Reach private networks — then download the client files.
VPN connections (IPsec / IKEv2, SSTP or WireGuard, client or server role) sit in the same governed catalog as SSH and Ansible. From a server connection in admin you generate secrets once, then download ready profiles and install commands grouped by iPhone, Android, Windows and Ubuntu. Typical path: gateway first, then SSH, playbooks or Windows remoting on the far side.
What VPN provides
VPN connector. People who only browse the catalogue can see connections; creating, changing or rotating them is for administrators. Certificates, keys and passwords stay in the vault — not in process text. Available where the connector is deployed and the account has access.
IPsec, SSTP, WireGuard
Supported protocols are IPsec (IKEv2), SSTP and WireGuard. The connection record also has a client or server role.
Profiles from admin
Download configs and install commands from the VPN connection. Secrets are created or rotated with Generate / Regenerate — they are stored in the vault, not copied into chat.
Network path
VPN is the path to private hosts. It does not replace SSH profiles, Ansible allowlists or product audit.
Test the gateway
Validate the connection from admin before automated processes depend on it. Gateway unavailable is a full failure, not a silent skip.
Rotate secrets
Regenerate replaces certificates, keys and passwords. Older iPhone profiles, .conf files and CA files then fail until people download again.
Then SSH, Ansible or Windows remoting
After the tunnel is up, governed SSH profiles, Ansible playbooks and WinRM/PSRP connections run on the reachable hosts.
Client downloads
On a VPN server in admin: Generate secrets, then Download. Files are grouped by device. After Regenerate, previous downloads stop working and people must install the new files. Generate is for server connections; a client-role record does not rotate the server material.
iPhone
IKEv2: install a .mobileconfig (password is inside the profile). WireGuard: official app and a downloaded .conf. SSTP is not an iPhone path — use IKEv2 or WireGuard.
Android
IKEv2: strongSwan or the system VPN, with CA import when you use a private CA. WireGuard: official app and a downloaded .conf.
Windows
IKEv2 and SSTP: import the CA, then add the VPN (SSTP typically hostname:8443). WireGuard: official app and import the .conf. Install commands come with the download.
Ubuntu
IKEv2 and SSTP: NetworkManager commands in the download. WireGuard: wg-quick script and .conf. Endpoint is the public VPN host, not a loopback address.
Explore more
SSH
SSH connections store host, port, user and keys in the vault. Automated processes run approved command profiles. A free-form remote command from the model is off; a named profile is used instead.
WinRM / PSRP
WinRM and PowerShell Remoting (PSRP) are one Windows connection family. You store the host and choose WinRM or PSRP, keep passwords and certificates in the vault, then test the path or run approved Windows Ansible books. Same idea as SSH: a governed connection, not a shell in the request.
Terraform
A Terraform connection points at modules you have approved. Automated processes can validate, plan, apply and show the result. Destroy stays off unless the connection allows it and a person has approved. Typical work: a Proxmox VM, deploying or upgrading a stack, preparing an environment. Provider credentials — including Proxmox API tokens — stay in the organization vault. The run can be local or over an existing SSH connection.
Ansible
Ansible connections bind inventory and playbooks into governed automated process steps. A run uses an approved playbook, sensitive credential-referenced credentials and organization policy. Chat does not get a free ansible-playbook shell.
Ready to move beyond the chatbot?
Build AI that understands your business, works with your knowledge, follows your processes and can actually finish the job. You decide which actions are allowed, when a person must step in and how much AI usage your organization can consume.