Tenantry

The control plane of an MSP that runs Teleport for many clients. One web interface to connect client sites, publish each client's Steward console, watch everything and alert you when something breaks.

What it does

• Connects client sites. Two wizards generate the commands that install a Teleport client proxy at a customer site and expose its Windows and Active Directory servers over RDP.
• Runs the fleet. Status, version, desktops per proxy, lock and unlock, per client.
• Publishes and monitors Steward. The delegated Active Directory console of each client, published as a Teleport application, polled for health, directory and audit chain, upgraded in bulk.
• Alerts. One set of rules across all clients, sent to webhook (HMAC), ntfy, Teams or Slack.
• Scopes technicians per client, enforced on the server.
• Keeps a tamper-evident audit log (hash-chained).

Why

• Easy to install. One command on the Teleport server: sudo scripts/install.sh. A guided wizard creates the Teleport role and Machine ID bot for you.
• Safe by default. Short-lived Teleport identity renewed by Machine ID, hardened containers, no docker.sock, and an installer that offers only protected exposures (private network, your WAF, Cloudflare Tunnel with Access).
• It generates, you run. Bundles and scripts are produced for you to review and run on the target host.
• Honest TLS. Publicly trusted certificates, even for internal-only servers, through DNS-01 with your DNS provider.

Architecture

flowchart TB
  subgraph users[People]
    ADM[MSP administrators and technicians]
  end
  subgraph edge[Protection layer]
    CFA[Cloudflare Access]
    WAF[Your WAF or reverse proxy]
    VPN[Private network or VPN]
  end
  subgraph srv[Your Teleport server]
    TEN[Tenantry web and API<br/>with embedded tctl]
    TBOT[tbot<br/>Machine ID]
    CFD[cloudflared<br/>or Caddy front]
    TP[Teleport Auth and Proxy]
  end
  subgraph clients[Client sites]
    CP[Client proxy<br/>Teleport agent]
    WIN[Windows and AD servers]
    STW[Steward console]
  end
  ADM --> CFA --> CFD
  ADM --> WAF --> CFD
  ADM --> VPN --> CFD
  CFD --> TEN
  TBOT -->|renews identity| TEN
  TBOT --> TP
  TEN -->|tctl| TP
  CP -->|outbound 443| TP
  CP --> WIN
  CP --> STW
  TEN -->|status poll, HTTPS| STW
  TEN -->|alerts| NOTIF[Webhook / ntfy / Teams / Slack]
  WIN -.->|one-time scripts and callbacks| TEN

Tenantry never connects to a client's network by itself. Client proxies connect out to Teleport. Tenantry talks to Teleport with tctl, and to Steward consoles over HTTPS.

Where to start

I want to...	Go to
Install Tenantry on my Teleport server	Quick start
Install it with Teleport elsewhere, or build a new cluster too	Quick start variants
Add a client	Onboard a client
Publish a client's Steward	Publish Steward
Get a trusted certificate	TLS certificates
Put it on the Internet safely	Exposure: never expose raw
Run Teleport behind Cloudflare Tunnel, Access and Duo	Teleport behind Cloudflare
Upgrade, back up, set alerts	Operations
Fix a problem	Troubleshooting
Look up an installer option	install.sh options

All pages

Section	Pages
Getting started	Quick start, Variants, A new Teleport cluster
Onboard a client	Overview, Gateway + AD, Existing gateway, Client proxies, Clients and consoles
Publish Steward	Publish Steward, Steward integration
TLS certificates	Choosing a method, one page per DNS provider, other acme.sh provider, own certificates
Exposure and security	Never expose raw, Teleport behind Cloudflare, Teleport SSO, Security
Operations	Upgrades, Upgrading Steward consoles, Backups, Alerts, Technicians
Reference	install.sh options, Machine ID, Translating, License

Password reset for the helpdesk

Password reset and unlock are provided by the separate Steward product, which Tenantry connects to Teleport (Steward integration).