Documentation

Warden

A security-conscious Linux server workspace with multi-user access, durable operations, files, development tools, terminals, monitoring and structured administration behind one Go service.

Current status

Hardened development build.

The BH00-BH17 campaign is complete for the tested candidate. Warden still exposes meaningful authority: capability-bearing users can write files, run agent tasks, operate terminals and administer the host. Completed testing is not a substitute for a dedicated OS account, TLS proxy, backups and deployment-specific review.

The interface is organised around distinct jobs. Explorer handles broad file management; Editor owns project workspaces; Terminal manages independent PTYs; Agent supervises durable coding conversations; Monitor and Alerts observe the host; Websites and System expose revisioned or typed operations.

Follow the exact evidence and retained limitations on the Battle Tested page.

Build and run

nift build
go test ./...
go build -o warden ./cmd/warden
./warden

Nift generates public/ and Go embeds it into the executable. The default listener is 127.0.0.1:8080. On a fresh instance, create the first administrator in the browser.

Choose a surface

EditorWorkspaces, tabs, search/replace, multi-edit and integrated tools.Coding agentDurable account-owned conversations and run evidence through OpenCode.TerminalMultiple authenticated PTYs with durable metadata and bounded scrollback.AlertsDuration-aware event rules, incidents, resolution and acknowledgement.WebsitesStatic sites, loopback proxies, immutable revisions and publish jobs.SQLite & durabilityTransactional migrations and normalized operational state.ExplorerBrowse, upload, move, archive and preview confined files.SystemStructured controls for services, users, SSH, firewall and Docker.Access controlAccounts, identities, reusable roles and server-enforced capabilities.InstallingEmbedded releases for Linux, macOS and Windows.HTTPS with CaddyAutomatic HTTPS through a trusted local reverse proxy.HTTPS with nginxDeploy behind an existing nginx service.

Know the authority boundary

WARDEN_FILE_ROOT confines filesystem APIs, not terminal or agent subprocesses. Read Security before granting capabilities or exposing Warden remotely.