Production deployment checklist§

Install and configuration§

Pick a deployment method: native binary, Docker, Helm or the community Kubernetes operator.
Run Warpgate under a supervisor that restarts it (a systemd unit for native installs)
Move off the built-in SQLite to an external MySQL or PostgreSQL (database_url in the config file) if you want clustering or expect the estate to grow.

Replace the self-signed certificate generated during setup with a real one for your domain.
Add SNI certificates for target subdomains not covered by that certificate.
Behind a reverse proxy: forward Host and X-Forwarded-Proto, and set http.trust_x_forwarded_headers (see running behind a reverse proxy)
Behind a TCP load balancer: enable the PROXY protocol per listener
Mount your internal root CAs if target certificates use a private CA

Connect your identity provider: SSO via OIDC.
Give each admin their own account instead of sharing the one created at setup.
Give each team the narrowest role that works, and keep the admin role a short list.

Require OTP or multiple factors for admins and for sensitive targets.
Enable login protection - IP blocking and user lockout thresholds - for your traffic.
Turn off password SSH logins under Config > Global parameters if you are not using password credentials.
Turn off web SSH or the web remote desktop client under Config > Global parameters > SSH if your policy doesn't allow them.
Set up password complexity rules under Config > Global parameters > Password policy.
Decide your policy on tickets and self-service ticket requests before users start asking.
Enable credential encryption at rest - particularly with an external database, replicas or off-host backups.
Store the encryption key where you can recover it.

Set up additional nodes: shared database, S3 recordings storage and the at-rest encryption key everywhere - see running a cluster
Confirm nodes can reach each other on their HTTP listener port (for cross-node proxying)
Check that taking one node out of the load balancer doesn't disturb sessions on the others.

Forward logs to your aggregator: log forwarding.
Subscribe to release and security announcements so upgrades and advisories don't arrive by surprise.

Test connections to each target as an end user
Play back a session recording and confirm it lands in the storage you configured
Test admin access recovery with warpgate recover-access - see recovering admin access.
Restore your backup onto a temporary deployment and test it
Always upgrade that temporary deployment host to the next version before you do it in production

Imprint