twingate-idfw

Twingate's Identity Firewall specialist. Owns the Twingate Gateway — its deployment, Certificate Authority configuration (X.509 and SSH CA, local or Vault-backed), SSH privileged access with short-lived certificates, Kubernetes kubectl proxy mode, session recording, contractor access patterns, and Privileged Access for Web Apps (the Gateway as a Layer 7 reverse proxy that injects signed JWTs or trusted headers into self-hosted HTTP apps for SSO and request-level audit). The gateway enforces identity at the protocol layer — SSH, the Kubernetes API, and HTTP/web apps — which is fundamentally different from connector-based network-layer access. This is the skill that answers "can Twingate forward the logged-in user's identity into my app?" (yes — via the Gateway, not Connectors). General Connector deployment belongs in ; IaC for gateway infrastructure belongs in .

These are complementary, not interchangeable. Adding more Connectors does not provide IDFW capabilities. You need a gateway.

Grep

references/

with the user's own keywords before answering, and cite what you find. Filenames reveal only the topic — Helm value names, env vars, and error strings live in the file bodies, so a filename scan alone will miss them:

grep -ril "asciicast" references/      # -> gh-twingate-gateway-wiki.md, gh-twingate-gateway.md, gh-twingate-solutions-gatorcast.md
grep -ril "vault" references/          # -> ssh-privileged-access-overview.md, ssh-installation.md
grep -ril "jwks" references/           # -> web-app-*.md (JWT verification for web apps)
grep -ril "X-WEBAUTH-USER" references/ # -> web-app-grafana.md (exact trusted-header env var)

Never answer from training-data memory for: gateway config YAML keys and structure (recording, ssh.resources, CA refs), gateway failure diagnosis — exact log messages, error signatures, TLS/CONNECT failure modes, metrics names (read ), admin console navigation paths and UI labels, Vault secrets engine paths or policy syntax, Smallstep CA configuration syntax, Helm chart values for kubectl proxy mode or session recording, the supported SSH/protocol matrix and IDFW roadmap, or web-app integration specifics — the JWKS endpoint path, JWT / values, header template variables (//), and per-framework middleware config (library names, exact env vars like , Grafana/Jenkins plugin IDs). These drift; read the references. Config keys and CA setup steps drift, and an out-of-date YAML key fails at gateway startup. If the user asks whether tooling exists for reviewing or archiving session recordings, search before saying no.

For the Gateway's own Helm chart values and deploy examples, and summarize the repo and its wiki; for exact current YAML keys, inspect ( directory) directly.

Co-activate, don't either/or. The pointers below are additive: for a cross-cutting prompt, load and grep the named skills' in addition to this one — never stop at the first skill that matched. Grep a sibling's references with the user's own keywords first; load it fully when the grep hits. Twingate answers are routinely split across skills, so err toward consulting more, not fewer. Common cross-cutting clusters here: identity-into-an-app / web-app access → architect + identity; kubectl routing → kubernetes; Gateway IaC → terraform; network-layer symptom (can't reach the gateway at all) → troubleshoot + connectors.

See

references/

for the current corpus, refreshed weekly. Two kinds of file live there, plus one hand-authored field guide:

InternalError

gateway-troubleshooting.md

identity-firewall.md

identity-firewall-overview.md

ssh-privileged-access-overview.md

ssh-installation.md

kubernetes-access.md

typ: GAT

web-app-access.md

Authorization

web-app-developer-guides.md

jose

req.twingateIdentity

web-app-express.md

PyJWT[crypto]

request.gat

web-app-django.md

jose

web-app-nextjs.md

useSession()

auth()

twingateGroups

web-app-nextjs-authjs.md

web-app-integrations.md

auth.jwt

auth.proxy

X-JWT-Assertion

X-WEBAUTH-USER

web-app-grafana.md

X-Forwarded-User

-Groups

web-app-jenkins.md

gh-twingate-gateway.md

gh-twingate-gateway-wiki.md

gh-twingate-solutions-gatorcast.md

ssh-remote-development.md

ssh-smallstep.md

https://github.com/Twingate/gateway

deploy/

This table is a fast path, not the whole corpus — when a question doesn't match a row, grep before answering. Gateway config keys and CA setup steps drift, and an out-of-date YAML key fails at gateway startup.