fleet-ssh

A browser-based SSH & SFTP fleet manager — like Termius, but it runs from a single Python command.

Install

pip install fleet-ssh

Or from a checkout:

pip install -e .

Quick Start

fleet-ssh --init-config      # writes a starter servers.yaml
fleet-ssh                     # serves on http://localhost:7681

Then open http://localhost:7681.

By default fleet-ssh binds to 127.0.0.1 (this machine only). To reach it from other devices on a trusted network, run fleet-ssh --host 0.0.0.0 — note this makes every configured server reachable to anyone who can hit the port.

Configure Servers

Config lives at ~/.config/fleet-ssh/servers.yaml (override with --config or $FLEET_SSH_CONFIG). Authenticate with a password or a private key:

servers:
  - name: "My Server"
    host: "192.168.1.100"
    port: 22
    username: "admin"
    key_path: "~/.ssh/id_ed25519"   # preferred
    # password: "yourpassword"       # or a password
    # key_passphrase: "…"            # if the key is encrypted
    group: "Production"
    tags: ["web"]

You can also add / edit / delete servers from the web UI — changes are written back to servers.yaml. Each server keeps a stable id, so adding or removing one never disturbs your other sessions.

Use as a library

from fleet_ssh import create_app
import uvicorn

app = create_app(config_path="servers.yaml")
uvicorn.run(app, host="127.0.0.1", port=7681)

create_app(config_path=None, poll_interval=30, cors_origins=None) returns a standard FastAPI app you can mount, extend, or serve with any ASGI server.

Features

• SSH Terminal — full xterm.js terminal with color, resize, copy/paste
• SFTP Browser — browse, preview, download, delete files; create folders
• Multi-tab sessions — several SSH/SFTP sessions at once
• Server groups & tags — organize by environment
• Live reachability — background port checks with an up/down indicator
• Password or SSH-key auth

Security notes

• Passwords in servers.yaml are stored in plain text — prefer key_path.
• Credentials never leave the backend; the web UI is only ever sent host, port, username, group, and tags.
• Host keys are auto-accepted (AutoAddPolicy), so run this on networks you trust.
• There is no login on the web UI itself — keep the default localhost bind unless you put it behind your own auth/proxy.

Requirements

• Python 3.9+
• Installed automatically: fastapi, uvicorn, paramiko, pyyaml

Architecture

Browser (xterm.js + Fetch)
    ↕  WebSocket (SSH terminal)
    ↕  REST API  (SFTP + server management)
Python Backend (FastAPI)
    ↕  paramiko (SSH/SFTP)
Remote SSH Servers