Publish an app

Publishing takes about a minute: point DashX at an internal host and port, pick the connector that can reach it, and set who may open it.

Steps

1. Go to Secure Access → Private Access and click + Publish app. The Publish resource drawer slides in from the right.
2. Type — choose Web app (default) or TCP resource.
   • Web app: reachable in the browser at a generated *.access.<region>.dashxtech.com host, gated by SSO.
   • TCP resource: reached through the dashx-access local proxy (ssh, databases, RDP) — read the note at the bottom of this page first.
   • The type cannot be changed later; the buttons are greyed out when you edit an existing app.
3. Name — what users and the audit log will see, e.g. Internal Wiki. The hostname is derived from it.
4. Internal host — the address the connector uses, e.g. 10.0.0.20. A hostname works if the connector can resolve it.
5. Port — e.g. 443.
6. Scheme (connector → app) — web apps only: http or https. This is how the connector talks to the app; users always get HTTPS on the public side.
7. Connector — pick the agent that sits in the same network as the app. The list shows the device name of every DashX agent eligible to act as a connector.
8. Set the Policy fields — see Access policy. Require MFA is on by default.
9. Click Publish. You get "App published" and the card appears with its public hostname.

Test it

Open the hostname shown on the card in a fresh private/incognito window — that is the only reliable way to see what a real user sees, because your admin console session would otherwise be reused. You should get the DashX sign-in page (with your logo), then the app.

Then check the Recent access table: a row with decision allow and your identity should be there within seconds.

Editing and removing

• Edit reopens the same drawer. Everything except Type can be changed; saving also rewrites the policy.
• Disable keeps the definition but stops serving traffic — useful for maintenance.
• Delete removes the app; open sessions stop working immediately.

Common problems

What you see	Cause
unassigned on the card	No connector selected — edit the app and pick one
Sign-in works, then the page hangs or errors	The connector cannot reach internal_host:port. Test from the connector machine itself, e.g. curl -k https://10.0.0.20:443
Deny with not_in_allowed_group	The user's email or IdP group is not in Allowed users or groups
Deny with device_not_managed	Require managed device is on and the browser presented no DashX device certificate
Browser certificate picker appears	Expected when managed-device enforcement is on — the user picks their DashX certificate

TCP resources

The TCP resource type publishes the definition and the policy, but connecting to it needs the dashx-access local proxy client, which is not distributed from the console yet. The card shows the command dashx-access -resource <id> as a placeholder. Until the client ships, use Web app for anything you need today, and reach SSH/RDP through Fleet → device → Terminal / RDP instead.

tip

Self-signed certificates on the internal app are fine. The connector does not verify them — the trust boundary is the tunnel plus the policy, not the app's own certificate.