Skip to content
Rack Gateway

Rack Gateway

Secure your Convox infrastructure with enterprise-grade authentication, authorization, and audit logging. SOC 2 compliant.
Get StartedView on GitHub

Why Rack Gateway?

Section titled “Why Rack Gateway?”

Rack Gateway is an open-source, self-hosted authentication and authorization proxy for Convox racks. It provides the security controls you need for SOC 2 compliance without vendor lock-in.

Google Workspace OAuth

Secure single sign-on with domain restrictions. Your team authenticates with their existing Google accounts.

Role-Based Access Control

Four built-in roles (viewer, ops, deployer, admin) with granular permissions. Control who can do what on your infrastructure.

Complete Audit Trail

Every request is recorded before it acts, in a hash-chained log anchored hourly to S3 Object Lock. Env values are redacted. Entries also go to stdout as JSON for CloudWatch or your SIEM.

Multi-Factor Authentication

TOTP, WebAuthn (security keys), and YubiKey OTP. Required for all users by default, with step-up MFA for sensitive commands.

Deploy Approvals

Manual approval workflow for CI/CD deployments. Integrates with CircleCI, GitHub, and Slack.

Single-Tenant Design

One gateway per rack. Deployed alongside your Convox API for maximum security and isolation.

How It Works

Section titled “How It Works”

Rack Gateway is a proxy between developers and the Convox API:

Users install the rack-gateway CLI, which handles authentication and wraps Convox commands.

Quick Example

Section titled “Quick Example”
Terminal window
# Install the rack-gateway CLI
# (download from releases or build from source)


# Login with Google OAuth
rack-gateway login staging https://gateway.example.com


# Run Convox commands through the gateway
rack-gateway apps
rack-gateway ps
rack-gateway deploy


# Set up a convenient alias
alias cg="rack-gateway"
cg apps
cg logs -a myapp

Built for Compliance

Section titled “Built for Compliance”

Rack Gateway was built to achieve SOC 2 compliance for production infrastructure. It provides:

  • Append-only audit logs, hash-chained and anchored hourly to S3 WORM storage, verified every hour
  • Secret redaction: env values are [REDACTED] in audit logs and Slack unless an admin lists them as visible
  • Session management with configurable timeouts and revocation
  • MFA enforcement with step-up authentication for sensitive operations

Community Edition

Section titled “Community Edition”

Rack Gateway is an open-source “community edition” alternative to the hosted Convox Console. While Convox Console offers more advanced features and official support, Rack Gateway provides everything you need for secure, compliant infrastructure management.