Gatorcast
Problem
Twingate Identity Firewall Gateways record privileged sessions - interactive kubectl exec and SSH shells - but emit them only as a stream of fragmented log entries. On their own those fragments are unusable: there is no reassembly into complete recordings, no way to browse sessions by system or user, no replay, and no way to search session content when a security incident needs investigating. Teams that want an audit trail of exactly what a privileged user typed have nowhere to store or review it.
Approach
Built a self-hosted FastAPI service that ingests gateway logs over HTTP POST or syslog TCP, demultiplexes concurrent sessions by connection ID, and reassembles the fragments into complete asciicast v2 recordings. Sessions are stored in SQLite with optional AES-256-GCM encryption at rest and organized by target system and user. A pattern-based detection engine scans reassembled sessions for dangerous commands and exposed secrets, flagging them so reviewers can jump straight to the relevant moment. A lightweight web UI - built with htmx, Alpine.js, and a vendored asciinema player - provides browsing, search by user/timeframe/content, and in-browser playback. The entire stack ships as a Docker image with zero external runtime dependencies, so it runs fully air-gapped.
Outcome
Security teams and infrastructure operators get a private, on-premises system of record for privileged access. Recordings stay grouped by target system, are searchable by user, timeframe, or command content, and link directly to detected threats within playback - turning raw gateway log noise into a reviewable audit trail without any data leaving the environment. Published under the Twingate-Solutions organization.