ThinkWatch is a Rust workspace implementing an AI gateway platform that fronts multiple model providers and MCP (Model Context Protocol) servers. It exposes OpenAI-compatible chat/completion endpoints, streaming, MCP tool-call routing, content filtering, and provider failover. The backend is split into crates: `common` (shared lifecycle/limits/access), `auth` (PoW login, API keys), `gateway` (model routing), `mcp-gateway` (MCP server proxying), `server` (REST admin/audit/trace endpoints), and `test-support` (integration test client). A React/TypeScript frontend in `web/` provides an admin console, setup wizard, limits panels, and MCP server management. Data flows: requests enter the gateway, pass through `check_limits`, `check_budget`, `check_access`, then `run_post_invoke`; `trace_id` is propagated across gateway, MCP, audit, and app logs stored in ClickHouse; Postgres holds users, API keys, budgets, and MCP server configs; Redis/Lua scripts enforce rate limits.
This repository provides a comprehensive, modular set of Bash scripts to automate the installation and configuration of Apache Guacamole—an open-source remote desktop gateway. The primary orchestrator '1-setup.sh' handles interactive prompts and silent install variables to deploy Guacamole server and client from source, integrate MySQL/MariaDB as the backend database, set up Nginx as a reverse proxy, and optionally configure TLS (self-signed or Let's Encrypt), multi-factor authentication (TOTP, Duo, LDAP), and extra UI features like quick-connect and session recording storage. The scripts are well-structured with extensive error checking, logging, distro-specific workarounds, and support for modular post-install add-ons. Though not a library for reuse, the code demonstrates solid shell scripting craftsmanship, security hardening (fail2ban integration, firewall rules), and separation of concerns. The repository serves as a turnkey deployment toolkit for production-grade Guacamole environments.
This repository contains the Docker packaging and optional Docker Swarm deployment recipes for JumpServer, an open-source bastion host / privileged access management system. It does not contain the JumpServer application source code; instead it composes upstream component images (core, koko, chen, web, kael) into a single all-in-one image and provides the runtime scripts to initialize and supervise them. The all-in-one deployment is explicitly a B/S web-only package and does not support client-related features. The core architecture is the allinone multi-stage Dockerfile, which copies runtime trees from each component image onto the core image, then uses Supervisor to run the Django core service, Koko (SSH/terminal access), guacd, Chen, Kael AI service, and the nginx web frontend. The entrypoint script prepares environment defaults, deterministically derives a service-to-service signing key from BOOTSTRAP_TOKEN when no explicit secret is supplied, migrates per-component data directories into a shared volume via symlinks, waits for database and Redis readiness, and runs the JumpServer schema migration before starting services. The swarm/ directory provides a separate deployment path using Docker Swarm stacks, external MySQL/Redis, healthchecks, and a one-shot init-db job. The code is generally careful within its narrow scope: database initialization is idempotent, local vs external dependency startup is handled cleanly, and the multi-stage image build is a non-trivial composition of separately published images. Maintenance appears active, and the build pipeline watches v5.* tags. Drift is medium: the GitHub Actions workflow uses the deprecated/archived actions/create-release@v1 action, image tags are mutable rather than digest-pinned, and a version string inside allinone/readme.txt lags behind the current default Dockerfile version. There are no tests, but this is deployment glue rather than application logic.