PRISM Ops: Multi-user AI Coding Gateway

An internal developer-platform sprint: give the team browser-based AI coding environments without handing out API keys or shell access to a shared box. Each authenticated user transparently gets their own sandboxed container. Built in one week, then retired once it had served its purpose.

What it did

Every request arrived through a Cloudflare Tunnel with a Cloudflare Access JWT, issued after login through Authentik. The gateway validated the token, derived a deterministic container name from the user's email, created the container if it did not exist, and proxied HTTP and WebSocket traffic to the AI coding environment inside it. LLM calls went through Cloudflare AI Gateway for unified billing and logging, with either shared or per-user credentials.

Notes

Stdlib net/http and log/slog, no web framework. Clean separation into auth, containers and proxy packages with documented config structs.
JWKS is cached with mutex-guarded refresh, and RSA public keys are rebuilt from the JWK components by hand rather than pulling in a dependency.
Because the email-to-container mapping is the only identity mapping, the filesystem layout is self-documenting and bulk provisioning is a twelve-line shell loop.
The README is a complete runbook: Docker install, the Authentik provider, the Cloudflare identity provider, Access application and tunnel configuration (including enabling WebSockets and the host header override), a systemd unit, and capacity planning.

The project is explicitly retired. Both product repositories carry a note not to add new dependencies on it.