Local-first configuration review
Compare resources and ACL rules across OneGate environments.
Import 1–5 config exports. Use one for a single-file ACL browser and export, or two or more to compare resources across environments. Files are read in your browser, parsed in a worker, and reduced to a redacted result. Nothing is uploaded or saved.
You need root access to the OneGate server or an already extracted backup. This tool reads plain-text config files only. It does not decrypt .bup backup files, and backup decryption is deliberately out of scope.
Environments
Give each environment a name and add its config file or files. File names do not matter. Leave a card empty to work with one file; the ACL browser and export work in single-file mode too.
How this application handles your data
No upload. The file picker and drag-and-drop use the browser File API. The server only serves static HTML, CSS and JavaScript; there is no upload endpoint, database or write path.
In memory only. Parsed configuration lives in a Web Worker in this tab. There is no localStorage, sessionStorage, IndexedDB or cookie storage. Refreshing or closing the tab clears everything.
Secrets are reduced before rendering. Passwords, keys, tokens and client secrets are compared in the worker and replaced with an opaque marker. Secret values are never put in the page, an export or a log.
What this cannot protect against. The browser and device are trusted endpoints. Developer tools or a malicious extension can inspect page memory while files are loaded. Non-secret configuration is still sensitive, and JavaScript memory cannot be guaranteed to be zeroized.
Resources
Resource profiles are assembled by name from resource settings, host entries, menus, cache rules and both ACL sources. Tick Ignore on a compared field to exclude that field path from every resource in this comparison; restore it from Ignored fields.
ACL rules
All ACL rules from every resource, from both the ACL table and the detailed access-control list. Click a row or its source badge to see the exact service and every rule field. Filter the view, then export everything or only the filtered rules.
Columns 0
Schema drift
Sections present in one config but not another are shown separately from resource differences. This is expected when environments run different OneGate versions.
Security & privacy
The application is intentionally serverless for configuration data.
Data flow
File picker / drop
│
▼
Browser File API ──► Web Worker ──► parser ──► comparison
│
├── secrets compared in memory
└── redacted result
│
▼
DOM / export
Guarantees
- No upload endpoint; the static server has no write path.
- No browser storage for configuration data. Global field exclusions are session-only and cleared by Forget.
- Classified secret values never reach the page, exports or logs.
- Password, secret, token and key-name suffix matching also covers nested resource and ACL fields.
- JSON parse errors never echo configuration content, and the worker clears its raw secret vault after parsing.
- Configuration values are rendered as text, never as HTML.
- No third-party scripts, fonts, analytics or telemetry.
- Exports are generated in the browser with a Blob.
Limits
- The browser and device are trusted endpoints; developer tools or extensions can inspect memory.
- JavaScript memory cannot be reliably zeroized.
- Secret detection is not omniscient; the redaction review exists for that reason.
- Global field exclusions suppress differences in every resource for the current comparison. Review the Ignored fields list before treating a result as clean.
- Non-secret configuration, group DNs, internal IPs and resource names are still sensitive.
- If exposed beyond localhost, use HTTPS and reverse-proxy authentication.
Getting the config files
You need root access to the OneGate server or an already extracted backup. This application does not decrypt .bup backup files and will not implement decryption. Extract the plain-text configuration with your own procedure before importing it.
Exports
ACL exports contain resource names, virtual hosts, group DNs, IP addresses and rule metadata. They contain no secret values, but they are still sensitive infrastructure documents. Store and share them accordingly.