GHGatehousePublic alpha

Private web access · outbound connector · explicit grants

Open private web services securely from any browser.

Run one Gatehouse Connector on a server that can reach your private web application. Register the exact target, grant a named user access, and open it through Gatehouse without publishing the application or the surrounding network.

Real account registration Downloadable Docker connector Live private-service proxy Immediate revocation

The complete path

Server. Connector. Authorized browser.

This is the whole Gatehouse model. Nothing is discovered automatically and no surrounding subnet becomes accessible.

01

You already have a web app

Gatehouse starts with an HTTP or HTTPS application that is reachable from one machine in your private network.

http://grafana:3000
  • No public DNS required
  • No inbound firewall rule
  • Exact host and port only
02

Run the connector beside it

Download the connector bundle, paste the one-time enrollment values from your workspace, and start the container.

docker compose up -d --build
  • Outbound WSS to the relay
  • Credential stored locally
  • Automatic reconnect
03

Open it through Gatehouse

Register that exact target, grant a named user access, and send the generated browser URL.

gatehousebox.com/access/…
  • Identity and expiry checked
  • Methods explicitly allowed
  • Immediate revocation

Step 02 · run it on your server

A connector bundle you can actually download and operate.

The bundle contains the .NET connector source, Dockerfile, Compose definition, environment template, and operating instructions. The connector enrolls once, stores its long-lived credential in a private Docker volume, and reconnects automatically.

Required egress
HTTPS/WSS to relay.gatehousebox.com
Inbound ports
None
Private target
One registered HTTP/HTTPS host and port
gatehouse-connector

$ cp .env.example .env

$ docker compose up -d --build

enrolled connector office-edge

tunnel connected · epoch 1842

service grafana:3000 reachable

Step 03 · open the private application

The visitor sees exactly what is being authorized.

Before Gatehouse starts a session, the access page names the organization, private service, signed-in identity, permitted HTTP methods, and expiry. The relay checks that authority again for every request stream.

Named identityNo anonymous access linkBounded durationGrant and session expiryReviewable recordSafe stream and audit metadata
gatehousebox.com/access/acme-grafana
AC
Acme InfrastructureProduction Grafana
Identityalex@acme.example
MethodsGET · POST
ExpiresToday, 18:00

Authorized by a time-bound Gatehouse grant

Operator console

One workspace for the entire access lifecycle.

Create account
Acme InfrastructureAccess operations
All systems operational
Connectors online2 / 2office-edge · cloud-vpc
Services reachable4 / 51 requires attention
Active sessions32 users · 4 streams
Denied requests7last 24 hours
Private serviceConnectorPolicyState
Production Grafanaoffice-edgeGET · POSTReachable
Inventory Admincloud-vpcGET · POST · PATCHReachable
Staging Consolecloud-vpcGETDegraded

Security model

Narrow authority, independently enforced.

Gatehouse is not a VPN or an unrestricted reverse proxy. It grants one identity access to one registered service under one explicit policy.

Deny by default

Only explicitly registered protocols, hosts, ports, paths, and methods are eligible.

One-time enrollment

The bootstrap token is exchanged once and cannot reconnect a connector.

Outbound-only tunnel

The connector initiates the persistent encrypted connection. It exposes no public listener.

Immediate revocation

The relay rechecks durable state and denies subsequent streams as soon as authority is revoked.

57 standards and security references mapped

Read what Gatehouse implements directly, inherits from its platforms, treats as compatibility guidance, or has not yet shipped.

Open standards registry

Pricing

Free during public alpha.

Use the complete connector, service, grant, browser gateway, revocation, and audit flow without billing.

Available now

Alpha

Free
  • 1 organization
  • 2 connectors
  • 5 private services
  • Temporary browser access
  • Basic audit history
Create account
Coming soon

Professional

For operating teams
  • Expanded connector fleet
  • Policy templates
  • Longer audit retention
  • Notifications and API access
Coming soon

MSP

For client operations
  • Multiple client organizations
  • Delegated administration
  • Customer branding
  • Fleet-wide policy controls