-    if user is None:
-        user = await create_user(session, DEMO_USERNAME, DEMO_PASSWORD, is_admin=False)
-        user.must_change_password = False
-        user.allowed_groups = json.dumps(["demo"])
-        await session.commit()
-        logger.info("Created demo user (%s/%s)", DEMO_USERNAME, DEMO_PASSWORD)
-
-    existing = await list_servers(session, user.id, is_admin=True)
-    existing_names = {s.name for s in existing}
-    for srv in DEMO_SERVERS:
-        if srv.name in existing_names:
-            continue
-        await create_server(session, srv, user.id)
-        logger.info("Seeded demo server: %s -> %s:%s", srv.name, srv.hostname, srv.port)