nexusssh

<div align="center"> <img src="docs/assets/nexusssh-banner.svg" alt="NexusSSH — a centralized web-based SSH and Kubernetes manager with MCP support. Infrastructure credentials stay on your deployment." width="1200" />

⭐ If NexusSSH is useful to you, star the repository. It helps others find it.

Overview · Features · Screenshots · Getting started · AI and MCP · Documentation

<img src="docs/assets/screenshots/ssh-terminal.png" alt="NexusSSH workspace with a browser SSH terminal open next to the folder tree of servers and Kubernetes clusters" width="1000" /> </div>

Overview

NexusSSH is a self-hosted workspace for your servers and Kubernetes clusters. Save your connections once, then open terminals, browse files, run cluster commands, and manage team access from a browser.

It also ships with a built-in Model Context Protocol (MCP) server, so AI assistants can work on your infrastructure without ever receiving your SSH passwords, private keys, Kubernetes tokens, or kubeconfig files. Credentials stay encrypted on your deployment. AI clients connect with scoped, expiring, revocable tokens, and NexusSSH runs only the operations you have granted them. SSH operations run immediately within those grants; Kubernetes commands also execute immediately within those grants.

Features

| Area | Capabilities | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Centralized workspace | Nested folders for servers and clusters, search, tags, favorites, recent connections, split views, a command palette, and saved workspace presets. | | Browser SSH | Interactive terminals with pinned host keys, session resume, snippets, search, command suggestions, and broadcast input across sessions. | | Remote files | SFTP browsing, resumable uploads with progress, and a Monaco editor with change previews, conflict detection, and optional encrypted file history. | | Kubernetes | Kubeconfig import with context and namespace selection, a cluster command console, on-demand connection checks, resource browsing, and pod logs. | | AI access through MCP | Per-agent server, cluster, and tool grants, approval-free SSH commands and mutations, approval-free Kubernetes commands, call limits, token revocation, and per-agent activity. | | Private infrastructure | Reach targets through saved WireGuard profiles, an SSH bastion, or both. The same routes serve browser sessions and MCP operations. | | Team access | Users, teams, operation grants, TOTP MFA with recovery codes, and optional OIDC single sign-on. | | Operations | Versioned runbooks, staged connection diagnostics, readiness checks, a searchable audit log, and optional scheduled encrypted backups with restore rehearsal. |

Screenshots

<table> <tr> <td width="50%" valign="top"> <a href="docs/assets/screenshots/sftp-file-browser.png"><img src="docs/assets/screenshots/sftp-file-browser.png" alt="SFTP file browser listing a remote home directory with upload drop zone" /></a> <p align="center"><b>SFTP file browser</b><br/>_{Browse, upload, download, and edit remote files in the browser.}</p> </td> <td width="50%" valign="top"> <a href="docs/assets/screenshots/kubernetes-console.png"><img src="docs/assets/screenshots/kubernetes-console.png" alt="Kubernetes console listing kube-system pods for a saved cluster" /></a> <p align="center"><b>Kubernetes console</b><br/>_{Run kubectl-style commands against saved clusters, with no local kubeconfig.}</p> </td> </tr> <tr> <td width="50%" valign="top"> <a href="docs/assets/screenshots/mcp-server.png"><img src="docs/assets/screenshots/mcp-server.png" alt="MCP server settings showing the endpoint, client configuration, and available tools" /></a> <p align="center"><b>Built-in MCP server</b><br/>_{Point any remote HTTP MCP client at one endpoint with a scoped token.}</p> </td> <td width="50%" valign="top"> <a href="docs/assets/screenshots/ai-agents.png"><img src="docs/assets/screenshots/ai-agents.png" alt="AI Agents page listing registered agents with access, limits, and status" /></a> <p align="center"><b>AI agents</b><br/>_{Grant, limit, and revoke each agent's access to servers, clusters, and tools.}</p> </td> </tr> <tr> <td width="50%" valign="top"> <a href="docs/assets/screenshots/audit-log.png"><img src="docs/assets/screenshots/audit-log.png" alt="Audit log of terminal connections, Kubernetes commands, and agent tool calls" /></a> <p align="center"><b>Audit log</b><br/>_{Every sign-in, connection, and agent tool call, with request references.}</p> </td> <td width="50%" valign="top"> <a href="docs/assets/screenshots/vpn-profiles.png"><img src="docs/assets/screenshots/vpn-profiles.png" alt="VPN page listing WireGuard profiles and the servers that use them" /></a> <p align="center"><b>WireGuard routes</b><br/>_{Reach private networks through saved VPN profiles and bastions.}</p> </td> </tr> <tr> <td width="50%" valign="top"> <a href="docs/assets/screenshots/command-palette.png"><img src="docs/assets/screenshots/command-palette.png" alt="Command palette open over a terminal, with connect, details, and test actions per server" /></a> <p align="center"><b>Command palette</b><br/>_{Press <kbd>Ctrl</kbd>+<kbd>K</kbd> to connect, inspect, or test any server.}</p> </td> <td width="50%" valign="top"> <a href="docs/assets/screenshots/security-settings.png"><img src="docs/assets/screenshots/security-settings.png" alt="Security settings for host key policy and allowed SSH destinations" /></a> <p align="center"><b>Connection safeguards</b><br/>_{Host key policy and destination allowlists.}</p> </td> </tr> </table>

Getting started

Prerequisites

• Docker with Linux containers, on amd64 or arm64
• Docker Compose 2.24.4 or newer

Deploy with one command

curl -fsSL https://raw.githubusercontent.com/nooblk-98/nexusssh/main/docker-compose.yml -o docker-compose.yml && docker compose up -d

This pulls the prebuilt image from GitHub Container Registry and starts two containers: nexusssh (web UI, API, MCP server, and SSH worker behind one gateway) and redis. No .env file is needed to start.

| Image tag | Built from | | ----------------------------------------- | ------------------------------------------------ | | ghcr.io/nooblk-98/nexusssh:latest | The newest stable release (default) | | ghcr.io/nooblk-98/nexusssh:v0.5.0 | A specific release, also published as 0.5.0 | | ghcr.io/nooblk-98/nexusssh:0.4 | The newest patch release of a minor version | | ghcr.io/nooblk-98/nexusssh:development | The development branch, for early testing | | ghcr.io/nooblk-98/nexusssh:sha-<commit> | An exact commit, for pinning and rollback |

To run another tag, set NEXUSSSH_IMAGE, for example NEXUSSSH_IMAGE=ghcr.io/nooblk-98/nexusssh:development docker compose up -d. To upgrade, run docker compose pull && docker compose up -d.

First sign-in

1. Open http://<your-host>:8080.
2. Copy the first-run setup token from docker compose logs nexusssh, then create your owner account. No default password is shipped.
3. Add an SSH identity and a server, or import a Kubernetes kubeconfig. Verify SSH host fingerprints through a trusted console before saving them.
4. Under Settings → Security, allow the networks your targets live in, then test the connection. Pick a WireGuard profile or bastion if the target needs one.
5. Open a terminal, an SFTP session, or a cluster console.

Installation secrets are generated on first start and kept in the nexusssh_secrets volume. Application records live in nexusssh_data.

[!IMPORTANT] Back up both volumes. Losing the encryption key makes saved credentials unrecoverable, and docker compose down -v deletes them.

[!WARNING] The app serves plain HTTP on port 8080. For a shared or internet-facing installation, put a TLS-terminating reverse proxy in front, set a stable APP_URL, and restrict SSH_ALLOWED_CIDRS and KUBERNETES_ALLOWED_CIDRS by following the deployment guide.

Optional settings

docker-compose.yml sets only what the container needs. Set these from your shell or a .env file next to it:

| Variable | Default | Purpose | | ------------------- | ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | APP_URL | Unset: serve whatever address the app is reached on | Public HTTPS address, such as https://nexusssh.example.com. Fixes the allowed browser origin and the MCP endpoint (<APP_URL>/mcp). | | HTTP_PORT | 8080 | Host port the gateway publishes. | | NEXUSSSH_IMAGE | ghcr.io/nooblk-98/nexusssh:latest | Image tag to run. |

Everything else is optional and has a working default. Cloud metadata addresses such as 169.254.169.254 are always refused, whatever the allowlists say. To set any of these, create a docker-compose.override.yml beside docker-compose.yml. Docker Compose merges it automatically, and replacing docker-compose.yml on upgrade leaves it in place:

services:
  nexusssh:
    environment:
      OIDC_ISSUER: https://login.example.com
      OIDC_CLIENT_ID: nexusssh
      OIDC_CLIENT_SECRET: change-me

| Variable | Default | Purpose | | -