Run & scale · QuoxBastion
Every command, through one governed gateway.
You are inside your infrastructure: every host a port, and one guarded gateway in front of all of them. One registry for every host. Parallel SSH across the fleet. A full audit trail on every command. Zero agents required.
In plain words
What it is, where it lives, when to reach for it
- What is it
- An SSH gateway you run in front of your servers, with one registry for every host.
- Where do I use it
- In your terminal through the
quox fleetcommands, and the Bastion panel in the dashboard. - When would I use it
- When you need to run a command on one host, a group, or the whole fleet, with an audit trail.
- How do I use it
- Run
quox fleet hoststo list your registry, thenquox fleet execto send a command through the gateway.
The problem
Where are your hosts?
Infrastructure teams accumulate hosts across environments: production, staging, development, monitoring, networking. Host information ends up scattered.
- SSH config files on individual laptops
- Shared spreadsheets and wiki pages
- Ansible inventories that drift from reality
- Tribal knowledge in someone's head
When an incident happens at 3am, the on-call engineer wastes time figuring out which host to check, what its IP is, and how to reach it. QuoxBastion makes the answer one command away.
Live demonstration
Watch a command go through the gateway.
One command targets a host, a group, or the whole fleet. The gateway verifies the key, fans out in parallel, streams every result back, and writes the run to the audit log. Pick a target and watch it happen.
parallel execution · 10 concurrent connections by default / timeouts · configurable per connection and per command / results · per-host stdout, stderr and exit codes on every run / audit · every command logged with timestamp, user, targets, output and duration
Operating record
Proof, not a promise.
The demonstration above is not a mock-up. It runs the same governed path that has been live for weeks: an attempt written to the chain before a command reaches a host, then the result written after, over three thousand executions deep and still running.
The console
The whole fleet, from one console.
Hosts in one registry, keys verified on every connection, every command streamed back and written to the audit log. Governed SSH with the evidence trail built in: every command policy-checked before it runs, every run anchored after.
- One registry for every host, group and tag
- Every command verified before it reaches a host
- Every run written to the audit log, with output and duration
- 1JANUS reads the gateway for youThe gate warden opens with a live count across a fifty-plus host lab fleet, reachable and unreachable, before you scroll to a single row.
- 2Defcon status, always in viewA DEFCON GREEN chip and a LIVE badge sit in the header on every screen of the console.
- 3Filter the registry downA search narrows the full fleet to the hosts you are looking for, with status, IP, group and MAC for each.
- 4Groups, countedHosts are organised into groups, each with its own host count, so you can target by function instead of memorising IPs.
- 5Ask JANUS instead of clickingSuggested prompts, "which hosts are unreachable right now", "add a host to the registry", answer without leaving the panel.
- 6Evidence chips along the footerAEE, AOCL, VOLT and WARD status sit next to backup and AI state, on every screen.
Captured from the real QuoxBastion console, not a mockup.
Host registry
Every host, documented.
Structured metadata for every host in your infrastructure, in one canonical registry.
{ "id": "nw-web-01", "ip": "10.20.0.11", "fqdn": "nw-web-01.northwind.internal", "aliases": ["dock01", "d01"], "group": "docker", "tags": ["production", "containers"], "ssh": { "port": 22, "user": "control", "key_id": "default" }, "metadata": { "os": "ubuntu-22.04", "arch": "amd64", "cores": "8", "ram_gb": "32" } }
Reference hosts your way.
- By ID:
nw-web-01 - By alias:
d01 - By group:
--group docker - By tag:
--tag production
The registry is the canonical source for what exists in your infrastructure. Query it via CLI or API, and import or export the whole thing as one file.
The registry, live
Real output, from the real CLI.
The simulated run above shows the shape of a command. What follows is not staged: the actual bastion binary, run against a 13-host demonstration fleet (10 healthy, 3 unreachable), output captured verbatim.
$ bastion host list
ID IP GROUP STATUS LAST SEEN
nw-backup-01 10.20.0.71 backup unhealthy 0001-01-01 00:00
nw-edge-gw-01 10.20.0.51 edge healthy 2026-08-06 17:12
nw-monitor-01 10.20.0.61 monitoring healthy 2026-08-06 17:12
nw-ops-console-01 127.0.0.1 ops healthy 2026-08-06 17:12
nw-web-02 10.20.0.12 web healthy 2026-08-06 17:12
nw-worker-02 10.20.0.42 workers unhealthy 0001-01-01 00:00
nw-api-01 10.20.0.13 api healthy 2026-08-06 17:12
nw-cache-01 10.20.0.31 cache healthy 2026-08-06 17:12
nw-db-01 10.20.0.21 database healthy 2026-08-06 17:12
nw-db-02-replica 10.20.0.22 database healthy 2026-08-06 17:12
nw-edge-gw-02 10.20.0.52 edge unhealthy 0001-01-01 00:00
nw-web-01 10.20.0.11 web healthy 2026-08-06 17:12
nw-worker-01 10.20.0.41 workers healthy 2026-08-06 17:12
Total: 13 hosts$ bastion exec nw-ops-console-01 "uptime"
[SSH] Strict host key verification enabled · known_hosts
=== 127.0.0.1 ===
20:42:49 up 2 days, 14:21, 5 users, load average: 5.50, 4.69, 4.70
Exit code: 0 · Duration: 179ms$ bastion audit verify
OK: audit chain intact (1 file(s), 76 entries checked)Captured 2026-08-06 from a local demonstration instance, fictitious Northwind Logistics hosts on 10.20.0.0/24, not the operator's production infrastructure.
Capabilities
Built for security.
Everything the gateway does, on one ledger.
Interactive TUI
The whole gateway, in the terminal.
A full-screen interface over the same governed core: fleet overview, tool browser, live monitoring and the audit viewer, all keyboard-driven. Nothing leaves the terminal, and every action runs through the same policy checks and audit trail as the CLI.
- Fleet overview with health and group breakdowns at a glance
- Browse and run tools without leaving the keyboard
- Read the audit log in place, command by command
Tools registry
Built-in tools, plus your own.
9 built-in tools for common ops tasks: health checks, SSH key deployment, sudo setup, certificate checks and software installation. Drop shell scripts into /etc/bastion/tools/ to register your own.
- Health check: CPU, RAM, disk and failed services
- SSH key deploy: Ed25519 keypair management
- Sudo setup: passwordless sudo with visudo validation
- Cert check: SSL certificate expiry monitoring
- Custom scripts: YAML front matter, auto-discovered
#!/bin/bash # @id: log-cleanup # @name: Log Cleanup # @category: utility # @scope: single,group,all # @param: days=30:Retention days find /var/log -name "*.log" \ -mtime +${days:-30} -delete echo "Cleaned logs older than ${days} days"
Interactive CLI
A full-screen TUI for the whole fleet.
A BubbleTea-powered terminal interface with six views, from fleet overview to the audit log.
QUOX BASTION › Fleet v1.0.0 ╭───────────────────────────────────╮╭────────────────────────────────────────────────────────────── │ Hosts (14) ││ hv-node-01 │ / to filter ││ │ ▸ ● hv-node-01 hypervisor ││ ● HEALTHY │ ● obs-01 observability ││ │ ● edge-web-01 edge ││ IP: 198.51.100.21 │ ○ app-node-02 apps ││ Group: hypervisor │ ● db-primary data ││ │ ● cache-01 data ││ SSH │ ● build-01 build ││ User: root │ ○ build-02 build ││ Port: 22 │ ● hv-node-02 hypervisor ││ Key: hv │ ● backup-01 backup ││ │ ● edge-web-02 edge ││ Tags │ ● app-node-01 apps ││ #virtualization │ ● app-node-03 apps ││ #critical │ ● db-replica data ││ │ ││ Last Seen: 2026-08-28 09:14:22 │ ││ │ ││ Metadata │ ││ cores: 64 │ ││ ram_gb: 256 │ ││ os: proxmox-9.0 │ ││ arch: amd64 │ ││ ╰───────────────────────────────────╯╰────────────────────────────────────────────────────────────── j/k navigate 1-6 views tab panel / search r refresh q quit ● 12 ● 0 Hosts: 14
A real capture, not a mock-up. This is bastion tui built from source and run in a 100 by 28 terminal, drawn by the binary itself. The fleet is invented for the screenshot: the names are made up and the addresses come from the ranges reserved for documentation, so nothing here belongs to a real network.
Browse hosts, filter by group, run a ping sweep.
Generate, deploy and revoke Ed25519 keys.
Browse and run tools with progress tracking.
Health dashboard with per-group breakdowns.
Filterable event timeline for every command.
SSH defaults, concurrency and server configuration.
REST API
Full API access.
20 endpoints for hosts, tools, keys, audit and metrics, served on port 9850.
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/v1/hosts | List all hosts |
| POST | /api/v1/hosts | Add a host |
| GET | /api/v1/groups/:name/hosts | Hosts in a group |
| POST | /api/v1/exec | Execute a command |
| GET | /api/v1/ping | Ping all hosts |
| GET | /api/v1/tools | List available tools |
| POST | /api/v1/tools/run | Run a tool on targets |
| GET | /api/v1/keys | List managed SSH keys |
| POST | /api/v1/keys/deploy | Deploy a key to hosts |
| GET | /api/v1/audit | Query the audit log |
| GET | /api/v1/metrics | Fleet health metrics |
QuoxCORE integration. AI agents query QuoxBastion directly. Ask "check disk on the docker hosts" and the agent calls the API for you, with the run logged like any other command.
Integration
Works standalone, or with QuoxCORE.
On its own, a complete SSH gateway with a CLI and an API. Inside QuoxCORE, the fleet arm of the AI command centre, with agent-issued commands going through the same gateway and the same log.
Getting started
Up and running in minutes.
One static Go binary on your bastion host. Five steps from clone to a governed fleet.
Clone the repo and build. Single static Go binary, no dependencies.
$ git clone https://github.com/quoxai/quoxbastion.git
$ cd quoxbastion
$ go build -o bastion ./cmd/bastionStart the server directly, or install the shipped systemd unit on your bastion host.
$ bastion serve --config /etc/bastion/bastion.yaml
# or as a service
$ sudo cp bastion /usr/local/bin/
$ sudo cp deploy/bastion.service /etc/systemd/system/
$ sudo systemctl enable --now bastionRegister your infrastructure hosts with IPs, groups and SSH config.
$ bastion host add nw-web-01 --ip 10.20.0.50 --group dockerGenerate an Ed25519 keypair and deploy it across your fleet.
bastion tui → SSH Access → Generate → DeployRun tools, execute commands and monitor your fleet from the CLI or API.
$ bastion tuiStraight answers
What's proven, and what isn't, yet.
Inside QuoxCORE's own NOC view, the fleet grid is real: it calls QuoxBastion's own host list and ping endpoints when a bastion is deployed and configured, and when it is not, the dashboard falls back to fabricated hosts labelled DEMO DATA rather than pretending they are yours.
QuoxBastion's own gateway audit trail, the attempt-then-exec chain above, is not a lab result: it is live and has been running continuously for weeks, not merely unit-tested.
What remains beta is the layer on top of it: when a tool runs through the gateway from QuoxCORE, the collector writes a full AEE, VOLT and AOCL record, but that integration path is unit-tested rather than confirmed against a live store.
The standalone binary's other claims on this page, the registry, the TUI, the REST API, come from its own repository, which does not yet carry an independent status review of its own beyond that live gateway audit trail.
One gateway
Take control of your fleet.
One bastion. Every host. Complete visibility, and a log for every command that ever went through the gateway, governed as part of the Quox enterprise platform.
Go deeper
Technical documentation.
How you get it
In the store today, and governed from the first command
One licence covers the gateway. What it governs is up to how many hosts you enrol.
On its own
The governed SSH gateway itself: every command brokered, policy-checked and witnessed, with the quox fleet CLI verbs included. Runs on your own QuoxCORE instance.
On every host
QuoxAgent is the per-host sidecar the gateway talks to. It costs nothing on top: enrol as many hosts as you run, and each one reports in through the same evidence trail.