Connect one private web application

Before you begin

Choose the machine that will run Gatehouse Connector. From that machine or its Docker network, confirm the private application is reachable by a stable hostname and port.

• Docker Engine 24+ and Compose v2
• Outbound DNS and HTTPS/WSS
• No inbound firewall opening
• HTTP or HTTPS target only

curl -I http://grafana:3000/
# Expect an HTTP response from the target application

Create the owner account

Open Create account, enter your name, work email, organization name, and a strong password. Registration creates a real owner account and an isolated organization workspace.

• Console routes require authentication
• Organization records are tenant-scoped
• Alpha limit: 2 connectors and 5 services

Download and enroll the connector

Open Connectors in the console, download the bundle, and generate a one-time enrollment token. The console gives you the relay URL, enrollment URL, and token.

unzip gatehouse-connector.zip -d gatehouse-connector
cd gatehouse-connector
cp .env.example .env
# Paste the three values shown in the Gatehouse console into .env

Start it on your server

Build and start the connector. The one-time token is exchanged for a long-lived random connector credential stored in the connector-data Docker volume.

• Look for enrollment accepted
• Look for tunnel connected
• Confirm the connector changes to Online in Gatehouse

docker compose up -d --build
docker compose logs -f connector

Register the exact private service

Open Services and add the application. Use the hostname as seen from inside the connector container. For a service on the Docker host, use host.docker.internal; for another container, attach both to a shared Docker network.

• Protocol: HTTP or HTTPS
• Target host and port
• Base path and optional health path
• Explicitly allowed methods

Name: Production Grafana
Connector: Office edge
Protocol: HTTP
Target host: grafana
Target port: 3000
Base path: /
Allowed methods: GET, POST

Verify reachability

Open the service detail and run Check reachability. The relay asks the enrolled connector to make the check from the private network. A failure here is a network or target configuration problem, not a visitor authorization problem.

• Confirm DNS inside the connector container
• Confirm target port
• Confirm health path returns 2xx or 3xx
• Review SSRF policy if using loopback

Grant and open access

Open Access grants, choose the service, enter the visitor email, allowed methods, grant duration, and maximum session duration. Send the generated URL to that same email identity.

• Visitor signs in or creates an account
• Access page shows exact authority
• Relay rechecks the grant for every stream
• Revocation blocks subsequent requests immediately