QuoxBastion: Fleet Management

QuoxBastion is your fleet's single source of truth. A lightweight Go binary on your bastion host that provides host registry, secure SSH command execution, and full audit logging.

What is QuoxBastion?

QuoxBastion is your fleet's address book and command center. It runs on your bastion (jump) host and knows about every server in your infrastructure - their IPs, groups, and how to reach them.

Think of it this way: Imagine you manage a large campus with dozens of buildings. QuoxBastion is like having a master key and a detailed map. You know exactly which door to open, and you can send maintenance crews to any building instantly.

Without QuoxBastion, managing hosts is scattered - some in SSH config, some in spreadsheets, some only in your head. With QuoxBastion, there's one source of truth that everyone (and every agent) can query.

Why QuoxBastion Changes Everything

Before QuoxBastion

• Host IPs scattered across SSH configs, notes, and memory
• Manual SSH connections to each host
• No central visibility of your fleet
• Hard to run commands across multiple hosts
• No audit trail of who did what

After QuoxBastion

• Single registry - All hosts in one place
• Instant access - API-driven command execution
• Fleet visibility - See all hosts, groups, and status
• Batch operations - Run commands on 50 hosts at once
• Full audit - Every command logged with AEE envelopes

Architecture: simple and effective

        Your Browser (QuoxCORE Dashboard)
                    |
                    v
        +------------------------+
        |   QuoxBastion Plugin   |  <-- UI in QuoxCORE
        +------------------------+
                    |
                    v
        +------------------------+
        |  QuoxBastion Backend   |  <-- Go binary on bastion
        |  (bastion host:9850)   |
        +------------------------+
               /    |    \
          SSH /     |     \ SSH
             /      |      \
            v       v       v
       nw-web-01  nw-hv-01   nw-monitor-01     <-- Your fleet

The flow:

1. Register hosts - Add hosts to the registry with their IPs, groups, and metadata
2. Query the registry - CIPHER, DAEDALUS, or you can ask "which hosts are in the docker group?"
3. Execute commands - Send commands to one host or many, results stream back
4. Audit everything - Every action logged with timestamp, user, and full output

Getting Started: 5 Minutes to Fleet Control

Step 1: Install on Your Bastion Host

# Clone and build
git clone https://github.com/quoxai/quoxbastion.git
cd quoxbastion
go build -o bastion ./cmd/bastion

# Quick start (for testing)
./bastion serve --config configs/bastion.example.yaml

# Production install
sudo ./deploy/install.sh
sudo systemctl enable --now bastion

Step 2: Add Your First Host

# Via CLI
bastion host add nw-web-01 --ip 10.20.0.101 --group docker

# Via API
curl -X POST http://localhost:9850/api/v1/hosts \
  -H "Content-Type: application/json" \
  -d '{"id":"nw-web-01","ip":"10.20.0.101","group":"docker"}'

Step 3: Execute a Command

# Single host
bastion exec nw-web-01 "uptime"

# All hosts in a group
bastion exec --group docker "docker ps"

# Via API
curl -X POST http://localhost:9850/api/v1/exec \
  -H "Content-Type: application/json" \
  -d '{"targets":["nw-web-01"],"command":"df -h"}'

Step 4: Enable in QuoxCORE

1. Go to Settings → Plugins
2. Find QuoxBastion Fleet Manager
3. Click Enable
4. Configure the backend URL (default: bastion host:9850)

Agent Integration: CIPHER and DAEDALUS

When you ask Quox about your infrastructure, agents use QuoxBastion automatically:

You: "Check disk space on all docker hosts"

What happens:

1. CIPHER receives the query
2. CIPHER calls QuoxBastion: "List hosts in group 'docker'"
3. QuoxBastion returns: nw-web-01, nw-db-01, nw-worker-01
4. CIPHER calls QuoxBastion: "Execute 'df -h' on these hosts"
5. QuoxBastion runs the command via SSH
6. Results stream back to your dashboard

All of this happens in seconds, fully audited.

Comparison: QuoxBastion vs QuoxAgent

Use together: QuoxBastion knows about your hosts. QuoxAgent provides agents on your hosts. They complement each other perfectly.

Use Cases

Infrastructure Teams

• Maintain a single source of truth for all servers
• Run compliance commands across entire fleet
• Audit every administrative action

DevOps Engineers

• Deploy configurations to host groups
• Check service status across environments
• Quickly identify which hosts need attention

Security Teams

• Run security scans on all hosts
• Check patch levels fleet-wide
• Full audit trail for compliance

title: "QuoxBastion fleet registry and SSH execution" slug: "bastion" section: "Core Systems" order: 5 description: "QuoxBastion runs on your bastion host as a host registry and audit-logged SSH execution layer, covering CLI usage, the REST API and security controls." icon: "B" lead: "Your fleet's single source of truth." keywords: "bastion, fleet, ssh, host registry, audit" status: stable

QuoxBastion

Your Fleet's Single Source of Truth

QuoxBastion is a lightweight fleet management system that runs on your bastion host. It provides a centralized registry for all your infrastructure hosts and enables secure remote command execution with full audit trails.

Overview

┌─────────────────────────────────────────────────────┐
│                  QuoxCORE Dashboard                 │
│               (QuoxBastion Plugin UI)               │
└────────────────────────┬────────────────────────────┘
                         │ REST API
                         ▼
┌─────────────────────────────────────────────────────┐
│            QuoxBastion Backend (port 9850)          │
│           Go binary on bastion host                 │
│  ┌───────────────────────────────────────────────┐  │
│  │ Host Registry │ SSH Exec │ Key Mgmt │ Audit   │  │
│  └───────────────────────────────────────────────┘  │
└────────────────────────┬────────────────────────────┘
                         │ SSH (port 22)
                         ▼
┌─────────────────────────────────────────────────────┐
│                    Fleet Hosts                      │
│  nw-web-01, nw-db-01, nw-hv-01, nw-monitor-01, nas01, ...     │
└─────────────────────────────────────────────────────┘

Features

Host Registry

Maintain a single source of truth for all your infrastructure:

• Unique IDs and aliases - Reference hosts by ID (nw-web-01) or alias (dock01, d01)
• Group organization - Organize hosts into groups (docker, proxmox, monitoring)
• Tagging - Add tags for flexible filtering (production, critical, containers)
• Metadata - Store OS, architecture, location, and custom fields

Remote Execution

Execute commands securely across your fleet:

• Single host - bastion exec nw-web-01 "df -h"
• Group execution - bastion exec --group docker "docker ps"
• Parallel execution - Commands run simultaneously on multiple hosts
• Streaming output - See results in real-time

Audit Trail

Every command is logged with full context:

• Timestamp and duration
• User/agent who executed
• Command and parameters
• Full stdout/stderr output
• AEE envelope for compliance

Installation

On the Bastion Host

# Clone the repository
git clone https://github.com/quoxai/quoxbastion.git
cd quoxbastion

# Build
go build -o bastion ./cmd/bastion

# Install
sudo ./deploy/install.sh

# Configure
sudo nano /etc/bastion/bastion.yaml

# Start
sudo systemctl enable --now bastion

Configuration

# /etc/bastion/bastion.yaml
server:
  listen: "0.0.0.0:9850"

registry:
  path: /var/lib/bastion/hosts.json

ssh:
  default_user: control
  key_dir: /etc/bastion/keys
  command_timeout: 60s

audit:
  enabled: true
  aee_enabled: true

CLI Usage

# Start the server
bastion serve --config /etc/bastion/bastion.yaml

# Host management
bastion host list
bastion host add nw-web-01 --ip 10.20.0.101 --group docker
bastion host show nw-web-01
bastion host remove nw-web-01

# Execute commands
bastion exec nw-web-01 "uptime"
bastion exec --group docker "docker ps"
bastion exec --all "df -h"

# Status
bastion health
bastion status

API Reference

Hosts

Groups

Execution

Example: Execute Command

curl -X POST http://bastion:9850/api/v1/exec \
  -H "Content-Type: application/json" \
  -d '{
    "targets": ["nw-web-01", "nw-db-01"],
    "command": "docker ps --format \"table {{.Names}}\t{{.Status}}\"",
    "timeout": 30
  }'

Agent Integration

QuoxBastion integrates seamlessly with CIPHER and NOVA agents:

• CIPHER uses QuoxBastion for network diagnostics and connectivity tests
• NOVA uses QuoxBastion for deployment commands and container management

When you ask "check disk space on docker hosts", CIPHER will:

1. Query QuoxBastion for hosts in the "docker" group
2. Execute df -h via the /exec endpoint
3. Return formatted results

Data Model

Host Schema

{
  "id": "nw-web-01",
  "ip": "10.20.0.101",
  "fqdn": "nw-web-01.internal.example.com",
  "aliases": ["dock01", "d01"],
  "group": "docker",
  "tags": ["production", "containers"],
  "ssh": {
    "port": 22,
    "user": "control",
    "key_id": "default"
  },
  "metadata": {
    "os": "ubuntu-22.04",
    "arch": "amd64",
    "cores": "8",
    "ram_gb": "32"
  },
  "status": {
    "state": "active",
    "health": "healthy",
    "last_seen": "2026-01-31T12:00:00Z"
  }
}

Security

• SSH Keys - Uses key-based authentication only
• Token Auth - API requires bearer token
• Command Filtering - Dangerous commands can be blocked
• Audit Everything - Full AEE envelope logging
• Network Isolation - Runs on bastion, only SSH outbound

Troubleshooting

Connection Refused

# Check if bastion is running
systemctl status bastion

# Check logs
journalctl -u bastion -f

Permission Denied

# Ensure SSH key is in place
ls -la /etc/bastion/keys/

# Test SSH manually
ssh -i /etc/bastion/keys/default [email protected]

Host Not Found

# List registered hosts
bastion host list

# Add missing host
bastion host add myhost --ip 10.20.0.100 --group mygroup