QuoxBastion

Fleet management from your bastion host.

QuoxBastion is a lightweight fleet management system that runs on your bastion (jump) host. It provides a single source of truth for all infrastructure hosts, secure SSH-based command execution, and a complete audit trail.

What It Is

QuoxBastion is a Go binary that sits on your bastion host and turns it into a fleet management API. It maintains a registry of every host you manage, executes commands over SSH in parallel, and logs every action for compliance.

It uses your existing SSH infrastructure — no new agents to deploy on managed hosts. If you can SSH to a host from your bastion, QuoxBastion can manage it.

The Problem

Infrastructure teams accumulate hosts across environments — production, staging, development, monitoring, networking. Host information ends up scattered across:

• SSH config files on individual laptops
• Shared spreadsheets and wiki pages
• Ansible inventories that drift from reality
• Tribal knowledge in someone's head

When an incident happens at 3 AM, the on-call engineer wastes time figuring out which host to check, what its IP is, and how to reach it. Running a command across all production hosts requires writing a bash loop or Ansible playbook.

QuoxBastion solves this by providing a single, API-queryable registry of every host, with built-in parallel SSH execution.

Who It's For

Core Capabilities

Host Registry

Every host is registered with structured metadata:

{
  "id": "nw-web-01",
  "ip": "10.20.0.101",
  "fqdn": "nw-web-01.internal.example.com",
  "aliases": ["dock01", "d01"],
  "group": "docker",
  "tags": ["production", "containers"],
  "ssh": {
    "port": 22,
    "user": "control",
    "key_id": "default"
  },
  "metadata": {
    "os": "ubuntu-22.04",
    "arch": "amd64",
    "cores": "8",
    "ram_gb": "32"
  },
  "status": {
    "state": "active",
    "health": "healthy",
    "last_seen": "2026-02-04T12:00:00Z"
  }
}

Reference hosts by ID, alias, or group. Filter by tags. The registry is the canonical source for what exists in your infrastructure.

Parallel SSH Execution

Run commands on individual hosts, groups, or the entire fleet:

# Single host
bastion exec nw-web-01 "df -h"

# All hosts in a group
bastion exec --group docker "docker ps"

# Entire fleet
bastion exec --all "uptime"

Commands execute in parallel (configurable concurrency, default 10). Results stream back with per-host stdout, stderr, exit codes, and execution duration.

Audit Trail

Every command execution is logged with:

• Timestamp
• Authenticated user (token identity)
• Target hosts
• Command executed
• Full stdout and stderr
• Exit codes
• Execution duration

Audit records are AEE-compatible, so they integrate directly with QuoxCORE's audit system.

Security

• SSH key-based authentication only — no passwords
• Token-based API auth with constant-time comparison
• SSH host key verification (strict mode prevents MITM)
• Command sanitisation — blocks injection patterns (;, &&, |, `, $(, redirects)
• Systemd hardening — NoNewPrivileges, ProtectSystem=strict, PrivateTmp, MemoryMax=512M
• CORS whitelist — empty by default (no cross-origin access)

Tools Registry

QuoxBastion includes 9 built-in tools and supports user-defined tools ("Bastion Packs"):

Built-in Tools:

• Health Check — CPU, RAM, disk usage, failed services
• SSH Key Deploy — Deploy Ed25519 keys to authorized_keys
• Sudo Setup — Create passwordless sudoers entry with visudo validation
• MOTD Set — Deploy custom message of the day
• Install npm — Detect OS, install Node.js + npm
• Install Claude — Download + install Claude CLI
• Install Prometheus — Install node_exporter + systemd service
• Install QuoxAgent — Deploy quoxagent binary + service file
• Cert Check — SSL certificate expiry via openssl

Custom Tools (Bastion Packs):

Drop shell scripts with YAML front-matter into /etc/bastion/tools/:

#!/bin/bash
# @id: log-cleanup
# @name: Log Cleanup
# @category: utility
# @scope: single,group,all
# @param: days=30:Retention days

find /var/log -name "*.log" -mtime +${days:-30} -delete

Parameters are passed as environment variables (no command injection). File permissions are validated.

SSH Key Management

Generate, deploy, and revoke Ed25519 SSH keys across your fleet:

# Generate a new keypair
bastion tui → SSH Access → Generate

# Deploy to all hosts
bastion tui → SSH Access → Deploy → All Hosts

# Or via API
POST /api/v1/keys/generate {"name": "fleet-deploy"}
POST /api/v1/keys/deploy {"key_id": "fleet-deploy", "all": true}

Key operations include:

• Ed25519 keypair generation
• Idempotent deployment (checks if key already present)
• Connectivity verification after deployment
• Key revocation across the fleet
• Key metadata tracking (deployed hosts, creation date)

Interactive CLI (TUI)

A full-screen BubbleTea-powered terminal interface:

bastion tui       # Launch interactive TUI
bastion menu      # Alias

Views:

• Fleet — Host list with filter, group, detail panel, ping sweep
• SSH Access — Key management, quick connect
• Tools — Browse and run tools with progress tracking
• Monitoring — Fleet health dashboard with bar charts
• Security — Scrollable audit log with filters
• Settings — Configuration viewer

Navigation: j/k to move, Tab to switch panels, / to search, 1-6 to switch views, q to quit.

API

Full REST API on port 9850:

How It Connects

QuoxBastion is standalone — it works without QuoxCORE or QuoxAgent. But when connected, it becomes more powerful.

With QuoxCORE

QuoxCORE's AI agents (CIPHER, NOVA) can query the QuoxBastion API directly. When you ask "check disk space on the docker hosts," the agent:

1. Calls GET /api/v1/groups/docker/hosts to discover hosts
2. Calls POST /api/v1/exec with the command
3. Streams results back to your dashboard
4. Logs the full operation to the AEE audit trail

The integration is available as the bastion-fleet plugin in QuoxCORE.

With QuoxAgent

QuoxBastion and QuoxAgent serve complementary roles:

Use both together: QuoxBastion is the source of truth for what hosts exist. QuoxAgent runs on those hosts for real-time monitoring. QuoxCORE orchestrates both.

QuoxCORE Dashboard
├── QuoxBastion (bastion host, port 9850)
│   ├── SSH → nw-web-01
│   ├── SSH → nw-db-01
│   ├── SSH → nw-hv-01
│   └── SSH → nw-monitor-01
└── QuoxAgent Collector (port 9848)
    ├── Heartbeat ← nw-web-01:9847
    ├── Heartbeat ← nw-db-01:9847
    ├── Heartbeat ← nw-hv-01:9847
    └── Heartbeat ← nw-monitor-01:9847

Technical Details

Configuration

server:
  listen: "0.0.0.0:9850"
  allowed_origins: []

registry:
  path: /var/lib/bastion/hosts.json

ssh:
  default_user: control
  max_concurrent: 10
  command_timeout: 60s
  key_dir: /etc/bastion/keys

audit:
  enabled: true
  aee_enabled: true
  retention_days: 90

Installation

Quick Start

git clone [email protected]:quoxai/quoxbastion.git
cd quoxbastion
go build -o bastion ./cmd/bastion
./bastion serve --config configs/bastion.example.yaml

Production

sudo ./deploy/install.sh
sudo systemctl enable --now bastion

Installs to:

• Binary: /usr/local/bin/bastion
• Config: /etc/bastion/bastion.yaml
• SSH keys: /etc/bastion/keys/ (600 permissions)
• Registry: /var/lib/bastion/hosts.json
• Audit logs: /var/lib/bastion/audit/
• Service: /etc/systemd/system/bastion.service

Next Steps

• QuoxCORE — The AI command center that orchestrates QuoxBastion
• QuoxAgent — Per-host agent for real-time monitoring
• Quickstart — Get QuoxCORE running
• Architecture — System design overview