Zero-Trust Perimeter • Enclaved Development
🛡️ Secure Air-Gapped Remote Development Enclave
How global developers securely code on enclaved Linux, Windows, and macOS hosts through the GoXterm Bastion Gateway—guaranteeing zero code leaks, inline AI DLP redaction, supply chain protection, and complete session auditing.
🛡️ No Code Leaves Enclave
Keystrokes in, pixels out. Source code lives and stays strictly inside the central Git repository and enclave hosts.
🤖 No Sensitive Data Leaks
AI DLP firewall intercepts prompts, masking passwords, API keys, and internal RFC1918 IPs in sub-milliseconds.
📦 No Vulnerable Packages
Supply chain proxy cross-references incoming dependencies with real-time OSV.dev CVE intelligence to block threats.
📜 100% Audited & Recorded
Tamper-evident audit ledger and asciinema session recording log every terminal input, command, and file operation.
🛡️ Configurable & Controllable Isolation Levels: GoXterm allows teams to balance developer convenience with compliance:
- Full Bidirectional Workflow: In standard development environments where policy permits, developers enjoy frictionless two-way SFTP file drag-and-drop and fluid copy & paste.
- One-Way Inbound Enclave Mode: When handling mission-critical IP or regulated enclaves, set
GOXTERM_CLIPBOARD_POLICY="inbound-only"(allows paste in, blocks copy out) andGOXTERM_SFTP_DOWNLOAD_POLICY="disabled"(blocks file downloads with403 sftp_download_disabled) to ensure no source code leaves the enclave.
Zero-Trust Credential Storage
🔐 Secret Vault Programmatic Reveal
GoXterm provides an AES-256-GCM encrypted vault accessible via headless machine tokens (api_user). Tokens are strictly bound 1-to-1 to a specific secret, preventing Broken Object-Level Authorization (BOLA/IDOR).
GET
/api/v1/vault/secret/reveal
Bearer gox_sec_...
Auto-resolves and decrypts the secret bound to the caller's scoped token. No secret ID required in URL.
# Reveal secret payload via scoped Bearer token
curl -s -X GET "https://goxterm.internal:8443/api/v1/vault/secret/reveal" \
-H "Authorization: Bearer gox_sec_4f9a1c8e7b2d5f0e3a6c8b1d4e7f9a2b0c3d5e8f1a4b7c0d2e5f8a1b4c7d0e3f"
import os, requests
VAULT_URL = "https://goxterm.internal:8443/api/v1/vault/secret/reveal"
TOKEN = os.getenv("GOXTERM_VAULT_TOKEN", "gox_sec_...")
response = requests.get(
VAULT_URL,
headers={"Authorization": f"Bearer {TOKEN}"},
timeout=5
)
secret_payload = response.json()
print("Decrypted Secret:", secret_payload.get("password"))
const token = process.env.GOXTERM_VAULT_TOKEN || 'gox_sec_...';
async function fetchSecret() {
const res = await fetch('https://goxterm.internal:8443/api/v1/vault/secret/reveal', {
headers: { 'Authorization': `Bearer ${token}` }
});
const payload = await res.json();
console.log('Decrypted Username:', payload.username);
console.log('Decrypted Password:', payload.password);
}
fetchSecret();
package main
import (
"encoding/json"
"fmt"
"net/http"
)
func main() {
req, _ := http.NewRequest("GET", "https://goxterm.internal:8443/api/v1/vault/secret/reveal", nil)
req.Header.Set("Authorization", "Bearer gox_sec_...")
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
var result map[string]interface{}
json.NewDecoder(resp.Body).Decode(&result)
fmt.Printf("Decrypted Payload: %+v\n", result)
}
🛡️ Zero-Trust Gating: Vault tokens can be configured with strict IP allowlists (e.g.
10.240.0.0/16), single-use self-destruct limits (max_uses=1), and TTL expirations. Token hashes are stored in salted SHA-256; raw tokens are never persisted in plaintext.
Workload Identity Federation (RFC 7519)
🛡️ Passwordless OIDC Workload Authentication
Eliminate static long-lived tokens from your CI/CD pipelines and Kubernetes pods. GoXterm verifies short-lived JWT tokens signed by Kubernetes or GitHub Actions against bound claims (iss, aud, sub).
POST
/api/v1/vault/secrets/{secret_id}/reveal
OIDC JWT Body Assertion
# In Kubernetes, read the short-lived projected service account token
K8S_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -s -X POST "https://goxterm.internal:8443/api/v1/vault/secrets/sec-billing-db/reveal" \
-H "Content-Type: application/json" \
-d '{
"app_id": "k8s-billing-microservice",
"jwt": "'"$K8S_TOKEN"'"
}'
# In GitHub Actions workflow step with id-token: write
GH_OIDC_TOKEN=$(curl -sLS "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=goxterm-vault" \
-H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" | jq -r '.value')
curl -s -X POST "https://goxterm.internal:8443/api/v1/vault/secrets/sec-prod-deployer/reveal" \
-H "Content-Type: application/json" \
-d '{
"app_id": "github-ci-workflow",
"jwt": "'"$GH_OIDC_TOKEN"'"
}'
import requests
payload = {
"app_id": "k8s-billing-microservice",
"jwt": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2tpZC5jbHVzdGVyLmxvY2FsIiwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50OmJpbGxpbmc6cHJvY2Vzc29yIiwiYXVkIjoiZ294dGVybS12YXVsdCIsImV4cCI6MTc5MDg1MjAwMH0..."
}
res = requests.post(
"https://goxterm.internal:8443/api/v1/vault/secrets/sec-billing-db/reveal",
json=payload,
verify=True
)
print(res.json())
Identity Assertion: The vault validates the RSA/ECDSA signature, issuer (
iss), audience (aud), and claim constraints before releasing the decrypted payload.
OpenAI-Compatible AI Gateway
🤖 AI Proxy Gateway & Inline DLP Firewall
Route your engineering team's LLM traffic through a unified, compliant endpoint. Features sub-millisecond regex DLP redaction to mask or block credentials, AWS keys, and internal RFC1918 IPs before reaching external model providers.
POST
/v1/chat/completions
Bearer <AI_TOKEN>
curl -s -X POST "https://goxterm.internal:8443/v1/chat/completions" \
-H "Authorization: Bearer gox_ai_tok_9b8a7c6d5e4f3a2b" \
-H "Content-Type: application/json" \
-d '{
"model": "gpt-4o",
"messages": [
{"role": "user", "content": "How do I securely configure database connection pool in Go?"}
]
}'
from openai import OpenAI
# Drop-in replacement: configure base_url to point to GoXterm Gateway
client = OpenAI(
base_url="https://goxterm.internal:8443/v1",
api_key="gox_ai_tok_9b8a7c6d5e4f3a2b"
)
completion = client.chat.completions.create(
model="gpt-4o",
messages=[
{"role": "user", "content": "Summarize this release note."}
]
)
print(completion.choices[0].message.content)
import OpenAI from 'openai';
const openai = new OpenAI({
baseURL: 'https://goxterm.internal:8443/v1',
apiKey: 'gox_ai_tok_9b8a7c6d5e4f3a2b'
});
async function main() {
const response = await openai.chat.completions.create({
model: 'gpt-4o',
messages: [{ role: 'user', content: 'Explain microsegmentation.' }]
});
console.log(response.choices[0].message.content);
}
main();
Supply Chain Firewall & Package Caching
📦 Package Management & Build Integration
Point standard build runners (pip, npm, Maven, Gradle, APT) directly at GoXterm. Speed up CI/CD pipeline build times while blocking vulnerable packages flagged by real-time OSV.dev CVE intelligence.
GET
/repository/{pypi|npm|maven|apt}/*
Upstream Mirror
# Option A: Command-line installation
pip install --index-url https://goxterm.internal:8443/repository/pypi/simple/ requests flask
# Option B: Global configuration in ~/.pip/pip.conf
[global]
index-url = https://goxterm.internal:8443/repository/pypi/simple/
trusted-host = goxterm.internal
# Option A: Command-line install
npm install express --registry=https://goxterm.internal:8443/repository/npm/
# Option B: Persist in project root .npmrc
registry=https://goxterm.internal:8443/repository/npm/
strict-ssl=true
<!-- Maven ~/.m2/settings.xml Mirror Configuration -->
<mirrors>
<mirror>
<id>goxterm-maven-cache</id>
<mirrorOf>central</mirrorOf>
<name>GoXterm Secure Central Mirror</name>
<url>https://goxterm.internal:8443/repository/maven/</url>
</mirror>
</mirrors>
// Gradle build.gradle Configuration
repositories {
maven {
url "https://goxterm.internal:8443/repository/maven/"
}
}
# /etc/apt/sources.list mirror redirection
deb https://goxterm.internal:8443/repository/apt/ jammy main restricted universe multiverse
deb https://goxterm.internal:8443/repository/apt/ jammy-updates main restricted universe multiverse
Monitoring & Operational Health
⚡ System Status & Gateway Health
Endpoints used by load balancers, Kubernetes liveness probes, and uptime monitors to verify instance health and software editions.
| Method | Endpoint | Description | Auth |
|---|---|---|---|
| GET | /api/system/info |
Returns server architecture, Go runtime, build timestamp, and platform metrics. | Public |
| GET | /api/license/status |
Returns active edition (Standalone, Gateway Pro, Enterprise) and seat allocation. | Public |
| GET | /api/ha/health |
High Availability health check used by keepalived and external load balancers. | Public |