QuoxBastion: Fleet Management

QuoxBastion is your fleet's single source of truth. A lightweight Go binary on your bastion host that provides a host registry, SSH command execution with an optional approval gate, and an audit log of API commands.

What is QuoxBastion?

QuoxBastion is your fleet's address book and command center. It runs on your bastion (jump) host and knows about every server in your infrastructure - their IPs, groups, and how to reach them.

Think of it this way: Imagine you manage a large campus with dozens of buildings. QuoxBastion is like having a master key and a detailed map. You know exactly which door to open, and you can send maintenance crews to any building instantly.

Without QuoxBastion, managing hosts is scattered - some in SSH config, some in spreadsheets, some only in your head. With QuoxBastion, there's one source of truth that everyone (and every agent) can query.

Why QuoxBastion Changes Everything

Before QuoxBastion

• Host IPs scattered across SSH configs, notes, and memory
• Manual SSH connections to each host
• No central visibility of your fleet
• Hard to run commands across multiple hosts
• No audit trail of who did what

After QuoxBastion

• Single registry - All hosts in one place
• Instant access - API-driven command execution
• Fleet visibility - See all hosts, groups, and status
• Batch operations - Run one command across many hosts, ten at a time
• Audit log - Every API command logged, with AEE when connected to QuoxCORE

Architecture: simple and effective

        Your Browser (QuoxCORE Dashboard)
                    |
                    v
        +------------------------+
        |   QuoxBastion Plugin   |  <-- UI in QuoxCORE
        +------------------------+
                    |
                    v
        +------------------------+
        |  QuoxBastion Backend   |  <-- Go binary on bastion
        |  (bastion host:9850)   |
        +------------------------+
               /    |    \
          SSH /     |     \ SSH
             /      |      \
            v       v       v
       nw-web-01  nw-hv-01   nw-monitor-01     <-- Your fleet

The flow:

1. Register hosts - Add hosts to the registry with their IPs, groups, and metadata
2. Query the registry - CIPHER, DAEDALUS, or you can ask "which hosts are in the docker group?"
3. Execute commands - Send commands to one host or many, results stream back
4. Audit - Every API command is logged with time, sender, targets and the command

Getting Started: 5 Minutes to Fleet Control

Step 1: Install on Your Bastion Host

# Build from a QuoxBastion source checkout
cd quoxbastion
go build -o bastion ./cmd/bastion

# Quick start (for testing)
./bastion serve --config configs/bastion.example.yaml

# Production install
sudo ./deploy/install.sh
sudo systemctl enable --now bastion

Step 2: Add Your First Host

# Via CLI
bastion host add nw-web-01 --ip 10.20.0.101 --group docker

# Via API
curl -X POST http://localhost:9850/api/v1/hosts \
  -H "Authorization: Bearer $BASTION_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id":"nw-web-01","ip":"10.20.0.101","group":"docker"}'

Step 3: Execute a Command

# Single host
bastion exec nw-web-01 "uptime"

# All hosts in a group
bastion exec --group docker "docker ps"

# Via API
curl -X POST http://localhost:9850/api/v1/exec \
  -H "Authorization: Bearer $BASTION_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"targets":["nw-web-01"],"command":"df -h"}'

Step 4: Enable in QuoxCORE

1. Go to Settings → Plugins
2. Find QuoxBastion Fleet Manager
3. Click Enable
4. Point it at your QuoxBastion server. QuoxBastion Fleet Manager is a paid add-on; see the store.

Agent Integration: CIPHER and DAEDALUS

When you ask Quox about your infrastructure, agents use QuoxBastion automatically:

You: "Check disk space on all docker hosts"

What happens:

1. CIPHER receives the query
2. CIPHER calls QuoxBastion: "List hosts in group 'docker'"
3. QuoxBastion returns: nw-web-01, nw-db-01, nw-worker-01
4. CIPHER calls QuoxBastion: "Execute 'df -h' on these hosts"
5. QuoxBastion runs the command via SSH
6. Results stream back to your dashboard

Commands outside the read-only list wait for a person to approve them first, and every API command is logged.

Comparison: QuoxBastion vs QuoxAgent

Use together: QuoxBastion knows about your hosts. QuoxAgent provides agents on your hosts. They complement each other perfectly.

Use Cases

Infrastructure Teams

• Maintain a single source of truth for all servers
• Run compliance commands across entire fleet
• Audit every administrative action

DevOps Engineers

• Deploy configurations to host groups
• Check service status across environments
• Quickly identify which hosts need attention

Security Teams

• Run security scans on all hosts
• Check patch levels fleet-wide
• An audit log of API commands

title: "QuoxBastion fleet registry and SSH execution" slug: "bastion" section: "Core Systems" order: 5 description: "QuoxBastion runs on your bastion host as a host registry and audit-logged SSH execution layer, covering CLI usage, the REST API and security controls." icon: "B" lead: "Your fleet's single source of truth." keywords: "bastion, fleet, ssh, host registry, audit" status: beta

QuoxBastion

Your Fleet's Single Source of Truth

QuoxBastion is a lightweight fleet management system that runs on your bastion host. It provides a centralized registry for all your infrastructure hosts and enables remote command execution over SSH, with an audit log of the commands run through its API (see Audit below).

Overview

┌─────────────────────────────────────────────────────┐
│                  QuoxCORE Dashboard                 │
│               (QuoxBastion Plugin UI)               │
└────────────────────────┬────────────────────────────┘
                         │ REST API
                         ▼
┌─────────────────────────────────────────────────────┐
│            QuoxBastion Backend (port 9850)          │
│           Go binary on bastion host                 │
│  ┌───────────────────────────────────────────────┐  │
│  │ Host Registry │ SSH Exec │ Key Mgmt │ Audit   │  │
│  └───────────────────────────────────────────────┘  │
└────────────────────────┬────────────────────────────┘
                         │ SSH (port 22)
                         ▼
┌─────────────────────────────────────────────────────┐
│                    Fleet Hosts                      │
│  nw-web-01, nw-db-01, nw-hv-01, nw-monitor-01, nas01, ...     │
└─────────────────────────────────────────────────────┘

Features

Host Registry

Maintain a single source of truth for all your infrastructure:

• Unique IDs and aliases - Reference hosts by ID (nw-web-01) or alias (dock01, d01)
• Group organization - Organize hosts into groups (docker, proxmox, monitoring)
• Tags - Store tags on a host record
• Metadata - Store OS, architecture, location, and custom fields

Remote Execution

Execute commands securely across your fleet:

• Single host - bastion exec nw-web-01 "df -h"
• Group execution - bastion exec --group docker "docker ps"
• Parallel execution - Commands run simultaneously on multiple hosts
• Streaming output - See results in real-time

Audit Trail

Every command sent through the API is logged before it runs:

• Timestamp and duration
• User or agent who sent it
• Command and targets
• An AEE envelope, when QuoxBastion is connected to QuoxCORE

Command output is not stored in the audit log. Commands run with the local bastion exec CLI are not recorded in it.

Installation

On the Bastion Host

# From an early-access checkout
cd quoxbastion

# Build
go build -o bastion ./cmd/bastion

# Install
sudo ./deploy/install.sh

# Configure
sudo nano /etc/bastion/bastion.yaml

# Start
sudo systemctl enable --now bastion

Configuration

# /etc/bastion/bastion.yaml
server:
  listen: "0.0.0.0:9850"

registry:
  path: /var/lib/bastion/hosts.json

ssh:
  default_user: control
  key_dir: /etc/bastion/keys
  command_timeout: 60s

audit:
  enabled: true

CLI Usage

# Start the server
bastion serve --config /etc/bastion/bastion.yaml

# Host management
bastion host list
bastion host add nw-web-01 --ip 10.20.0.101 --group docker
bastion host show nw-web-01
bastion host remove nw-web-01

# Execute commands
bastion exec nw-web-01 "uptime"
bastion exec --group docker "docker ps"
bastion exec --all "df -h"

# Status
bastion health
bastion status

API Reference

Hosts

Groups

Execution

Example: Execute Command

curl -X POST http://bastion:9850/api/v1/exec \
  -H "Content-Type: application/json" \
  -d '{
    "targets": ["nw-web-01", "nw-db-01"],
    "command": "docker ps --format \"table {{.Names}}\t{{.Status}}\"",
    "timeout": 30
  }'

Agent Integration

QuoxBastion works with the CIPHER and DAEDALUS agents:

• CIPHER uses QuoxBastion for network diagnostics and connectivity tests
• DAEDALUS uses QuoxBastion for deployment commands and container management

When you ask "check disk space on docker hosts", CIPHER will:

1. Query QuoxBastion for hosts in the "docker" group
2. Execute df -h via the /exec endpoint
3. Return formatted results

Data Model

Host Schema

{
  "id": "nw-web-01",
  "ip": "10.20.0.101",
  "fqdn": "nw-web-01.internal.example.com",
  "aliases": ["dock01", "d01"],
  "group": "docker",
  "tags": ["production", "containers"],
  "ssh": {
    "port": 22,
    "user": "control",
    "key_id": "default"
  },
  "metadata": {
    "os": "ubuntu-22.04",
    "arch": "amd64",
    "cores": "8",
    "ram_gb": "32"
  },
  "status": {
    "state": "active",
    "health": "healthy",
    "last_seen": "2026-01-31T12:00:00Z"
  }
}

Security

• SSH Keys - Uses key-based authentication only
• Token Auth - API requires bearer token
• Strict host keys - Hosts are checked against a known_hosts file by default
• Approval gate - When configured, risky requests need a signed approval grant before they run. It is off until the operator sets approval.trusted_public_keys, and it fails closed if misconfigured. Configure it before giving agents access.
• Audit log - API commands are logged before they run (see Audit above)

QuoxBastion does not filter commands itself, and by default it listens on all interfaces over plain HTTP. Put it on a private network or behind TLS. Agents using SSH through QuoxCORE also send commands outside the read-only list to a person for approval first.

Troubleshooting

Connection Refused

# Check if bastion is running
systemctl status bastion

# Check logs
journalctl -u bastion -f

Permission Denied

# Ensure SSH key is in place
ls -la /etc/bastion/keys/

# Test SSH manually
ssh -i /etc/bastion/keys/default [email protected]

Host Not Found

# List registered hosts
bastion host list

# Add missing host
bastion host add myhost --ip 10.20.0.100 --group mygroup