Production deployment checklist§

Install and configuration§

• Pick a deployment method: native binary, Docker, Helm or the community Kubernetes operator.
• Run Warpgate under a supervisor that restarts it (a systemd unit for native installs)
• Move off the built-in SQLite to an external MySQL or PostgreSQL (database_url in the config file) if you want clustering or expect the estate to grow.

TLS and networking§

• Replace the self-signed certificate generated during setup with a real one for your domain.
• Add SNI certificates for target subdomains not covered by that certificate.
• Behind a reverse proxy: forward Host and X-Forwarded-Proto, and set http.trust_x_forwarded_headers (see running behind a reverse proxy)
• Behind a TCP load balancer: enable the PROXY protocol per listener
• Mount your internal root CAs if target certificates use a private CA

Identity and access§

• Connect your identity provider: SSO via OIDC.
• Give each admin their own account instead of sharing the one created at setup.
• Give each team the narrowest role that works, and keep the admin role a short list.

Hardening§

• Require OTP or multiple factors for admins.
• Optionally, turn on MFA enforcement globally.
• Set the default auth policy for users created later.
• Require an administrator approval for your most sensitive targets.
• Enable login protection - IP blocking and user lockout thresholds - for your traffic.
• Turn off password SSH logins under Config > Global parameters if you are not using password credentials.
• Turn off web SSH or the web remote desktop client under Config > Global parameters > UI if your policy doesn't allow them.
• Set up password complexity rules under Config > Global parameters > Password policy.
• Decide your policy on tickets and self-service ticket requests before users start asking.
• Enable credential encryption at rest - particularly with an external database, replicas or off-host backups.
• Store the encryption key where you can recover it.

Scaling and HA§

• Set up additional nodes: shared database, S3 recordings storage and the at-rest encryption key everywhere - see running a cluster
• Confirm nodes can reach each other on their HTTP listener port (for cross-node proxying)
• Check that taking one node out of the load balancer doesn't disturb sessions on the others.

Backups§

See the backup and restore guide.

• The config file (/etc/warpgate.yaml)
• The data directory (on Docker that's the /data volume)
• The database
• The at-rest encryption key
• Session recordings

Observability§

• Forward logs to your aggregator: log forwarding.
• Subscribe to release and security announcements so upgrades and advisories don't arrive by surprise.

Before you go live§

• Test connections to each target as an end user
• Play back a session recording and confirm it lands in the storage you configured
• Test admin access recovery with warpgate recover-access - see recovering admin access.
• Restore your backup onto a temporary deployment and test it
• Always upgrade that temporary deployment host to the next version before you do it in production