diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a207de0..cb2a696 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -37,6 +37,14 @@ updates:
major-updates:
update-types:
- "major"
+ ignore:
+ # typescript-eslint declares `typescript: >=4.8.4 <6.1.0`, and TypeScript 7
+ # removed `ts.Extension`, which @typescript-eslint/typescript-estree reads
+ # at import time. Bumping to 7 makes `eslint .` fail to load its own config,
+ # so `npm run lint` cannot run at all. Drop this once typescript-eslint
+ # supports TypeScript 7.
+ - dependency-name: "typescript"
+ update-types: ["version-update:semver-major"]
# Docker base images (docker/Dockerfile + docker-compose / compose-dev)
- package-ecosystem: "docker"
diff --git a/.github/workflows/beta-release.yml b/.github/workflows/beta-release.yml
index 4f18967..bf771ed 100644
--- a/.github/workflows/beta-release.yml
+++ b/.github/workflows/beta-release.yml
@@ -28,7 +28,7 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
@@ -67,7 +67,7 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "npm"
@@ -78,11 +78,8 @@ jobs:
- name: Run ESLint
run: npx eslint .
- - name: Run Prettier check
- run: npx prettier --check .
-
- name: Type check
- run: npx tsc --noEmit
+ run: npm run type-check
- name: Run unit tests
run: npm run test
@@ -121,7 +118,7 @@ jobs:
CHANGES=$(git log --oneline --no-merges "${{ steps.prev.outputs.sha }}..${{ needs.prep.outputs.sha }}" -- . ':!package-lock.json' | sed 's/^/- /')
fi
if [ -z "$CHANGES" ]; then
- CHANGES="- No new commits since the last beta (or this is the first beta build)."
+ CHANGES="- No new commits since the last beta."
fi
cat > BETA_RELEASE_BODY.md << EOF
@@ -157,7 +154,7 @@ jobs:
docker:
needs: [prep, verify, create-release]
- if: ${{ always() && needs.prep.outputs.dev_branch != '' && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped') }}
+ if: ${{ always() && needs.prep.outputs.dev_branch != '' && needs.verify.result == 'success' && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped') }}
uses: ./.github/workflows/docker.yml
with:
version: ${{ needs.prep.outputs.beta_version }}
diff --git a/.github/workflows/crowdin-sync.yml b/.github/workflows/crowdin-sync.yml
new file mode 100644
index 0000000..2a63ea1
--- /dev/null
+++ b/.github/workflows/crowdin-sync.yml
@@ -0,0 +1,83 @@
+name: Crowdin Sync
+
+on:
+ schedule:
+ - cron: "0 6 * * *"
+ workflow_dispatch:
+ inputs:
+ branch:
+ description: "Branch to sync translations into"
+ required: false
+ type: string
+
+permissions:
+ contents: write
+
+jobs:
+ crowdin:
+ runs-on: blacksmith-2vcpu-ubuntu-2404
+ steps:
+ - name: Resolve target branch
+ id: branch
+ run: |
+ BRANCH="${{ inputs.branch }}"
+ if [ -z "$BRANCH" ]; then
+ BRANCH="${{ github.event.repository.default_branch }}"
+ fi
+ echo "name=$BRANCH" >> "$GITHUB_OUTPUT"
+
+ - name: Checkout branch
+ uses: actions/checkout@v7
+ with:
+ ref: ${{ steps.branch.outputs.name }}
+ fetch-depth: 0
+ token: ${{ secrets.GHCR_TOKEN }}
+
+ - name: Setup Node.js
+ uses: actions/setup-node@v7
+ with:
+ node-version-file: ".nvmrc"
+
+ - name: Upload sources to Crowdin
+ uses: crowdin/github-action@v2
+ with:
+ upload_sources: true
+ upload_translations: false
+ download_translations: false
+ create_pull_request: false
+ push_translations: false
+ token: ${{ secrets.CROWDIN_API_KEY }}
+ project_id: "858252"
+ env:
+ CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
+
+ - name: Machine pre-translate untranslated strings
+ env:
+ CROWDIN_API_KEY: ${{ secrets.CROWDIN_API_KEY }}
+ run: node scripts/crowdin-pretranslate.cjs
+
+ - name: Download translations from Crowdin
+ uses: crowdin/github-action@v2
+ with:
+ upload_sources: false
+ upload_translations: false
+ download_translations: true
+ create_pull_request: false
+ push_translations: false
+ token: ${{ secrets.CROWDIN_API_KEY }}
+ project_id: "858252"
+ env:
+ CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
+
+ - name: Commit translations
+ run: |
+ git config user.name "LukeGus"
+ git config user.email "bugattiguy527@gmail.com"
+
+ git add src/ui/locales/translated
+ if git diff --cached --quiet; then
+ echo "No translation changes to commit."
+ exit 0
+ fi
+ git commit -m "chore: sync Crowdin translations"
+ git push origin HEAD:"${{ steps.branch.outputs.name }}"
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 4b5ae3f..109e7a4 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -43,6 +43,7 @@ on:
jobs:
build:
runs-on: ubuntu-latest
+ timeout-minutes: 20
permissions:
contents: read
packages: write
diff --git a/.github/workflows/electron.yml b/.github/workflows/electron.yml
index 324cc50..27b1a4f 100644
--- a/.github/workflows/electron.yml
+++ b/.github/workflows/electron.yml
@@ -72,11 +72,48 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "npm"
+ - name: Install Spectre-mitigated MSVC libraries
+ shell: pwsh
+ run: |
+ # node-pty's binding.gyp sets SpectreMitigation, so MSBuild refuses to
+ # build without these. They are not on the runner image by default.
+ $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+ $installPath = & $vswhere -latest -products * -property installationPath
+ if (-not $installPath) { throw "Visual Studio installation not found" }
+
+ # Derive the toolset version from the installed MSVC so the component
+ # id keeps matching when the runner image bumps the compiler.
+ $toolsetDir = Get-ChildItem -Path "$installPath\VC\Tools\MSVC" -Directory |
+ Sort-Object Name -Descending | Select-Object -First 1
+ if (-not $toolsetDir) { throw "No MSVC toolset found under $installPath" }
+ $parts = $toolsetDir.Name.Split(".")
+ $shortVer = "$($parts[0]).$($parts[1].Substring(0,2))"
+ Write-Host "MSVC toolset $($toolsetDir.Name) -> component version $shortVer"
+
+ $installer = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vs_installer.exe"
+ $components = @(
+ "Microsoft.VisualStudio.Component.VC.$shortVer.17.14.x86.x64.Spectre",
+ "Microsoft.VisualStudio.Component.VC.Runtimes.x86.x64.Spectre"
+ )
+ $args = @("modify", "--installPath", "`"$installPath`"", "--quiet", "--norestart", "--nocache")
+ foreach ($c in $components) { $args += @("--add", $c) }
+
+ Write-Host "Installing: $($components -join ', ')"
+ $proc = Start-Process -FilePath $installer -ArgumentList $args -Wait -PassThru -NoNewWindow
+ if ($proc.ExitCode -ne 0 -and $proc.ExitCode -ne 3010) {
+ Write-Host "vs_installer exited with $($proc.ExitCode); verifying libraries anyway"
+ }
+
+ $found = Get-ChildItem -Path "$installPath\VC\Tools\MSVC" -Recurse -Filter "*.lib" -ErrorAction SilentlyContinue |
+ Where-Object { $_.FullName -match "\\spectre\\" } | Select-Object -First 1
+ if (-not $found) { throw "Spectre-mitigated libraries still missing after install" }
+ Write-Host "Spectre libs present: $($found.FullName)"
+
- name: Install dependencies
run: npm ci
@@ -166,7 +203,7 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "npm"
@@ -380,7 +417,7 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "npm"
@@ -559,7 +596,7 @@ jobs:
CHECKSUM=$(shasum -a 256 "$DMG_PATH" | awk '{print $1}')
mkdir -p homebrew-generated
- cp packaging/Casks/termix.rb homebrew-generated/termix.rb
+ cp Casks/termix.rb homebrew-generated/termix.rb
sed -i '' "s/VERSION_PLACEHOLDER/$VERSION/g" homebrew-generated/termix.rb
sed -i '' "s/CHECKSUM_PLACEHOLDER/$CHECKSUM/g" homebrew-generated/termix.rb
@@ -894,7 +931,7 @@ jobs:
mkdir -p homebrew-submission/Casks/t
- cp packaging/Casks/termix.rb homebrew-submission/Casks/t/termix.rb
+ cp Casks/termix.rb homebrew-submission/Casks/t/termix.rb
sed -i '' "s/VERSION_PLACEHOLDER/$VERSION/g" homebrew-submission/Casks/t/termix.rb
sed -i '' "s/CHECKSUM_PLACEHOLDER/$CHECKSUM/g" homebrew-submission/Casks/t/termix.rb
@@ -966,7 +1003,7 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "npm"
@@ -1075,13 +1112,21 @@ jobs:
default_platform(:mac)
lane :fetch_build_number do
- number = app_store_build_number(
- live: false,
+ live_number = app_store_build_number(
+ live: true,
+ platform: "osx",
api_key_path: "/tmp/asc_keys/api_key.json",
app_identifier: "com.karmaa.termix",
- version: "$APP_VERSION",
initial_build_number: 0,
)
+ pending_number = app_store_build_number(
+ live: false,
+ platform: "osx",
+ api_key_path: "/tmp/asc_keys/api_key.json",
+ app_identifier: "com.karmaa.termix",
+ initial_build_number: 0,
+ )
+ number = [live_number, pending_number].max
File.write("$OUT_FILE", number.to_s)
end
EOF
@@ -1109,6 +1154,18 @@ jobs:
BUILD_VERSION="${{ steps.build_number.outputs.build_version || github.run_number }}"
npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
+ - name: Generate App Store release notes
+ id: asc_notes
+ if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
+ run: |
+ META_DIR="$RUNNER_TEMP/asc_metadata"
+ rm -rf "$META_DIR"
+ node scripts/generate-appstore-notes.cjs \
+ --notes RELEASE_NOTES.md \
+ --out-dir "$META_DIR" \
+ --locales "en-US"
+ echo "metadata_path=$META_DIR" >> "$GITHUB_OUTPUT"
+
- name: Upload and submit to Mac App Store
if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
run: |
@@ -1125,10 +1182,16 @@ jobs:
--pkg "$PKG_FILE" \
--api_key_path "$API_KEY_JSON" \
--app_version "$VERSION" \
- --skip_metadata true \
+ --platform osx \
+ --app_identifier "com.karmaa.termix" \
+ --skip_metadata false \
+ --metadata_path "${{ steps.asc_notes.outputs.metadata_path }}" \
--skip_screenshots true \
+ --skip_app_version_update false \
--submit_for_review true \
--automatic_release true \
+ --precheck_include_in_app_purchases false \
+ --submission_information "{\"export_compliance_uses_encryption\": false}" \
--force true
- name: Clean up keychains
diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml
index c76952d..54f1486 100644
--- a/.github/workflows/openapi.yml
+++ b/.github/workflows/openapi.yml
@@ -13,7 +13,7 @@ jobs:
uses: actions/checkout@v7
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "npm"
diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml
index 2e48e16..727c51e 100644
--- a/.github/workflows/pr-check.yml
+++ b/.github/workflows/pr-check.yml
@@ -16,7 +16,7 @@ jobs:
uses: actions/checkout@v7
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "npm"
@@ -24,14 +24,89 @@ jobs:
- name: Install dependencies
run: npm ci
- - name: Run ESLint
- run: npx eslint .
+ - name: Lint
+ # npm run lint, not npx eslint โ the script also checks that the
+ # generated dialect schemas match schema.ts, which eslint cannot see.
+ run: npm run lint
- name: Run Prettier check
run: npx prettier --check .
- name: Type check
- run: npx tsc --noEmit
+ run: npm run type-check
- name: Build
run: npm run build
+
+ database-dialects:
+ name: Postgres and MySQL
+ runs-on: blacksmith-2vcpu-ubuntu-2404
+
+ # The test suite only ever sees SQLite. Everything that differs per engine โ
+ # the RETURNING replacements, the read-then-write transactions, the
+ # migrations themselves โ is only covered here, against real servers.
+ services:
+ postgres:
+ image: postgres:16
+ env:
+ POSTGRES_USER: termix
+ POSTGRES_PASSWORD: termix
+ POSTGRES_DB: termix_test
+ ports:
+ - 5432:5432
+ options: >-
+ --health-cmd pg_isready
+ --health-interval 10s
+ --health-timeout 5s
+ --health-retries 5
+
+ mysql:
+ image: mysql:8
+ env:
+ MYSQL_ROOT_PASSWORD: termix
+ MYSQL_DATABASE: termix_test
+ MYSQL_USER: termix
+ MYSQL_PASSWORD: termix
+ ports:
+ - 3306:3306
+ options: >-
+ --health-cmd "mysqladmin ping -h 127.0.0.1 -ptermix"
+ --health-interval 10s
+ --health-timeout 5s
+ --health-retries 10
+
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v7
+
+ - name: Setup Node.js
+ uses: actions/setup-node@v7
+ with:
+ node-version-file: ".nvmrc"
+ cache: "npm"
+
+ - name: Install dependencies
+ run: npm ci
+
+ # Each run applies the migrations to an empty database first, so a
+ # migration that does not apply cleanly fails the build.
+ - name: Verify Postgres
+ run: npm run verify:dialect -- postgres://termix:termix@127.0.0.1:5432/termix_test
+
+ - name: Verify MySQL
+ run: npm run verify:dialect -- mysql://termix:termix@127.0.0.1:3306/termix_test
+
+ # The same repository suite the SQLite run executes, pointed at each
+ # engine. This is where a dialect difference in a query shows up as a
+ # failing assertion rather than as a bug report.
+ - name: Repository tests on Postgres
+ env:
+ TEST_DIALECT: postgres
+ TEST_DATABASE_URL: postgres://termix:termix@127.0.0.1:5432/termix_test
+ run: npx vitest run src/backend/tests/database/repositories --no-file-parallelism
+
+ - name: Repository tests on MySQL
+ env:
+ TEST_DIALECT: mysql
+ TEST_DATABASE_URL: mysql://termix:termix@127.0.0.1:3306/termix_test
+ run: npx vitest run src/backend/tests/database/repositories --no-file-parallelism
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cf89c5a..f59c5a9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
@@ -92,7 +92,7 @@ jobs:
token: ${{ secrets.GHCR_TOKEN }}
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "npm"
@@ -144,7 +144,7 @@ jobs:
token: ${{ secrets.GHCR_TOKEN }}
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
@@ -225,7 +225,7 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
@@ -304,7 +304,7 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
@@ -395,10 +395,10 @@ jobs:
git fetch origin main
git checkout -B main origin/main
- sed -i "s|version \".*\"|version \"$VERSION\"|g" packaging/Casks/termix.rb
- sed -i "s|sha256 \".*\"|sha256 \"$DMG_SHA256\"|g" packaging/Casks/termix.rb
+ sed -i "s|version \".*\"|version \"$VERSION\"|g" Casks/termix.rb
+ sed -i "s|sha256 \".*\"|sha256 \"$DMG_SHA256\"|g" Casks/termix.rb
- git add packaging/Casks/termix.rb
+ git add Casks/termix.rb
if git diff --cached --quiet; then
echo "Cask already up to date."
exit 0
@@ -420,7 +420,7 @@ jobs:
path: termix
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: "termix/.nvmrc"
cache: "npm"
@@ -443,13 +443,21 @@ jobs:
- name: Create docs release branch
working-directory: docs-repo
- run: git checkout -B "dev-${{ needs.prep.outputs.version }}"
+ run: |
+ BRANCH="dev-${{ needs.prep.outputs.version }}"
+ if git ls-remote --exit-code origin "refs/heads/$BRANCH" >/dev/null 2>&1; then
+ echo "Reusing existing docs branch $BRANCH."
+ git checkout -B "$BRANCH" "origin/$BRANCH"
+ else
+ git checkout -B "$BRANCH"
+ fi
- name: Overwrite OpenAPI spec and regenerate API docs
working-directory: docs-repo
run: |
cp ../termix/openapi.json static/openapi.json
npm ci
+ npm run docusaurus clean-api-docs termix
npm run docusaurus gen-api-docs termix
- name: Commit and push docs branch
@@ -471,7 +479,7 @@ jobs:
git add -A
git commit -m "feat: update API docs for ${{ needs.prep.outputs.version }}"
- git push --force origin "dev-${{ needs.prep.outputs.version }}"
+ git push origin "dev-${{ needs.prep.outputs.version }}"
- name: Open and squash-merge docs PR
if: ${{ inputs.mode != 'Dry run' }}
@@ -513,7 +521,7 @@ jobs:
fetch-depth: 1
- name: Setup Node.js
- uses: actions/setup-node@v6
+ uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
@@ -534,7 +542,7 @@ jobs:
docs,
publish-youtube,
]
- if: ${{ always() && (inputs.mode == 'Everything' || inputs.mode == 'Skip submit') && needs.merge-to-main.result == 'success' && needs.electron-release.result == 'success' }}
+ if: ${{ always() && (inputs.mode == 'Everything' || inputs.mode == 'Skip submit') && needs.merge-to-main.result == 'success' && needs.docs.result == 'success' }}
runs-on: blacksmith-2vcpu-ubuntu-2404
steps:
- name: Checkout repository
diff --git a/.gitignore b/.gitignore
index d9251b2..cfb1233 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,7 +13,8 @@ dist-ssr
coverage
*.local
-.vscode/
+.vscode/*
+!.vscode/settings.json
.idea
.DS_Store
*.suo
@@ -33,5 +34,7 @@ electron/build-info.cjs
/.mcp.json
/CLAUDE.md
/old_db/
-/scripts/fix-bugs.mjs
-/scripts/fix-features.mjs
+/scripts/auto-fix.mjs
+/scripts/auto-fix-blocklist.json
+/scripts/auto-fix-state.json
+/scripts/auto-fix-report-*.json
diff --git a/.husky/commit-msg b/.husky/commit-msg
index 0a4b97d..da99483 100644
--- a/.husky/commit-msg
+++ b/.husky/commit-msg
@@ -1 +1 @@
-npx --no -- commitlint --edit $1
+npx --no -- commitlint --edit "$1"
diff --git a/.prettierignore b/.prettierignore
index befe2e1..8cf32b0 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -17,3 +17,6 @@ db
*.min.js
*.min.css
openapi.json
+
+# Generated by drizzle-kit; formatting is the tool's own
+drizzle/
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 0000000..dff3ab4
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,22 @@
+{
+ "editor.formatOnSave": true,
+ "editor.defaultFormatter": "esbenp.prettier-vscode",
+ "prettier.prettierPath": "./node_modules/prettier",
+ "editor.codeActionsOnSave": {
+ "source.fixAll.eslint": "explicit"
+ },
+ "eslint.validate": [
+ "javascript",
+ "javascriptreact",
+ "typescript",
+ "typescriptreact"
+ ],
+ "files.eol": "\n",
+ "files.insertFinalNewline": true,
+ "files.trimTrailingWhitespace": true,
+ "[markdown]": {
+ "files.trimTrailingWhitespace": false
+ },
+ "typescript.tsdk": "node_modules/typescript/lib",
+ "typescript.enablePromptUseWorkspaceTsdk": true
+}
diff --git a/packaging/Casks/termix.rb b/Casks/termix.rb
similarity index 87%
rename from packaging/Casks/termix.rb
rename to Casks/termix.rb
index 9e42e20..7458d04 100644
--- a/packaging/Casks/termix.rb
+++ b/Casks/termix.rb
@@ -1,6 +1,6 @@
cask "termix" do
- version "2.5.1"
- sha256 "39f88b6fb6f8841496fe689968decbbc4f4baa92ab5a3a41a738123cf7daeb3f"
+ version "2.7.0"
+ sha256 "8cdae5cf5ce2786e35a1a676dec51974cfca318a5595bc743981a4c373515059"
url "https://github.com/Termix-SSH/Termix/releases/download/release-#{version}-tag/termix_macos_universal_dmg.dmg"
name "Termix"
diff --git a/README.md b/README.md
index 6ec9996..95c175b 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
Termix
-Self-hosted SSH management and remote desktop access
+Self-hosted server management, from SSH and remote desktop to automations
English ยท
@@ -58,7 +58,7 @@ Termix is free and open source. If you find it useful, consider [donating](https
## Overview
-Termix is an open-source, forever-free, self-hosted all-in-one server management platform. It provides a multi-platform solution for managing your servers and infrastructure through a single, intuitive interface. Termix offers SSH terminal access, remote desktop control (RDP, VNC, Telnet), SSH tunneling capabilities, remote file management, and many other tools. Termix is the perfect free and self-hosted alternative to Termius available for all platforms.
+Termix is a free, open source, self-hosted platform for managing your servers. It puts SSH terminals, remote desktops (RDP, VNC, Telnet), file transfers, tunnels, Docker, metrics, and automations in one place, on web, desktop, and mobile. It is a self-hosted alternative to Termius that stays free forever.
-**SSH Terminal Access:**
-Full-featured terminal with split-screen support (up to 4 panels) with a browser-like tab system. Includes support for customizing the terminal including common terminal themes, fonts, and other components.
+**SSH Terminal:**
+A full terminal with browser-like tabs and split screen, up to 6 panels at once. Pick your theme, font, and colors. A toolbar sits above each session with live CPU, memory, and disk, plus quick links to that host's files, Docker, tunnels, and metrics.
-**Remote Desktop Access:**
-RDP, VNC, and Telnet support over the browser with complete customization and split screening.
+**Remote Desktop:**
+RDP, VNC, and Telnet in the browser, in tabs and split screen like any other session. Includes a file browser for RDP drives and drag-and-drop upload. On Windows desktop you can also open a host in the native RDP client.
-**SSH Tunnel Management:**
-Create and manage server-to-server SSH tunnels with automatic reconnection, health monitoring, and local, remote, or dynamic SOCKS forwarding. Desktop client-to-server tunnel settings are stored locally per desktop install, optional C2S preset snapshots can be saved to the server, renamed, loaded, or deleted when you want to move a local tunnel configuration between clients.
+**SSH Tunnels:**
+Local, remote, and dynamic SOCKS forwarding with auto reconnect and health checks. Client-to-server tunnels on the desktop app are stored on that machine, and you can save presets to the server to move a setup to another client.
-**Remote File Manager:**
-Manage files directly on remote servers with support for viewing and editing code, images, audio, and video. Upload, download, rename, delete, and move files seamlessly with sudo support. Includes support for moving files from server to server.
+**File Manager:**
+Browse, edit, upload, download, rename, move, and delete files over SFTP, with sudo support. View and edit code, images, audio, and video. Copy files straight from one server to another, with the fastest route picked for you and transfers checked for integrity.
-**Docker and Podman Management:**
-Start, stop, pause, remove containers. View container stats. Control containers using a docker exec terminal. Supports both Docker and Podman as the container runtime. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.
+**Docker and Podman:**
+Start, stop, pause, and remove containers, watch their stats, and open a shell inside one. Works with both Docker and Podman. It is not meant to replace Portainer or Dockge, just to manage containers you already have.
-**SSH Host Manager:**
-Save, organize, and manage your SSH connections with tags and folders (folder customization and nested folder support), and easily save reusable login info while being able to automate the deployment of SSH keys.
+**Host Manager:**
+Save and organize hosts with tags and nested folders you can name and color. Reuse saved credentials across hosts, deploy SSH keys automatically, group hosts under a parent host, bulk edit and export, and use Quick Connect for one-off connections you do not want to save.
@@ -111,83 +111,139 @@ Save, organize, and manage your SSH connections with tags and folders (folder cu
**Host Metrics:**
-View CPU, memory, disk usage, network, uptime, system information, firewall, port monitor, log viewer, users/permissions, certificates, and many more which work on most Linux based servers. Includes time-series history graphs and threshold-based alerts with ntfy and webhook support.
+CPU, memory, disk, network, temperature, uptime, processes, ports, logins, and system info on most Linux servers, with history graphs. Manager cards let you handle services, cron jobs, packages, users, firewall rules, WireGuard, Tailscale, SSL certs, logs, and health checks without leaving Termix.
-**User Authentication:**
-Secure user management with admin controls (can edit other users information) and OIDC/LDAP/SSO (with access control), 2FA (TOTP), and passkey (WebAuthn) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together. View audit log of all users actions.
+**Automations:**
+Pick a trigger, then say what should happen. Triggers include a metric crossing a threshold, a host going up or down, a health check changing, a schedule, a container event, or an incoming webhook. Steps can run commands and snippets, control containers and tunnels, wake a host, call a URL, wait, branch on a condition, run another automation, and notify you over ntfy, Discord, or a webhook. Test runs let you try it safely first.
-**Tailscale Integration:**
-List devices from your tailnet to quickly add them as hosts, and connect using Tailscale SSH as an authentication method, letting your tailnet ACLs handle authorization without storing credentials.
+**Fleets:**
+Group hosts into a fleet by picking them or with tag rules, so new hosts join on their own. Run one command on every host at once, push and pull files across all of them, install packages, and collect an inventory of OS, kernel, arch, and uptime.
-**RBAC/Sharing:**
-Create roles and share hosts across users/roles. Supports all auth types and all host protocols.
+**AI Assistant:**
+Optional, and off until you turn it on. Connect OpenAI, Anthropic, Gemini, Ollama, or any OpenAI compatible endpoint and ask about your setup. It reads hosts, fleets, snippets, and alerts, and proposes changes for you to approve instead of making them. It can never touch credentials, users, or settings. Admins can leave it off for the whole instance, and you can hide it during setup.
-**Serial Connections:**
-Connect to serial devices (routers, switches, microcontrollers, etc.) directly from the browser or desktop app. Configure baud rate, data bits, stop bits, and parity. Uses the Web Serial API in supported browsers or a native backend in the Electron app.
+**Login and Users:**
+Local accounts plus OIDC, LDAP, GitHub, and Google sign-in, with 2FA (TOTP), passkeys (WebAuthn), and trusted devices. Admins can manage users, map OIDC groups to roles, see every active session across platforms, and revoke them. Link your local and OIDC accounts together, and read the audit log of what everyone did.
+**Roles and Sharing:**
+Create roles and share hosts with users or roles at four levels: connect, view, edit, and manage. Works with every auth type and every protocol, and you can override the credentials used for a shared host.
+
+
+
+
+
+
**Alerts:**
-Set threshold-based alert rules on host metrics (CPU, memory, disk, etc.) and get notified via ntfy or webhooks when they fire. View firing and resolved alerts in a history log.
+Set rules on host metrics like CPU, memory, and disk, and get notified over ntfy, Discord, or a webhook when they fire. See firing and resolved alerts in a history log, and dismiss the ones you do not care about.
-
-
**Homepage:**
-A fully customizable homepage with a drag-and-drop widget grid. Add widgets for host status, service links, clocks, notes, RSS feeds, weather, Docker containers, host metrics charts, embedded terminals, iframes, and more.
-
-
-
-
-**Database Encryption:**
-Backend stored as encrypted SQLite database files. View [docs](https://docs.termix.site/security) for more.
+A drag-and-drop widget grid you build yourself. Widgets for host status, pings, service links, bookmarks, search, clocks, calendars, countdowns, notes, RSS, weather, images, iframes, Docker, tunnels, metrics charts, custom APIs, and even a live terminal.
-**Network Graph:**
-Customize your Dashboard to visualize your homelab based off your SSH connections with status support.
+**Snippets and Tools:**
+Save commands you run often and fire them off in one click, with variables for the host and your own inputs. Run a single command across every open terminal, and search your command history with autocomplete.
-**SSH Tools:**
-Create reusable command snippets that execute with a single click. Run one command simultaneously across multiple open terminals.
+**Session Sharing:**
+Share a live terminal, RDP, VNC, or Telnet session in real time. Send a link anyone can join without an account, or share with a specific Termix user, in read-only or read-write mode. Shares can expire on their own or be revoked, and can be turned off globally or per host.
-**Persistent Tabs:**
-SSH sessions and tabs stay open across devices/refreshes if enabled in user profile.
+**Session Recording and Logs:**
+Record terminal, RDP, and VNC sessions and play them back later. Download plain text logs of a session, and check the connection log to see exactly what happened during a connection.
+
+
+
+
+**Serial Connections:**
+Talk to serial devices like routers, switches, and microcontrollers from the browser or desktop app. Set baud rate, data bits, stop bits, and parity. Uses the Web Serial API in supported browsers, or a native backend in the desktop app.
+
+
+
+
+
+
+**Tailscale:**
+Pull devices from your tailnet to add them as hosts in a couple of clicks, and connect with Tailscale SSH so your tailnet ACLs handle access and no credentials are stored. Headscale and custom endpoints work too.
+
+
+
+
+**Proxmox:**
+Import hosts straight from a Proxmox instance, and watch node and guest stats, including CPU, memory, and storage, in their own tab.
+
+
+
+
+
+
+**Workspaces and Tabs:**
+Save a set of tabs with their split layout and reopen the whole thing in one click. Termix also remembers your last session, so your tabs come back across refreshes and devices.
+
+
+
+
+**Guided Setup:**
+A short setup walks you through picking an interface preset, your theme, the features you want, and your first host. Simple mode hides what you do not use, and you can rerun setup or switch presets any time.
+
+
+
+
+
+
+**Desktop Standalone and Sync:**
+The desktop app runs on its own with a local backend and database, no server needed. You can also connect it to a Termix server for two-way sync of hosts, credentials, snippets, and more, and choose whether connections start locally or through the server.
+
+
+
+
+**Command Line Interface:**
+A `termix` CLI for your shell and your scripts. Open terminals, run a command on one host or a whole fleet, move files over SFTP, and manage hosts, snippets, and credentials. Install with `npm install -g @termix-cli/cli` or grab a standalone binary. See the [CLI docs](https://docs.termix.site/cli).
+
+
+
+
+
+
+**Security:**
+Passwords, keys, and other secrets are encrypted per user, and the database files themselves can be encrypted on disk. See the [docs](https://docs.termix.site/security) for how it works.
**Languages:**
-Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/translations)).
+Around 30 languages built in, managed through [Crowdin](https://docs.termix.site/translations).
@@ -199,17 +255,20 @@ Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/tr
More features
-
-
@@ -340,14 +421,17 @@ Interested in a paid placement to support development? Email [mail@termix.site](
-
+
+
+
Termix
-ุฅุฏุงุฑุฉ SSH ุฐุงุชูุฉ ุงูุงุณุชุถุงูุฉ ูุงููุตูู ุฅูู ุณุทุญ ุงูู
ูุชุจ ุงูุจุนูุฏ
+ุฅุฏุงุฑุฉ ุฎูุงุฏู
ุฐุงุชูุฉ ุงูุงุณุชุถุงูุฉุ ู
ู SSH ูุณุทุญ ุงูู
ูุชุจ ุงูุจุนูุฏ ุฅูู ุงูุฃุชู
ุชุฉ
English ยท
@@ -37,7 +37,7 @@
-**ุงููุตูู ุฅูู ุทุฑููุฉ SSH:**
-ุทุฑููุฉ ูุงู
ูุฉ ุงูู
ูุฒุงุช ู
ุน ุฏุนู
ุชูุณูู
ุงูุดุงุดุฉ (ุญุชู 4 ููุญุงุช) ู
ุน ูุธุงู
ุนูุงู
ุงุช ุชุจููุจ ุดุจูู ุจุงูู
ุชุตูุญ. ูุชุถู
ู ุฏุนู
ุชุฎุตูุต ุงูุทุฑููุฉ ุจู
ุง ูู ุฐูู ุณู
ุงุช ุงูุทุฑููุฉ ุงูุดุงุฆุนุฉ ูุงูุฎุทูุท ูุงูู
ูููุงุช ุงูุฃุฎุฑู.
+**ุทุฑููุฉ SSH:**
+ุทุฑููุฉ ูุงู
ูุฉ ุจุนูุงู
ุงุช ุชุจููุจ ู
ุซู ุงูู
ุชุตูุญ ูุชูุณูู
ููุดุงุดุฉุ ุญุชู 6 ููุญุงุช ูู ููุช ูุงุญุฏ. ุงุฎุชุฑ ุงูุณู
ุฉ ูุงูุฎุท ูุงูุฃููุงู. ููุฌุฏ ููู ูู ุฌูุณุฉ ุดุฑูุท ูุนุฑุถ ุงูู
ุนุงูุฌ ูุงูุฐุงูุฑุฉ ูุงููุฑุต ูุญุธููุงุ ู
ุน ุฑูุงุจุท ุณุฑูุนุฉ ุฅูู ู
ููุงุช ุฐูู ุงูู
ุถูู ูDocker ูุงูุฃููุงู ูุงูู
ูุงููุณ.
-**ุงููุตูู ุฅูู ุณุทุญ ุงูู
ูุชุจ ุงูุจุนูุฏ:**
-ุฏุนู
RDP ู VNC ู Telnet ุนุจุฑ ุงูู
ุชุตูุญ ู
ุน ุชุฎุตูุต ูุงู
ู ูุชูุณูู
ุงูุดุงุดุฉ.
+**ุณุทุญ ุงูู
ูุชุจ ุงูุจุนูุฏ:**
+RDP ูVNC ูTelnet ุฏุงุฎู ุงูู
ุชุตูุญุ ูู ุนูุงู
ุงุช ุชุจููุจ ูุดุงุดุฉ ู
ูุณูู
ุฉ ู
ุซู ุฃู ุฌูุณุฉ ุฃุฎุฑู. ูุชุถู
ู ู
ุชุตูุญ ู
ููุงุช ูุฃูุฑุงุต RDP ูุฑูุนูุง ุจุงูุณุญุจ ูุงูุฅููุงุช. ุนูู ุณุทุญ ู
ูุชุจ Windows ูู
ููู ุฃูุถูุง ูุชุญ ุงูู
ุถูู ูู ุนู
ูู RDP ุงูุฃุตูู.
-**ุฅุฏุงุฑุฉ ุฃููุงู SSH:**
-ุฅูุดุงุก ูุฅุฏุงุฑุฉ ุฃููุงู SSH ุจูู ุงูุฎูุงุฏู
ู
ุน ุฅุนุงุฏุฉ ุงูุงุชุตุงู ุงูุชููุงุฆู ูู
ุฑุงูุจุฉ ุงูุญุงูุฉ ูุฅุนุงุฏุฉ ุงูุชูุฌูู ุงูู
ุญูู ุฃู ุงูุจุนูุฏ ุฃู SOCKS ุงูุฏููุงู
ููู. ูุชู
ุชุฎุฒูู ุฅุนุฏุงุฏุงุช ููู ุงูุนู
ูู-ุงูู
ูุชุจู ุฅูู ุงูุณูุฑูุฑ ู
ุญููุงู ููู ุชุซุจูุช ู
ูุชุจูุ ููู
ูู ุญูุธ ููุทุงุช C2S ุงูุงุฎุชูุงุฑูุฉ ุนูู ุงูุฎุงุฏู
ูุฅุนุงุฏุฉ ุชุณู
ูุชูุง ูุชุญู
ูููุง ุฃู ุญุฐููุง ุนูุฏู
ุง ุชุฑูุฏ ููู ุชูููู ุงูููู ุงูู
ุญูู ุจูู ุงูุนู
ูุงุก.
+**ุฃููุงู SSH:**
+ุฅุนุงุฏุฉ ุชูุฌูู ู
ุญููุฉ ูุจุนูุฏุฉ ูSOCKS ุฏููุงู
ูููุฉุ ู
ุน ุฅุนุงุฏุฉ ุงุชุตุงู ุชููุงุฆูุฉ ููุญูุต ููุญุงูุฉ. ุชูุญูุธ ุฃููุงู ุงูุนู
ูู ุฅูู ุงูุฎุงุฏู
ูู ุชุทุจูู ุณุทุญ ุงูู
ูุชุจ ุนูู ุฐูู ุงูุฌูุงุฒุ ููู
ููู ุญูุธ ุฅุนุฏุงุฏุงุช ุฌุงูุฒุฉ ุนูู ุงูุฎุงุฏู
ูููู ุงูุชููุฆุฉ ุฅูู ุฌูุงุฒ ุขุฎุฑ.
-**ู
ุฏูุฑ ุงูู
ููุงุช ุนู ุจูุนุฏ:**
-ุฅุฏุงุฑุฉ ุงูู
ููุงุช ู
ุจุงุดุฑุฉ ุนูู ุงูุฎูุงุฏู
ุงูุจุนูุฏุฉ ู
ุน ุฏุนู
ุนุฑุถ ูุชุญุฑูุฑ ุงูููุฏ ูุงูุตูุฑ ูุงูุตูุช ูุงูููุฏูู. ุฑูุน ูุชูุฒูู ูุฅุนุงุฏุฉ ุชุณู
ูุฉ ูุญุฐู ูููู ุงูู
ููุงุช ุจุณูุงุณุฉ ู
ุน ุฏุนู
sudo. ูุชุถู
ู ุฏุนู
ููู ุงูู
ููุงุช ู
ู ุฎุงุฏู
ุฅูู ุขุฎุฑ.
+**ู
ุฏูุฑ ุงูู
ููุงุช:**
+ุชุตูุญ ุงูู
ููุงุช ูุญุฑูุฑูุง ูุงุฑูุนูุง ููุฒูููุง ูุฃุนุฏ ุชุณู
ูุชูุง ูุงููููุง ูุงุญุฐููุง ุนุจุฑ SFTPุ ู
ุน ุฏุนู
sudo. ุงุนุฑุถ ูุญุฑูุฑ ุงูุดููุฑุฉ ูุงูุตูุฑ ูุงูุตูุช ูุงูููุฏูู. ุงูุณุฎ ุงูู
ููุงุช ู
ุจุงุดุฑุฉ ู
ู ุฎุงุฏู
ุฅูู ุขุฎุฑุ ู
ุน ุงุฎุชูุงุฑ ุฃุณุฑุน ู
ุณุงุฑ ุชููุงุฆููุง ูุงูุชุญูู ู
ู ุณูุงู
ุฉ ุงูููู.
-**ุฅุฏุงุฑุฉ Docker ู Podman:**
-ุชุดุบูู ูุฅููุงู ูุชุนููู ูุญุฐู ุงูุญุงููุงุช. ุนุฑุถ ุฅุญุตุงุฆูุงุช ุงูุญุงููุงุช. ุงูุชุญูู
ูู ุงูุญุงููุฉ ุจุงุณุชุฎุฏุงู
ุทุฑููุฉ docker exec. ูุฏุนู
ููุงู ู
ู Docker ู Podman ูุจูุฆุฉ ุชุดุบูู ููุญุงููุงุช. ูู
ููุตู
ู
ููุญู ู
ุญู Portainer ุฃู Dockge ุจู ูุฅุฏุงุฑุฉ ุญุงููุงุชู ุจุจุณุงุทุฉ ู
ูุงุฑูุฉ ุจุฅูุดุงุฆูุง.
+**Docker ูPodman:**
+ุดุบูู ุงูุญุงููุงุช ูุฃููููุง ูุนููููุง ูุงุญุฐููุงุ ูุชุงุจุน ุฅุญุตุงุกุงุชูุงุ ูุงูุชุญ ุทุฑููุฉ ุฏุงุฎู ุฅุญุฏุงูุง. ูุนู
ู ู
ุน Docker ูPodman ู
ุนูุง. ููุณ ุจุฏููุงู ุนู Portainer ุฃู Dockgeุ ุจู ูุณููุฉ ูุฅุฏุงุฑุฉ ุงูุญุงููุงุช ุงูู
ูุฌูุฏุฉ ูุฏูู.
-**ู
ุฏูุฑ ู
ุถููุงุช SSH:**
-ุญูุธ ูุชูุธูู
ูุฅุฏุงุฑุฉ ุงุชุตุงูุงุช SSH ุงูุฎุงุตุฉ ุจู ุจุงุณุชุฎุฏุงู
ุงูุนูุงู
ุงุช ูุงูู
ุฌูุฏุงุช (ู
ุน ุฏุนู
ุชุฎุตูุต ุงูู
ุฌูุฏุงุช ูุงูู
ุฌูุฏุงุช ุงูู
ุชุฏุงุฎูุฉ)ุ ูุญูุธ ุจูุงูุงุช ุชุณุฌูู ุงูุฏุฎูู ุงููุงุจูุฉ ูุฅุนุงุฏุฉ ุงูุงุณุชุฎุฏุงู
ุจุณูููุฉ ู
ุน ุฅู
ูุงููุฉ ุฃุชู
ุชุฉ ูุดุฑ ู
ูุงุชูุญ SSH.
+**ู
ุฏูุฑ ุงูู
ุถููุงุช:**
+ุงุญูุธ ู
ุถููุงุชู ููุธูู
ูุง ุจุงููุณูู
ูู
ุฌูุฏุงุช ู
ุชุฏุงุฎูุฉ ูู
ููู ุชุณู
ูุชูุง ูุชูููููุง. ุฃุนุฏ ุงุณุชุฎุฏุงู
ุจูุงูุงุช ุงูุฏุฎูู ุงูู
ุญููุธุฉ ุนุจุฑ ุนุฏุฉ ู
ุถููุงุชุ ูุงูุดุฑ ู
ูุงุชูุญ SSH ุชููุงุฆููุงุ ูุงุฌู
ุน ุงูู
ุถููุงุช ุชุญุช ู
ุถูู ุฑุฆูุณูุ ูุญุฑูุฑ ูุตุฏูุฑ ุฏูุนุฉ ูุงุญุฏุฉุ ูุงุณุชุฎุฏู
ุงูุงุชุตุงู ุงูุณุฑูุน ููุงุชุตุงูุงุช ุงูุนุงุจุฑุฉ ุงูุชู ูุง ุชุฑูุฏ ุญูุธูุง.
@@ -111,83 +111,139 @@ Termix ูู ู
ูุตุฉ ู
ูุชูุญุฉ ุงูู
ุตุฏุฑ ูู
ุฌุงููุฉ ููุฃุจุฏ ูุฐุง
**ู
ูุงููุณ ุงูู
ุถูู:**
-ุนุฑุถ ุงุณุชุฎุฏุงู
ุงูู
ุนุงูุฌ ูุงูุฐุงูุฑุฉ ูุงููุฑุต ูุงูุดุจูุฉ ูููุช ุงูุชุดุบูู ูู
ุนููู
ุงุช ุงููุธุงู
ูุฌุฏุงุฑ ุงูุญู
ุงูุฉ ูู
ุฑุงูุจ ุงูู
ูุงูุฐ ูุนุงุฑุถ ุงูุณุฌูุงุช ูุงูู
ุณุชุฎุฏู
ูู/ุงูุตูุงุญูุงุช ูุงูุดูุงุฏุงุช ูุบูุฑูุง ุงููุซูุฑุ ุชุนู
ู ุนูู ู
ุนุธู
ุงูุฎูุงุฏู
ุงูู
ุจููุฉ ุนูู Linux. ูุชุถู
ู ุฑุณูู
ุจูุงููุฉ ุชุงุฑูุฎูุฉ ุฒู
ููุฉ ุงูุณูุณูุฉ ูุชูุจููุงุช ูุงุฆู
ุฉ ุนูู ุงูุญุฏูุฏ ู
ุน ุฏุนู
ntfy ูุงูู webhook.
+ุงูู
ุนุงูุฌ ูุงูุฐุงูุฑุฉ ูุงููุฑุต ูุงูุดุจูุฉ ูุงูุญุฑุงุฑุฉ ูู
ุฏุฉ ุงูุชุดุบูู ูุงูุนู
ููุงุช ูุงูู
ูุงูุฐ ูุชุณุฌููุงุช ุงูุฏุฎูู ูู
ุนููู
ุงุช ุงููุธุงู
ุนูู ู
ุนุธู
ุฎูุงุฏู
Linuxุ ู
ุน ุฑุณูู
ุจูุงููุฉ ููุณุฌู. ุชุชูุญ ูู ุจุทุงูุงุช ุงูุฅุฏุงุฑุฉ ุงูุชุนุงู
ู ู
ุน ุงูุฎุฏู
ุงุช ูู
ูุงู
cron ูุงูุญุฒู
ูุงูู
ุณุชุฎุฏู
ูู ูููุงุนุฏ ุงูุฌุฏุงุฑ ุงููุงุฑู ูWireGuard ูTailscale ูุดูุงุฏุงุช SSL ูุงูุณุฌูุงุช ููุญูุต ุงูุณูุงู
ุฉ ุฏูู ู
ุบุงุฏุฑุฉ Termix.
-**ู
ุตุงุฏูุฉ ุงูู
ุณุชุฎุฏู
ูู:**
-ุฅุฏุงุฑุฉ ุขู
ูุฉ ููู
ุณุชุฎุฏู
ูู ู
ุน ุถูุงุจุท ุฅุฏุงุฑูุฉ (ูู
ูู ุชุนุฏูู ู
ุนููู
ุงุช ุงูู
ุณุชุฎุฏู
ูู ุงูุขุฎุฑูู) ูุฏุนู
OIDC/LDAP/SSO (ู
ุน ุงูุชุญูู
ูู ุงููุตูู) ู 2FA (TOTP) ูุฏุนู
ู
ูุงุชูุญ ุงูู
ุฑูุฑ (WebAuthn). ุนุฑุถ ุฌูุณุงุช ุงูู
ุณุชุฎุฏู
ูู ุงููุดุทุฉ ุนุจุฑ ุฌู
ูุน ุงูู
ูุตุงุช ูุฅูุบุงุก ุงูุตูุงุญูุงุช. ุฑุจุท ุญุณุงุจุงุช OIDC/ุงูู
ุญููุฉ ู
ุนุงู. ุนุฑุถ ุณุฌู ุชุฏููู ูุฌู
ูุน ุฅุฌุฑุงุกุงุช ุงูู
ุณุชุฎุฏู
ูู.
+**ุงูุฃุชู
ุชุฉ:**
+ุงุฎุชุฑ ู
ูุดุบููููุง ุซู
ุญุฏูุฏ ู
ุง ููุจุบู ุฃู ูุญุฏุซ. ุชุดู
ู ุงูู
ุดุบููุงุช ุชุฌุงูุฒ ู
ููุงุณ ูุญุฏ ู
ุนููุ ุฃู ู
ุถูููุง ูุณูุท ุฃู ูุนูุฏุ ุฃู ุชุบููุฑ ูุญุต ุงูุณูุงู
ุฉุ ุฃู ุฌุฏูููุง ุฒู
ูููุงุ ุฃู ุญุฏุซ ุญุงููุฉุ ุฃู webhook ูุงุฑุฏูุง. ูู
ูู ููุฎุทูุงุช ุชุดุบูู ุฃูุงู
ุฑ ูู
ูุชุทูุงุชุ ูุงูุชุญูู
ูู ุงูุญุงููุงุช ูุงูุฃููุงูุ ูุฅููุงุธ ู
ุถููุ ูุงุณุชุฏุนุงุก ุฑุงุจุทุ ูุงูุงูุชุธุงุฑุ ูุงูุชูุฑุน ุญุณุจ ุดุฑุทุ ูุชุดุบูู ุฃุชู
ุชุฉ ุฃุฎุฑูุ ูุฅุดุนุงุฑู ุนุจุฑ ntfy ุฃู Discord ุฃู webhook. ุชุชูุญ ูู ุนู
ููุงุช ุงูุชุดุบูู ุงูุชุฌุฑูุจู ุงูุชุฌุฑุจุฉ ุจุฃู
ุงู ุฃูููุง.
-**ุชูุงู
ู Tailscale:**
-ุนุฑุถ ุฃุฌูุฒุฉ ุดุจูุชู ู
ู Tailscale ูุฅุถุงูุชูุง ุจุณุฑุนุฉ ูู
ุถููุงุชุ ูุงูุงุชุตุงู ุนุจุฑ Tailscale SSH ูุทุฑููุฉ ู
ุตุงุฏูุฉุ ู
ู
ุง ูุชูุญ ูููุงุฆู
ุชุญูู
ุงููุตูู ูู Tailscale ุงูุชุนุงู
ู ู
ุน ุงูุชูููุถ ุฏูู ุงูุญุงุฌุฉ ูุชุฎุฒูู ุจูุงูุงุช ุงุนุชู
ุงุฏ.
+**ุงูุฃุณุงุทูู:**
+ุงุฌู
ุน ุงูู
ุถููุงุช ูู ุฃุณุทูู ุจุงุฎุชูุงุฑูุง ูุฏูููุง ุฃู ุจููุงุนุฏ ุงููุณูู
ุ ูุชูุถู
ุงูู
ุถููุงุช ุงูุฌุฏูุฏุฉ ุชููุงุฆููุง. ุดุบูู ุฃู
ุฑูุง ูุงุญุฏูุง ุนูู ูู ุงูู
ุถููุงุช ุฏูุนุฉ ูุงุญุฏุฉุ ูุงุฏูุน ุงูู
ููุงุช ูุงุณุญุจูุง ู
ู ุฌู
ูุนูุงุ ูุซุจูุช ุงูุญุฒู
ุ ูุงุฌู
ุน ุฌุฑุฏูุง ุจูุธุงู
ุงูุชุดุบูู ูุงูููุงุฉ ูุงูู
ุนู
ุงุฑูุฉ ูู
ุฏุฉ ุงูุชุดุบูู.
-**RBAC/ุงูู
ุดุงุฑูุฉ:**
-ุฅูุดุงุก ุงูุฃุฏูุงุฑ ูู
ุดุงุฑูุฉ ุงูู
ุถููุงุช ุนุจุฑ ุงูู
ุณุชุฎุฏู
ูู/ุงูุฃุฏูุงุฑ. ูุฏุนู
ุฌู
ูุน ุฃููุงุน ุงูู
ุตุงุฏูุฉ ูุฌู
ูุน ุจุฑูุชููููุงุช ุงูู
ุถูู.
+**ู
ุณุงุนุฏ ุงูุฐูุงุก ุงูุงุตุทูุงุนู:**
+ู
ูุฒุฉ ุงุฎุชูุงุฑูุฉ ูู
ุนุทูุฉ ุญุชู ุชูุนูููุง ุจููุณู. ุงุฑุจุท OpenAI ุฃู Anthropic ุฃู Gemini ุฃู Ollama ุฃู ุฃู ููุทุฉ ูุตูู ู
ุชูุงููุฉ ู
ุน OpenAI ูุงุณุฃู ุนู ุฅุนุฏุงุฏุงุชู. ูู
ููู ูุฑุงุกุฉ ุงูู
ุถููุงุช ูุงูุฃุณุงุทูู ูุงูู
ูุชุทูุงุช ูุงูุชูุจููุงุชุ ูููุชุฑุญ ุงูุชุบููุฑุงุช ูุชูุงูู ุนูููุง ุจุฏููุง ู
ู ุชูููุฐูุง ุจููุณู. ูุง ูู
ููู ุฃุจุฏูุง ุงููุตูู ุฅูู ุจูุงูุงุช ุงูุฏุฎูู ุฃู ุงูู
ุณุชุฎุฏู
ูู ุฃู ุงูุฅุนุฏุงุฏุงุช. ูุณุชุทูุน ุงูู
ุณุคูููู ุชุนุทููู ูููุธุงู
ุจุงููุงู
ูุ ููู
ููู ุฅุฎูุงุคู ุฃุซูุงุก ุงูุฅุนุฏุงุฏ.
-**ุงูุงุชุตุงูุงุช ุงูุชุณูุณููุฉ:**
-ุงูุงุชุตุงู ุจุงูุฃุฌูุฒุฉ ุงูุชุณูุณููุฉ (ุฃุฌูุฒุฉ ุงูุชูุฌูู ูุงูู
ูุงุชูุญ ูุงูู
ุชุญูู
ุงุช ุงูุฏูููุฉ ูุบูุฑูุง) ู
ุจุงุดุฑุฉ ู
ู ุงูู
ุชุตูุญ ุฃู ุชุทุจูู ุณุทุญ ุงูู
ูุชุจ. ุถุจุท ู
ุนุฏู ููู ุงูุจูุงูุงุช ูุจุชุงุช ุงูุจูุงูุงุช ูุจุชุงุช ุงูุชููู ูุงูุชูุงูุค. ูุณุชุฎุฏู
Web Serial API ูู ุงูู
ุชุตูุญุงุช ุงูู
ุฏุนูู
ุฉ ุฃู ุฎูููุฉ ุฃุตููุฉ ูู ุชุทุจูู Electron.
+**ุชุณุฌูู ุงูุฏุฎูู ูุงูู
ุณุชุฎุฏู
ูู:**
+ุญุณุงุจุงุช ู
ุญููุฉ ุฅุถุงูุฉ ุฅูู ุชุณุฌูู ุงูุฏุฎูู ุนุจุฑ OIDC ูLDAP ูGitHub ูGoogleุ ู
ุน ุงูุชุญูู ุจุฎุทูุชูู (TOTP) ูู
ูุงุชูุญ ุงูู
ุฑูุฑ (WebAuthn) ูุงูุฃุฌูุฒุฉ ุงูู
ูุซููุฉ. ูุณุชุทูุน ุงูู
ุณุคูููู ุฅุฏุงุฑุฉ ุงูู
ุณุชุฎุฏู
ูู ูุฑุจุท ู
ุฌู
ูุนุงุช OIDC ุจุงูุฃุฏูุงุฑ ูุฑุคูุฉ ูู ุงูุฌูุณุงุช ุงููุดุทุฉ ุนูู ุฌู
ูุน ุงูู
ูุตุงุช ูุฅูุบุงุคูุง. ุงุฑุจุท ุญุณุงุจู ุงูู
ุญูู ุจุญุณุงุจ OIDCุ ูุงุทููุน ุนูู ุณุฌู ุงูุชุฏููู ูู
ุง ูุนูู ุงูุฌู
ูุน.
+**ุงูุฃุฏูุงุฑ ูุงูู
ุดุงุฑูุฉ:**
+ุฃูุดุฆ ุฃุฏูุงุฑูุง ูุดุงุฑู ุงูู
ุถููุงุช ู
ุน ุงูู
ุณุชุฎุฏู
ูู ุฃู ุงูุฃุฏูุงุฑ ุนูู ุฃุฑุจุนุฉ ู
ุณุชููุงุช: ุงูุงุชุตุงู ูุงูุนุฑุถ ูุงูุชุญุฑูุฑ ูุงูุฅุฏุงุฑุฉ. ูุนู
ู ู
ุน ุฌู
ูุน ุฃููุงุน ุงูู
ุตุงุฏูุฉ ูุฌู
ูุน ุงูุจุฑูุชููููุงุชุ ููู
ููู ุชุฌุงูุฒ ุจูุงูุงุช ุงูุฏุฎูู ุงูู
ุณุชุฎุฏู
ุฉ ูู
ุถูู ู
ุดุชุฑู.
+
+
+
+
+
+
**ุงูุชูุจููุงุช:**
-ุถุจุท ููุงุนุฏ ุชูุจูู ูุงุฆู
ุฉ ุนูู ุงูุญุฏูุฏ ูู
ูุงููุณ ุงูู
ุถูู (ุงูู
ุนุงูุฌ ูุงูุฐุงูุฑุฉ ูุงููุฑุต ูุบูุฑูุง) ูุงูุญุตูู ุนูู ุฅุดุนุงุฑุงุช ุนุจุฑ ntfy ุฃู webhooks ุนูุฏ ุฅุทูุงููุง. ุนุฑุถ ุงูุชูุจููุงุช ุงููุดุทุฉ ูุงูู
ุญูููุฉ ูู ุณุฌู ุงูุชุงุฑูุฎ.
+ุถุน ููุงุนุฏ ุนูู ู
ูุงููุณ ุงูู
ุถูู ู
ุซู ุงูู
ุนุงูุฌ ูุงูุฐุงูุฑุฉ ูุงููุฑุตุ ูุชูููู ุฅุดุนุงุฑูุง ุนุจุฑ ntfy ุฃู Discord ุฃู webhook ุนูุฏ ุชูุนูููุง. ุงุทููุน ุนูู ุงูุชูุจููุงุช ุงููุดุทุฉ ูุงูู
ูุชููุฉ ูู ุณุฌูุ ูุชุฌุงูู ู
ุง ูุง ููู
ู ู
ููุง.
-
-
**ุงูุตูุญุฉ ุงูุฑุฆูุณูุฉ:**
-ุตูุญุฉ ุฑุฆูุณูุฉ ูุงุจูุฉ ููุชุฎุตูุต ุจุงููุงู
ู ู
ุน ุดุจูุฉ ุฃุฏูุงุช ูุงุจูุฉ ููุณุญุจ ูุงูุฅููุงุช. ุฃุถู ุฃุฏูุงุช ูุญุงูุฉ ุงูู
ุถูู ูุฑูุงุจุท ุงูุฎุฏู
ุงุช ูุงูุณุงุนุงุช ูุงูู
ูุงุญุธุงุช ูุฎูุงุตุงุช RSS ูุงูุทูุณ ูุญุงููุงุช Docker ูู
ุฎุทุทุงุช ู
ูุงููุณ ุงูู
ุถูู ูุงูุทุฑููุงุช ุงูู
ุถู
ูุฉ ูุงูุฅุทุงุฑุงุช ุงูู
ุถู
ูุฉ ูุฃูุซุฑ.
-
-
-
-
-**ุชุดููุฑ ูุงุนุฏุฉ ุงูุจูุงูุงุช:**
-ููุฎุฒููู ุงูุฎุงุฏู
ุงูุฎููู ูู
ููุงุช ูุงุนุฏุฉ ุจูุงูุงุช SQLite ู
ุดูุฑุฉ. ุงุทูุน ุนูู [ุงููุซุงุฆู](https://docs.termix.site/security) ูู
ุฒูุฏ ู
ู ุงูู
ุนููู
ุงุช.
+ุดุจูุฉ ุนูุงุตุฑ ุชุจูููุง ุจููุณู ุจุงูุณุญุจ ูุงูุฅููุงุช. ููุงู ุนูุงุตุฑ ูุญุงูุฉ ุงูู
ุถููุงุช ูnping ูุฑูุงุจุท ุงูุฎุฏู
ุงุช ูุงูุฅุดุงุฑุงุช ุงูู
ุฑุฌุนูุฉ ูุงูุจุญุซ ูุงูุณุงุนุงุช ูุงูุชูููู
ุงุช ูุงูุนุฏ ุงูุชูุงุฒูู ูุงูู
ูุงุญุธุงุช ูRSS ูุงูุทูุณ ูุงูุตูุฑ ูุงูุฅุทุงุฑุงุช ุงูู
ุถู
ููุฉ ูDocker ูุงูุฃููุงู ูุฑุณูู
ุงูู
ูุงููุณ ููุงุฌูุงุช API ุงูุฎุงุตุฉ ุจูุ ูุญุชู ุทุฑููุฉ ุญูุฉ.
-**ุงูุฑุณู
ุงูุจูุงูู ููุดุจูุฉ:**
-ุชุฎุตูุต ููุญุฉ ุงูุชุญูู
ูุชุตูุฑ ู
ุฎุชุจุฑู ุงูู
ูุฒูู ุจูุงุกู ุนูู ุงุชุตุงูุงุช SSH ู
ุน ุฏุนู
ุงูุญุงูุฉ.
+**ุงูู
ูุชุทูุงุช ูุงูุฃุฏูุงุช:**
+ุงุญูุธ ุงูุฃูุงู
ุฑ ุงูุชู ุชุณุชุฎุฏู
ูุง ูุซูุฑูุง ูุดุบูููุง ุจููุฑุฉ ูุงุญุฏุฉุ ู
ุน ู
ุชุบูุฑุงุช ููู
ุถูู ููู
ุฏุฎูุงุชู ุงูุฎุงุตุฉ. ุดุบูู ุฃู
ุฑูุง ูุงุญุฏูุง ุนูู ูู ุงูุทุฑููุงุช ุงูู
ูุชูุญุฉุ ูุงุจุญุซ ูู ุณุฌู ุฃูุงู
ุฑู ู
ุน ุงูุฅูู
ุงู ุงูุชููุงุฆู.
-**ุฃุฏูุงุช SSH:**
-ุฅูุดุงุก ู
ูุชุทูุงุช ุฃูุงู
ุฑ ูุงุจูุฉ ูุฅุนุงุฏุฉ ุงูุงุณุชุฎุฏุงู
ุชูููููุฐ ุจููุฑุฉ ูุงุญุฏุฉ. ุชุดุบูู ุฃู
ุฑ ูุงุญุฏ ูู ููุช ูุงุญุฏ ุนุจุฑ ุนุฏุฉ ุทุฑููุงุช ู
ูุชูุญุฉ.
+**ู
ุดุงุฑูุฉ ุงูุฌูุณุฉ:**
+ุดุงุฑู ุฌูุณุฉ ุทุฑููุฉ ุฃู RDP ุฃู VNC ุฃู Telnet ู
ุจุงุดุฑุฉ. ุฃุฑุณู ุฑุงุจุทูุง ูู
ูู ูุฃู ุดุฎุต ุงูุงูุถู
ุงู
ุฅููู ุฏูู ุญุณุงุจุ ุฃู ุดุงุฑู ู
ุน ู
ุณุชุฎุฏู
Termix ู
ุญุฏุฏุ ูููุฑุงุกุฉ ููุท ุฃู ู
ุน ุตูุงุญูุฉ ุงููุชุงุจุฉ. ูู
ูู ุฃู ุชูุชูู ุงูู
ุดุงุฑูุงุช ุชููุงุฆููุง ุฃู ุชููุบู ูู ุฃู ููุชุ ููู
ูู ุฅููุงููุง ููููุง ุฃู ููู ู
ุถูู ุนูู ุญุฏุฉ.
-**ุนูุงู
ุงุช ุงูุชุจููุจ ุงูุฏุงุฆู
ุฉ:**
-ุชุจูู ุฌูุณุงุช SSH ูุนูุงู
ุงุช ุงูุชุจููุจ ู
ูุชูุญุฉ ุนุจุฑ ุงูุฃุฌูุฒุฉ/ุงูุชุญุฏูุซุงุช ุฅุฐุง ุชู
ุชูุนูููุง ูู ู
ูู ุชุนุฑูู ุงูู
ุณุชุฎุฏู
.
+**ุชุณุฌูู ุงูุฌูุณุงุช ูุงูุณุฌูุงุช:**
+ุณุฌูู ุฌูุณุงุช ุงูุทุฑููุฉ ูRDP ูVNC ูุดุงูุฏูุง ูุงุญููุง. ูุฒูู ุณุฌูุงุช ูุตูุฉ ููุฌูุณุฉุ ูุงุทููุน ุนูู ุณุฌู ุงูุงุชุตุงู ูุชุฑู ุจุงูุถุจุท ู
ุง ุฌุฑู ุฃุซูุงุก ุงูุงุชุตุงู.
+
+
+
+
+**ุงูุงุชุตุงูุงุช ุงูุชุณูุณููุฉ:**
+ุชูุงุตู ู
ุน ุงูุฃุฌูุฒุฉ ุงูุชุณูุณููุฉ ู
ุซู ุงูู
ูุฌููุงุช ูุงูู
ุจุฏููุงุช ูุงูู
ุชุญูู
ุงุช ุงูุฏูููุฉ ู
ู ุงูู
ุชุตูุญ ุฃู ุชุทุจูู ุณุทุญ ุงูู
ูุชุจ. ุงุถุจุท ู
ุนุฏู ุงูุจุงูุฏ ูุจุชุงุช ุงูุจูุงูุงุช ูุจุชุงุช ุงูุชููู ูุงูุชู
ุงุซู. ูุณุชุฎุฏู
ูุงุฌูุฉ Web Serial ูู ุงูู
ุชุตูุญุงุช ุงูู
ุฏุนูู
ุฉุ ุฃู ุฎูููุฉ ุฃุตููุฉ ูู ุชุทุจูู ุณุทุญ ุงูู
ูุชุจ.
+
+
+
+
+
+
+**Tailscale:**
+ุงุณุญุจ ุงูุฃุฌูุฒุฉ ู
ู ุดุจูุฉ tailnet ูุฅุถุงูุชูุง ูู
ุถููุงุช ุจุจุถุน ููุฑุงุชุ ูุงุชุตู ุนุจุฑ Tailscale SSH ูุชุชููู ููุงุฆู
ุตูุงุญูุงุช tailnet ุฃู
ุฑ ุงููุตูู ุฏูู ุชุฎุฒูู ุจูุงูุงุช ุฏุฎูู. ูุนู
ู ุฃูุถูุง ู
ุน Headscale ูููุงุท ุงููุตูู ุงูู
ุฎุตุตุฉ.
+
+
+
+
+**Proxmox:**
+ุงุณุชูุฑุฏ ุงูู
ุถููุงุช ู
ุจุงุดุฑุฉ ู
ู ูุณุฎุฉ Proxmoxุ ูุชุงุจุน ุฅุญุตุงุกุงุช ุงูุนูุฏ ูุงูุฃูุธู
ุฉ ุงูุถููุฉุ ุจู
ุง ูููุง ุงูู
ุนุงูุฌ ูุงูุฐุงูุฑุฉ ูุงูุชุฎุฒููุ ูู ุชุจููุจ ุฎุงุต ุจูุง.
+
+
+
+
+
+
+**ู
ุณุงุญุงุช ุงูุนู
ู ูุนูุงู
ุงุช ุงูุชุจููุจ:**
+ุงุญูุธ ู
ุฌู
ูุนุฉ ู
ู ุนูุงู
ุงุช ุงูุชุจููุจ ุจุชูุณูู
ูุงุ ูุฃุนุฏ ูุชุญูุง ูููุง ุจููุฑุฉ ูุงุญุฏุฉ. ูุชุฐูุฑ Termix ุฃูุถูุง ุฌูุณุชู ุงูุฃุฎูุฑุฉุ ูุชุนูุฏ ุนูุงู
ุงุช ุงูุชุจููุจ ุจุนุฏ ุงูุชุญุฏูุซ ูุนูู ุงูุฃุฌูุฒุฉ ุงูุฃุฎุฑู.
+
+
+
+
+**ุฅุนุฏุงุฏ ู
ูุฌููู:**
+ุฅุนุฏุงุฏ ูุตูุฑ ูุฑุดุฏู ุฅูู ุงุฎุชูุงุฑ ูู
ุท ุงููุงุฌูุฉ ูุงูุณู
ุฉ ูุงูู
ูุฒุงุช ุงูุชู ุชุฑูุฏูุง ูุฃูู ู
ุถูู ูู. ูุฎูู ุงููุถุน ุงูุจุณูุท ู
ุง ูุง ุชุณุชุฎุฏู
ูุ ููู
ููู ุฅุนุงุฏุฉ ุงูุฅุนุฏุงุฏ ุฃู ุชุบููุฑ ุงููู
ุท ูู ุฃู ููุช.
+
+
+
+
+
+
+**ุชุทุจูู ุณุทุญ ุงูู
ูุชุจ ุงูู
ุณุชูู ูุงูู
ุฒุงู
ูุฉ:**
+ูุนู
ู ุชุทุจูู ุณุทุญ ุงูู
ูุชุจ ุจู
ูุฑุฏู ุจุฎูููุฉ ููุงุนุฏุฉ ุจูุงูุงุช ู
ุญููุฉุ ุฏูู ุญุงุฌุฉ ุฅูู ุฎุงุฏู
. ูู
ููู ุฃูุถูุง ุฑุจุทู ุจุฎุงุฏู
Termix ูู
ุฒุงู
ูุฉ ุงูู
ุถููุงุช ูุจูุงูุงุช ุงูุฏุฎูู ูุงูู
ูุชุทูุงุช ูุบูุฑูุง ูู ุงูุงุชุฌุงูููุ ูุงุฎุชูุงุฑ ู
ุง ุฅุฐุง ูุงูุช ุงูุงุชุตุงูุงุช ุชุจุฏุฃ ู
ู ุฌูุงุฒู ุฃู
ุนุจุฑ ุงูุฎุงุฏู
.
+
+
+
+
+**ุณุทุฑ ุงูุฃูุงู
ุฑ:**
+ุฃุฏุงุฉ `termix` ูุณุทุฑ ุงูุฃูุงู
ุฑ ุชุนู
ู ูู ุงูุทุฑููุฉ ููู ุณูุฑุจุชุงุชู. ุงูุชุญ ุงูุทุฑููุงุชุ ููููุฐ ุฃู
ุฑูุง ุนูู ู
ุถูู ูุงุญุฏ ุฃู ุนูู ุฃุณุทูู ูุงู
ูุ ูุงููู ุงูู
ููุงุช ุนุจุฑ SFTPุ ูุฃุฏุฑ ุงูู
ุถููุงุช ูุงูู
ูุชุทูุงุช ูุจูุงูุงุช ุงูุฏุฎูู. ุซุจูุชูุง ุนุจุฑ `npm install -g @termix-cli/cli` ุฃู ุงุณุชุฎุฏู
ู
ูููุง ุชูููุฐููุง ู
ุณุชูููุง. ุฑุงุฌุน [ูุซุงุฆู ุณุทุฑ ุงูุฃูุงู
ุฑ](https://docs.termix.site/cli).
+
+
+
+
+
+
+**ุงูุฃู
ุงู:**
+ุชูุดูููุฑ ููู
ุงุช ุงูู
ุฑูุฑ ูุงูู
ูุงุชูุญ ูุงูุฃุณุฑุงุฑ ุงูุฃุฎุฑู ููู ู
ุณุชุฎุฏู
ุนูู ุญุฏุฉุ ููู
ูู ุชุดููุฑ ู
ููุงุช ูุงุนุฏุฉ ุงูุจูุงูุงุช ููุณูุง ุนูู ุงููุฑุต. ุฑุงุฌุน [ุงููุซุงุฆู](https://docs.termix.site/security) ูู
ุนุฑูุฉ ุขููุฉ ุงูุนู
ู.
**ุงููุบุงุช:**
-ุฏุนู
ู
ุฏู
ุฌ ูุญูุงูู 30 ูุบุฉ (ุชูุฏุงุฑ ุจูุงุณุทุฉ [Crowdin](https://docs.termix.site/translations)).
+ูุญู 30 ูุบุฉ ู
ุฏู
ุฌุฉุ ุชูุฏุงุฑ ุนุจุฑ [Crowdin](https://docs.termix.site/translations).
@@ -195,40 +251,43 @@ Termix ูู ู
ูุตุฉ ู
ูุชูุญุฉ ุงูู
ุตุฏุฑ ูู
ุฌุงููุฉ ููุฃุจุฏ ูุฐุง
-ุงูู
ุฒูุฏ ู
ู ุงูู
ูุฒุงุช
+ู
ูุฒุงุช ุฃุฎุฑู
ุงูู
ูุตุฉ
-ุงูุชูุฒูุน
+ุทุฑููุฉ ุงูุชูุฒูุน
Web ุฃู ู
ุชุตูุญ ุญุฏูุซ (Chromeุ Safariุ Firefox) ยท ุฏุนู
PWA
+ุฃู ู
ุชุตูุญ ุญุฏูุซ (Chrome ูSafari ูFirefox) ยท ูุฏุนู
PWA
Windows x64/ia32 ูุณุฎุฉ ู
ุญู
ููุฉ ยท ู
ุซุจุช MSI ยท Chocolatey
+ูุณุฎุฉ ู
ุญู
ููุฉ ยท ู
ุซุจูุช MSI ยท Chocolatey
Linux x64/ia32
@@ -325,10 +410,6 @@ Termix ู
ุฌุงูู ูู
ูุชูุญ ุงูู
ุตุฏุฑ ุจุฏูู ุงุดุชุฑุงูุงุช ุฃู ุฎุท
-
-
-
@@ -340,14 +421,17 @@ Termix ู
ุฌุงูู ูู
ูุชูุญ ุงูู
ุตุฏุฑ ุจุฏูู ุงุดุชุฑุงูุงุช ุฃู ุฎุท
-
+
+
+
ุดุงูุฏ ูุธุฑุฉ ุนุงู
ุฉ ุนูู ุงูุชุญุฏูุซุงุช ุนูู YouTube
+ุดุงูุฏ ุนุฑูุถ ุงูุชุญุฏูุซุงุช ุนูู YouTube
-ูุฏ ุชููู ุจุนุถ ู
ูุงุทุน ุงูููุฏูู ูุงูุตูุฑ ูุฏูู
ุฉ ุฃู ูุฏ ูุง ุชุนุฑุถ ุงูู
ูุฒุงุช ุจุดูู ู
ุซุงูู.
+ูุฏ ุชููู ุจุนุถ ุงูู
ูุงุทุน ูุงูุตูุฑ ูุฏูู
ุฉ ุฃู ูุง ุชุนุฑุถ ุงูู
ูุฒุงุช ุนูู ุฃูุถู ูุฌู.
@@ -407,10 +491,10 @@ Termix ู
ุฌุงูู ูู
ูุชูุญ ุงูู
ุตุฏุฑ ุจุฏูู ุงุดุชุฑุงูุงุช ุฃู ุฎุท
## ุงูู
ูุฒุงุช ุงูู
ุฎุทุทุฉ
-ุฑุงุฌุน [ุงูู
ุดุงุฑูุน](https://github.com/orgs/Termix-SSH/projects/5) ูุนุฑุถ ุฌู
ูุน ุงูู
ูุฒุงุช ุงูู
ุฎุทุทุฉ. ุฅุฐุง ููุช ุชุชุทูุน ููู
ุณุงูู
ุฉุ ุฑุงุฌุน [ุงูู
ุณุงูู
ุฉ](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+ุฌู
ูุน ุงูู
ูุฒุงุช ุงูู
ุฎุทุทุฉ ู
ูุฌูุฏุฉ ูู [Projects](https://github.com/orgs/Termix-SSH/projects/5). ุฅุฐุง ุฃุฑุฏุช ุงูู
ุณุงูู
ุฉุ ุฑุงุฌุน [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
Termix
-่ชๆ็ฎก SSH ็ฎก็ไธ่ฟ็จๆก้ข่ฎฟ้ฎๅนณๅฐ
+่ชๆ็ฎกๆๅกๅจ็ฎก็๏ผไป SSH ๅ่ฟ็จๆก้ขๅฐ่ชๅจๅ
English ยท
@@ -58,7 +58,7 @@ Termix ๅ
่ดนไธๅผๆบใๅฆๆๆจ่งๅพๅฎๆ็จ๏ผ่ฏท่่[ๆ่ต ](https://do
## ๆฆ่ง
-Termix ๆฏไธไธชๅผๆบใๆฐธไน
ๅ
่ดนใ่ชๆ็ฎก็ไธไฝๅๆๅกๅจ็ฎก็ๅนณๅฐใๅฎๆไพไบไธไธชๅคๅนณๅฐ่งฃๅณๆนๆก๏ผ้่ฟไธไธช็ด่ง็็้ข็ฎก็ไฝ ็ๆๅกๅจๅๅบ็ก่ฎพๆฝใTermix ๆไพ SSH ็ป็ซฏ่ฎฟ้ฎใ่ฟ็จๆก้ขๆงๅถ๏ผRDPใVNCใTelnet๏ผใSSH ้ง้ๅ่ฝใ่ฟ็จๆไปถ็ฎก็ไปฅๅ่ฎธๅคๅ
ถไปๅทฅๅ
ทใTermix ๆฏ้็จไบๆๆๅนณๅฐ็ๅฎ็พๅ
่ดน่ชๆ็ฎก Termius ๆฟไปฃๅใ
+Termix ๆฏไธไธชๅ
่ดนใๅผๆบใ่ชๆ็ฎก็ๆๅกๅจ็ฎก็ๅนณๅฐใๅฎๆ SSH ็ป็ซฏใ่ฟ็จๆก้ข๏ผRDPใVNCใTelnet๏ผใๆไปถไผ ่พใ้ง้ใDockerใๆๆ ๅ่ชๅจๅ้ไธญๅจไธไธชๅฐๆน๏ผๆฏๆ็ฝ้กต็ซฏใๆก้ข็ซฏๅ็งปๅจ็ซฏใๅฎๆฏ Termius ็่ชๆ็ฎกๆฟไปฃๅ๏ผๅนถไธๆฐธไน
ๅ
่ดนใ
-**SSH ็ป็ซฏ่ฎฟ้ฎ:**
-ๅ่ฝ้ฝๅ
จ็็ป็ซฏ๏ผๆฏๆๅๅฑ๏ผๆๅค 4 ไธช้ขๆฟ๏ผ๏ผๅนถ้
ๆ็ฑปไผผๆต่งๅจ็ๆ ็ญพ็ณป็ปใๅ
ๆฌๅฏน่ชๅฎไน็ป็ซฏ็ๆฏๆ๏ผๅฆๅธธ็จ็็ป็ซฏไธป้ขใๅญไฝๅๅ
ถไป็ปไปถใ
+**SSH ็ป็ซฏ:**
+ๅ่ฝ้ฝๅ
จ็็ป็ซฏ๏ผ้
ๆ็ฑปไผผๆต่งๅจ็ๆ ็ญพ้กตๅๅๅฑ๏ผๆๅคๅๆถๆพ็คบ 6 ไธช้ขๆฟใๅฏไปฅ้ๆฉไธป้ขใๅญไฝๅ้
่ฒใๆฏไธชไผ่ฏไธๆน้ฝๆไธไธชๅทฅๅ
ทๆ ๏ผๆพ็คบๅฎๆถ็ CPUใๅ
ๅญๅ็ฃ็๏ผๅนถๆไพๆๅ่ฏฅไธปๆบๆไปถใDockerใ้ง้ๅๆๆ ็ๅฟซๆทๅ
ฅๅฃใ
-**่ฟ็จๆก้ข่ฎฟ้ฎ:**
-้่ฟๆต่งๅจๆฏๆ RDPใVNC ๅ Telnet๏ผๅ
ทๆๅฎๆด็่ชๅฎไนๅๅๅฑๅ่ฝใ
+**่ฟ็จๆก้ข:**
+ๅจๆต่งๅจไธญไฝฟ็จ RDPใVNC ๅ Telnet๏ผๅๅ
ถไปไผ่ฏไธๆ ทๆฏๆๆ ็ญพ้กตๅๅๅฑใๅ
ๅซ RDP ้ฉฑๅจๅจ็ๆไปถๆต่งๅจๅๆๆพไธไผ ใๅจ Windows ๆก้ข็ซฏ๏ผไฝ ่ฟๅฏไปฅ็จๅ็ RDP ๅฎขๆท็ซฏๆๅผไธปๆบใ
-**SSH ้ง้็ฎก็:**
-ๅๅปบๅ็ฎก็ๅ
ทๆ่ชๅจ้่ฟๅๅฅๅบท็ๆตๅ่ฝ็ๆๅกๅจ้ด SSH ้ง้๏ผๆฏๆๆฌๅฐใ่ฟ็จๆๅจๆ SOCKS ่ฝฌๅใๆก้ขๅฎขๆท็ซฏๅฐๆๅกๅจ็้ง้่ฎพ็ฝฎๆๆก้ขๅฎ่ฃ
ๆฌๅฐๅญๅจ๏ผๅฏ้็ C2S ้ข่ฎพๅฟซ็
งๅฏไฟๅญๅฐๆๅกๅจใ้ๅฝๅใๅ ่ฝฝๆๅ ้ค๏ผไปฅไพฟๅจๅฎขๆท็ซฏไน้ด่ฟ็งปๆฌๅฐ้ง้้
็ฝฎใ
+**SSH ้ง้:**
+ๆฏๆๆฌๅฐใ่ฟ็จๅๅจๆ SOCKS ่ฝฌๅ๏ผๅฏ่ชๅจ้่ฟๅนถ่ฟ่กๅฅๅบทๆฃๆฅใๆก้ข็ซฏ็ๅฎขๆท็ซฏๅฐๆๅกๅจ้ง้ไฟๅญๅจๆฌๆบ๏ผไฝ ไนๅฏไปฅๆ้ข่ฎพไฟๅญๅฐๆๅกๅจ๏ผไปฅไพฟ่ฟ็งปๅฐๅฆไธๅฐๅฎขๆท็ซฏใ
-**่ฟ็จๆไปถ็ฎก็ๅจ:**
-็ดๆฅๅจ่ฟ็จๆๅกๅจไธ็ฎก็ๆไปถ๏ผๆฏๆๆฅ็ๅ็ผ่พไปฃ็ ใๅพๅใ้ณ้ขๅ่ง้ขใๆฏๆ้่ฟ sudo ๆ ็ผไธไผ ใไธ่ฝฝใ้ๅฝๅใๅ ้คๅ็งปๅจๆไปถใๅ
ๆฌๆฏๆๅจๆๅกๅจไน้ด็งปๅจๆไปถใ
+**ๆไปถ็ฎก็ๅจ:**
+้่ฟ SFTP ๆต่งใ็ผ่พใไธไผ ใไธ่ฝฝใ้ๅฝๅใ็งปๅจๅๅ ้คๆไปถ๏ผๆฏๆ sudoใๅฏไปฅๆฅ็ๅ็ผ่พไปฃ็ ใๅพ็ใ้ณ้ขๅ่ง้ขใๆไปถๅฏไปฅ็ดๆฅไปไธๅฐๆๅกๅจๅคๅถๅฐๅฆไธๅฐ๏ผ็ณป็ปไผ่ชๅจ้ๆฉๆๅฟซ็่ทฏๅพๅนถๆ ก้ชไผ ่พๅฎๆดๆงใ
-**Docker ๅ Podman ็ฎก็:**
-ๅฏๅจใๅๆญขใๆๅใ็งป้คๅฎนๅจใๆฅ็ๅฎนๅจ็ป่ฎกไฟกๆฏใ้่ฟ docker exec ็ป็ซฏๆงๅถๅฎนๅจใๅๆถๆฏๆ Docker ๅ Podman ไฝไธบๅฎนๅจ่ฟ่กๆถใๅฎ็ๅ่กทไธๆฏๅไปฃ Portainer ๆ Dockge๏ผ่ๆฏไธบไบๆฏ็ดๆฅๅๅปบๅฎนๅจๆด็ฎๅๅฐ็ฎก็ๅฎไปฌใ
+**Docker ๅ Podman:**
+ๅฏๅจใๅๆญขใๆๅๅๅ ้คๅฎนๅจ๏ผๆฅ็ๅฎไปฌ็็ถๆ๏ผๅนถๅจๅฎนๅจๅ
ๆๅผไธไธช็ป็ซฏใๅๆถๆฏๆ Docker ๅ Podmanใๅฎไธๆฏ่ฆๅไปฃ Portainer ๆ Dockge๏ผๅชๆฏ็จๆฅ็ฎก็ไฝ ๅทฒๆ็ๅฎนๅจใ
-**SSH ไธปๆบ็ฎก็ๅจ:**
-้่ฟๆ ็ญพๅๆไปถๅคน๏ผๆฏๆๆไปถๅคน่ชๅฎไนๅๅตๅฅๆไปถๅคน๏ผไฟๅญใ็ป็ปๅ็ฎก็ๆจ็ SSH ่ฟๆฅ๏ผ่ฝปๆพไฟๅญๅฏ้็จ็็ปๅฝไฟกๆฏ๏ผๅนถ่ฝ่ชๅจๅ้จ็ฝฒ SSH ๅฏ้ฅใ
+**ไธปๆบ็ฎก็:**
+็จๆ ็ญพๅๅฏๅฝๅใๅฏ้
่ฒ็ๅตๅฅๆไปถๅคนๆฅๆด็ไธปๆบใๅจๅคๅฐไธปๆบไน้ดๅค็จๅทฒไฟๅญ็ๅญๆฎ๏ผ่ชๅจ้จ็ฝฒ SSH ๅฏ้ฅ๏ผๆไธปๆบๅฝๅฐ็ถไธปๆบไธ๏ผๆน้็ผ่พๅๅฏผๅบ๏ผ่ฟๅฏไปฅ็จๅฟซ้่ฟๆฅๅค็้ฃไบไธๆณไฟๅญ็ไธๆฌกๆง่ฟๆฅใ
@@ -111,83 +111,139 @@ Termix ๆฏไธไธชๅผๆบใๆฐธไน
ๅ
่ดนใ่ชๆ็ฎก็ไธไฝๅๆๅกๅจ็ฎก็ๅนณ
**ไธปๆบๆๆ :**
-ๅจๅคงๅคๆฐๅบไบ Linux ็ๆๅกๅจไธๆฅ็ CPUใๅ
ๅญใ็ฃ็ไฝฟ็จๆ
ๅตใ็ฝ็ปใ่ฟ่กๆถ้ดใ็ณป็ปไฟกๆฏใ้ฒ็ซๅขใ็ซฏๅฃ็ๆงใๆฅๅฟๆฅ็ๅจใ็จๆท/ๆ้ใ่ฏไนฆ็ญๆดๅคไฟกๆฏใๅ
ๆฌๆถ้ดๅบๅๅๅฒๅพ่กจๅๆฏๆ ntfy ไธ webhook ็้ๅผๅ่ญฆใ
+ๅจๅคงๅคๆฐ Linux ๆๅกๅจไธๆฅ็ CPUใๅ
ๅญใ็ฃ็ใ็ฝ็ปใๆธฉๅบฆใ่ฟ่กๆถ้ดใ่ฟ็จใ็ซฏๅฃใ็ปๅฝ่ฎฐๅฝๅ็ณป็ปไฟกๆฏ๏ผๅนถ้ๅธฆๅๅฒๆฒ็บฟๅพใ็ฎก็ๅก็่ฎฉไฝ ๆ ้็ฆปๅผ Termix ๅฐฑ่ฝๅค็ๆๅกใๅฎๆถไปปๅกใ่ฝฏไปถๅ
ใ็จๆทใ้ฒ็ซๅข่งๅใWireGuardใTailscaleใSSL ่ฏไนฆใๆฅๅฟๅๅฅๅบทๆฃๆฅใ
-**็จๆท่ฎค่ฏ:**
-ๅฎๅ
จ็็จๆท็ฎก็๏ผๅ
ทๆ็ฎก็ๅๆงๅถ๏ผๅฏ็ผ่พๅ
ถไป็จๆทไฟกๆฏ๏ผๅ OIDC/LDAP/SSO๏ผๅธฆ่ฎฟ้ฎๆงๅถ๏ผใ2FA (TOTP) ไปฅๅ้่กๅฏ้ฅ๏ผWebAuthn๏ผๆฏๆใๆฅ็ๆๆๅนณๅฐไธ็ๆดปๅจ็จๆทไผ่ฏๅนถๆค้ๆ้ใๅฐๆจ็ OIDC/ๆฌๅฐ่ดฆๆท้พๆฅๅจไธ่ตทใๆฅ็ๆๆ็จๆทๆไฝ็ๅฎก่ฎกๆฅๅฟใ
+**่ชๅจๅ:**
+ๅ
้ไธไธช่งฆๅๆกไปถ๏ผๅๅณๅฎ่ฆๅไปไนใ่งฆๅๆกไปถๅ
ๆฌๆๆ ่ถ
่ฟ้ๅผใไธปๆบไธ็บฟๆไธ็บฟใๅฅๅบทๆฃๆฅ็ถๆๅๅใๅฎๆถ่ฎกๅใๅฎนๅจไบไปถ๏ผๆ่
ไธไธชไผ ๅ
ฅ็ Webhookใๆญฅ้ชคๅฏไปฅๆง่กๅฝไปคๅไปฃ็ ็ๆฎตใๆงๅถๅฎนๅจๅ้ง้ใๅค้ไธปๆบใ่ฐ็จๆไธช็ฝๅใ็ญๅพ
ใๆๆกไปถๅๆฏใ่ฟ่กๅฆไธไธช่ชๅจๅ๏ผๅนถ้่ฟ ntfyใDiscord ๆ Webhook ้็ฅไฝ ใๆต่ฏ่ฟ่ก่ฎฉไฝ ๅ
ๅฎๅ
จๅฐ่ฏไธ้ใ
-**Tailscale ้ๆ:**
-ๅๅบๆจ Tailscale ็ฝ็ปไธญ็่ฎพๅคไปฅๅฟซ้ๆทปๅ ไธบไธปๆบ๏ผๅนถไฝฟ็จ Tailscale SSH ไฝไธบ่บซไปฝ้ช่ฏๆนๅผ๏ผ่ฎฉๆจ็ Tailscale ACL ๅค็ๆๆ่ๆ ้ๅญๅจๅญๆฎใ
+**ๆบ็พค:**
+้่ฟๆๅจๆ้ๆๆ ็ญพ่งๅๆไธปๆบ็ผๆไธไธชๆบ็พค๏ผๆฐไธปๆบๅฏไปฅ่ชๅจๅ ๅ
ฅใไธๆฌกๅจๆๆไธปๆบไธๆง่กๅไธๆกๅฝไปค๏ผๅๅ
จ้จไธปๆบๆจ้ๅๆๅๆไปถ๏ผๅฎ่ฃ
่ฝฏไปถๅ
๏ผๅนถๆถ้็ณป็ปใๅ
ๆ ธใๆถๆๅ่ฟ่กๆถ้ด็ๆธ
ๅใ
-**RBAC/ๅ
ฑไบซ:**
-ๅๅปบ่ง่ฒๅนถๅจ็จๆท/่ง่ฒไน้ดๅ
ฑไบซไธปๆบใๆฏๆๆๆ่ฎค่ฏ็ฑปๅๅๆๆไธปๆบๅ่ฎฎใ
+**AI ๅฉๆ:**
+ๅฏ้ๅ่ฝ๏ผ้ป่ฎคๅ
ณ้ญ๏ผ้่ฆไฝ ๆๅจๅผๅฏใๆฅๅ
ฅ OpenAIใAnthropicใGeminiใOllama ๆไปปไฝๅ
ผๅฎน OpenAI ็ๆฅๅฃ๏ผๅๅฎ่ฏข้ฎไฝ ็้
็ฝฎใๅฎๅฏไปฅ่ฏปๅไธปๆบใๆบ็พคใไปฃ็ ็ๆฎตๅๅ่ญฆ๏ผๅนถๆๆนๅจไฝไธบๅปบ่ฎฎๆไบค็ปไฝ ็กฎ่ฎค๏ผ่ไธไผ่ช่กไฟฎๆนใๅฎๆฐธ่ฟๆ ๆณๆฅ่งฆๅญๆฎใ็จๆทๅ่ฎพ็ฝฎใ็ฎก็ๅๅฏไปฅๅฏนๆดไธชๅฎไพๅ
ณ้ญๅฎ๏ผไฝ ไนๅฏไปฅๅจๅๅง่ฎพ็ฝฎๆถๆๅฎ้่ใ
-**ไธฒๅฃ่ฟๆฅ:**
-็ดๆฅไปๆต่งๅจๆๆก้ขๅบ็จ่ฟๆฅๅฐไธฒๅฃ่ฎพๅค๏ผ่ทฏ็ฑๅจใไบคๆขๆบใๅพฎๆงๅถๅจ็ญ๏ผใ้
็ฝฎๆณข็น็ใๆฐๆฎไฝใๅๆญขไฝๅๅฅๅถๆ ก้ชใๅจๆฏๆ็ๆต่งๅจไธญไฝฟ็จ Web Serial API๏ผๆๅจ Electron ๅบ็จไธญไฝฟ็จๅ็ๅ็ซฏใ
+**็ปๅฝไธ็จๆท:**
+ๆฏๆๆฌๅฐ่ดฆๆท๏ผไปฅๅ OIDCใLDAPใGitHub ๅ Google ็ปๅฝ๏ผ่ฟๆไธคๆญฅ้ช่ฏ๏ผTOTP๏ผใ้่กๅฏ้ฅ๏ผWebAuthn๏ผๅๅไฟกไปป่ฎพๅคใ็ฎก็ๅๅฏไปฅ็ฎก็็จๆทใๆ OIDC ็พค็ปๆ ๅฐๅฐ่ง่ฒใๆฅ็ๆๆๅนณๅฐไธ็ๆดปๅจไผ่ฏๅนถๅฐๅ
ถๅ้ใไฝ ๅฏไปฅๆๆฌๅฐ่ดฆๆทๅ OIDC ่ดฆๆทๅ
ณ่่ตทๆฅ๏ผๅนถๆฅ็่ฎฐๅฝๆๆไบบๆไฝ็ๅฎก่ฎกๆฅๅฟใ
+**่ง่ฒไธๅ
ฑไบซ:**
+ๅๅปบ่ง่ฒ๏ผๅนถๆๅไธช็บงๅซๆไธปๆบๅ
ฑไบซ็ป็จๆทๆ่ง่ฒ๏ผ่ฟๆฅใๆฅ็ใ็ผ่พๅ็ฎก็ใ้็จไบๆๆ่ฎค่ฏๆนๅผๅๆๆๅ่ฎฎ๏ผๅนถไธๅฏไปฅ่ฆ็ๅ
ฑไบซไธปๆบๆไฝฟ็จ็ๅญๆฎใ
+
+
+
+
+
+
**ๅ่ญฆ:**
-ไธบไธปๆบๆๆ ๏ผCPUใๅ
ๅญใ็ฃ็็ญ๏ผ่ฎพ็ฝฎๅบไบ้ๅผ็ๅ่ญฆ่งๅ๏ผๅนถ้่ฟ ntfy ๆ webhook ๆฅๆถ่งฆๅ้็ฅใๅจๅๅฒๆฅๅฟไธญๆฅ็่งฆๅๅๅทฒ่งฃๅณ็ๅ่ญฆใ
+ไธบ CPUใๅ
ๅญใ็ฃ็็ญไธปๆบๆๆ ่ฎพ็ฝฎ่งๅ๏ผ่งฆๅๆถ้่ฟ ntfyใDiscord ๆ Webhook ้็ฅไฝ ใๅจๅๅฒ่ฎฐๅฝไธญๆฅ็ๆญฃๅจ่งฆๅๅๅทฒๆขๅค็ๅ่ญฆ๏ผๅนถๅฟฝ็ฅไฝ ไธๅ
ณๅฟ็้ฃไบใ
-
-
**ไธป้กต:**
-ๅ
ทๆๆๆพๅฐ็ปไปถ็ฝๆ ผ็ๅฎๅ
จๅฏๅฎๅถไธป้กตใๆทปๅ ไธปๆบ็ถๆใๆๅก้พๆฅใๆถ้ใ็ฌ่ฎฐใRSS ่ฎข้
ใๅคฉๆฐใDocker ๅฎนๅจใไธปๆบๆๆ ๅพ่กจใๅตๅ
ฅๅผ็ป็ซฏใiframe ็ญๅฐ็ปไปถใ
-
-
-
-
-**ๆฐๆฎๅบๅ ๅฏ:**
-ๅ็ซฏๅญๅจไธบๅ ๅฏ็ SQLite ๆฐๆฎๅบๆไปถใๆฅ็[ๆๆกฃ](https://docs.termix.site/security)ไบ่งฃๆดๅคใ
+ไธไธช็ฑไฝ ่ชๅทฑๆญๅปบ็ๆๆพๅฐ็ปไปถ็ฝๆ ผใๅฐ็ปไปถๅ
ๆฌไธปๆบ็ถๆใPingใๆๅก้พๆฅใไนฆ็ญพใๆ็ดขใๆถ้ใๆฅๅใๅ่ฎกๆถใไพฟ็ญพใRSSใๅคฉๆฐใๅพ็ใๅ
ๅต็ฝ้กตใDockerใ้ง้ใๆๆ ๅพ่กจใ่ชๅฎไน API๏ผ็่ณ่ฟๆไธไธชๅฎๆถ็ป็ซฏใ
-**็ฝ็ปๅพ:**
-่ชๅฎไนๆจ็ไปช่กจๆฟ๏ผๆ นๆฎๆจ็ SSH ่ฟๆฅๅฏ่งๅๆจ็ๅฎถๅบญๅฎ้ชๅฎค๏ผๅนถๆฏๆ็ถๆ็ๆตใ
+**ไปฃ็ ็ๆฎตไธๅทฅๅ
ท:**
+ไฟๅญๅธธ็จๅฝไปค๏ผไธ้ฎๆง่ก๏ผๅนถๆฏๆไธปๆบๅ้ๅ่ชๅฎไน่พๅ
ฅใๅฏไปฅๅจๆๆๅทฒๆๅผ็็ป็ซฏไธญๅๆถ่ฟ่กไธๆกๅฝไปค๏ผไนๅฏไปฅๅธฆ่ชๅจ่กฅๅ
จๅฐๆ็ดขๅฝไปคๅๅฒใ
-**SSH ๅทฅๅ
ท:**
-ๅๅปบๅฏ้็จ็ๅฝไปค็ๆฎต๏ผๅช้็นๅปไธไธๅณๅฏๆง่กใๅจๅคไธชๆๅผ็็ป็ซฏไธญๅๆถ่ฟ่กไธไธชๅฝไปคใ
+**ไผ่ฏๅ
ฑไบซ:**
+ๅฎๆถๅ
ฑไบซ็ป็ซฏใRDPใVNC ๆ Telnet ไผ่ฏใๅฏไปฅๅ้ไธไธชๆ ้่ดฆๆทๅณๅฏๅ ๅ
ฅ็้พๆฅ๏ผไนๅฏไปฅๅ
ฑไบซ็ปๆๅฎ็ Termix ็จๆท๏ผๅนถ้ๆฉๅช่ฏปๆๅฏ่ฏปๅใๅ
ฑไบซๅฏไปฅ่ชๅจ่ฟๆๆ้ๆถๆค้๏ผไนๅฏไปฅๅ
จๅฑๆๆไธปๆบๅ
ณ้ญใ
-**ๆไน
ๆ ็ญพ้กต:**
-ๅฆๆๅจ็จๆทไธชไบบ่ตๆไธญๅฏ็จ๏ผSSH ไผ่ฏๅๆ ็ญพ้กตๅฐๅจ่ฎพๅค/ๅทๆฐๅไฟๆๆๅผ็ถๆใ
+**ไผ่ฏๅฝๅถไธๆฅๅฟ:**
+ๅฝๅถ็ป็ซฏใRDP ๅ VNC ไผ่ฏ๏ผไนๅๅฏไปฅๅๆพใๅฏไปฅไธ่ฝฝไผ่ฏ็็บฏๆๆฌๆฅๅฟ๏ผไนๅฏไปฅๆฅ็่ฟๆฅๆฅๅฟ๏ผไบ่งฃ่ฟๆฅ่ฟ็จไธญ็ฉถ็ซๅ็ไบไปไนใ
-**่ฏญ่จ:**
-ๅ
็ฝฎๆฏๆ็บฆ 30 ็ง่ฏญ่จ๏ผ็ฑ [Crowdin](https://docs.termix.site/translations) ็ฎก็๏ผใ
+**ไธฒๅฃ่ฟๆฅ:**
+ไปๆต่งๅจๆๆก้ขๅบ็จ่ฟๆฅ่ทฏ็ฑๅจใไบคๆขๆบๅๅ็ๆบ็ญไธฒๅฃ่ฎพๅคใๅฏ่ฎพ็ฝฎๆณข็น็ใๆฐๆฎไฝใๅๆญขไฝๅๆ ก้ชไฝใๅจๆฏๆ็ๆต่งๅจไธญไฝฟ็จ Web Serial API๏ผๅจๆก้ขๅบ็จไธญไฝฟ็จๅ็ๅ็ซฏใ
+
+
+
+
+
+
+**Tailscale:**
+ไปไฝ ็ tailnet ไธญๆๅ่ฎพๅค๏ผ็นๅ ไธๅฐฑ่ฝๆๅฎไปฌๆทปๅ ไธบไธปๆบ๏ผๅนถไฝฟ็จ Tailscale SSH ่ฟๆฅ๏ผ็ฑ tailnet ACL ่ด่ดฃ่ฎฟ้ฎๆงๅถ๏ผๆ ้ไฟๅญไปปไฝๅญๆฎใไนๆฏๆ Headscale ๅ่ชๅฎไนๆฅๅฃๅฐๅใ
+
+
+
+
+**Proxmox:**
+็ดๆฅไป Proxmox ๅฎไพๅฏผๅ
ฅไธปๆบ๏ผๅนถๅจไธๅฑๆ ็ญพ้กตไธญๆฅ็่็นๅ่ๆๆบ็็ถๆ๏ผๅ
ๆฌ CPUใๅ
ๅญๅๅญๅจใ
+
+
+
+
+
+
+**ๅทฅไฝๅบไธๆ ็ญพ้กต:**
+ไฟๅญไธ็ปๆ ็ญพ้กตๅๅ
ถๅๅฑๅธๅฑ๏ผไธ้ฎๅฐฑ่ฝๆๆดๅฅ้ๆฐๆๅผใTermix ่ฟไผ่ฎฐไฝไฝ ไธๆฌก็ไผ่ฏ๏ผๆไปฅๅทๆฐ้กต้ขๆๆข่ฎพๅคๅๆ ็ญพ้กต้ฝไผๅๆฅใ
+
+
+
+
+**ๅผๅฏผ่ฎพ็ฝฎ:**
+ไธไธช็ฎ็ญ็ๅผๅฏผๆต็จไผๅธฆไฝ ้ๆฉ็้ข้ข่ฎพใไธป้ขใ้่ฆ็ๅ่ฝ๏ผไปฅๅ็ฌฌไธๅฐไธปๆบใ็ฎๆดๆจกๅผไผ้่ไฝ ็จไธๅฐ็ไธ่ฅฟ๏ผไฝ ้ๆถๅฏไปฅ้ๆฐ่ฟ่กๅผๅฏผๆๅๆข้ข่ฎพใ
+
+
+
+
+
+
+**ๆก้ข็ฌ็ซ่ฟ่กไธๅๆญฅ:**
+ๆก้ขๅบ็จๅฏไปฅๅฎๅ
จ็ฌ็ซ่ฟ่ก๏ผ่ชๅธฆๆฌๅฐๅ็ซฏๅๆฐๆฎๅบ๏ผไธ้่ฆๆๅกๅจใไฝ ไนๅฏไปฅๆๅฎ่ฟๅฐ Termix ๆๅกๅจ๏ผๅๅๅๆญฅไธปๆบใๅญๆฎใไปฃ็ ็ๆฎต็ญๅ
ๅฎน๏ผๅนถ้ๆฉ่ฟๆฅๆฏๅจๆฌๅฐๅ่ตท่ฟๆฏ้่ฟๆๅกๅจๅ่ตทใ
+
+
+
+
+**ๅฝไปค่กๅทฅๅ
ท:**
+`termix` ๅฝไปค่กๅทฅๅ
ท๏ผๅฏ็จไบไฝ ็็ป็ซฏๅ่ๆฌใๆๅผ็ป็ซฏใๅจๅๅฐไธปๆบๆๆดไธชๆบ็พคไธๆง่กๅฝไปคใ้่ฟ SFTP ไผ ่พๆไปถ๏ผไปฅๅ็ฎก็ไธปๆบใไปฃ็ ็ๆฎตๅๅญๆฎใ็จ `npm install -g @termix-cli/cli` ๅฎ่ฃ
๏ผๆ่
็ดๆฅไธ่ฝฝ็ฌ็ซ็ๅฏๆง่กๆไปถใ่ฏฆ่ง [CLI ๆๆกฃ](https://docs.termix.site/cli)ใ
+
+
+
+
+
+
+**ๅฎๅ
จ:**
+ๅฏ็ ใๅฏ้ฅๅๅ
ถไปๆบๅฏๆ็จๆทๅ ๅฏ๏ผๆฐๆฎๅบๆไปถๆฌ่บซไนๅฏไปฅๅจ็ฃ็ไธๅ ๅฏใๅ
ทไฝๅ็่ฏทๆฅ็[ๆๆกฃ](https://docs.termix.site/security)ใ
+
+
+
+
+**ๅค่ฏญ่จ:**
+ๅ
็ฝฎ็บฆ 30 ็ง่ฏญ่จ๏ผ้่ฟ [Crowdin](https://docs.termix.site/translations) ็ฎก็ใ
@@ -199,17 +255,20 @@ Termix ๆฏไธไธชๅผๆบใๆฐธไน
ๅ
่ดนใ่ชๆ็ฎก็ไธไฝๅๆๅกๅจ็ฎก็ๅนณ
ๆดๅคๅ่ฝ
@@ -220,11 +279,11 @@ Termix ๆฏไธไธชๅผๆบใๆฐธไน
ๅ
่ดนใ่ชๆ็ฎก็ไธไฝๅๆๅกๅจ็ฎก็ๅนณ
ๅนณๅฐ
-ๅ่ก็
+ๅ่กๆนๅผ
Web ไปปไฝ็ฐไปฃๆต่งๅจ๏ผChromeใSafariใFirefox๏ผยท PWA ๆฏๆ
+ไปปไฝ็ฐไปฃๆต่งๅจ๏ผChromeใSafariใFirefox๏ผยท ๆฏๆ PWA
Windows x64/ia32
@@ -325,10 +410,6 @@ Termix ๅ
่ดนไธๅผๆบ๏ผๆฒกๆ่ฎข้
ๆไป่ดนๆนๆกใๅฆๆๆจ่งๅพๅฎๆ็จ
-
-
-
@@ -340,14 +421,17 @@ Termix ๅ
่ดนไธๅผๆบ๏ผๆฒกๆ่ฎข้
ๆไป่ดนๆนๆกใๅฆๆๆจ่งๅพๅฎๆ็จ
-
+
+
+
ๅจ YouTube ไธ่ง็ๆดๆฐๆฆ่ง
+ๅจ YouTube ไธ่ง็็ๆฌๆดๆฐไป็ป
-ๆไบ่ง้ขๅๅพๅๅฏ่ฝๅทฒ่ฟๆถ๏ผๆ่
ๅฏ่ฝๆ ๆณๅฎ็พๅฑ็คบๅ่ฝใ
+้จๅ่ง้ขๅๅพ็ๅฏ่ฝๅทฒ็ป่ฟๆถ๏ผๆ่
ไธ่ฝๅฎๆดๅฑ็คบๅ่ฝใ
@@ -407,10 +491,10 @@ Termix ๅ
่ดนไธๅผๆบ๏ผๆฒกๆ่ฎข้
ๆไป่ดนๆนๆกใๅฆๆๆจ่งๅพๅฎๆ็จ
## ่ฎกๅๅ่ฝ
-ๆฅ็ [Projects](https://github.com/orgs/Termix-SSH/projects/5) ไบ่งฃๆๆ่ฎกๅๅ่ฝใๅฆๆๆจๆณ่ดก็ฎไปฃ็ ๏ผ่ฏทๅ้
[Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)ใ
+ๆๆ่ฎกๅไธญ็ๅ่ฝ้ฝๅจ [Projects](https://github.com/orgs/Termix-SSH/projects/5) ้ใๅฆๆไฝ ๆณๅไธ่ดก็ฎ๏ผ่ฏทๆฅ็[่ดก็ฎๆๅ](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)ใ
Termix
-Selbst gehostete SSH-Verwaltung und Remote-Desktop-Zugriff
+Selbst gehostete Serververwaltung, von SSH und Remotedesktop bis zu Automatisierungen
English ยท
@@ -37,7 +37,7 @@
-**SSH-Terminalzugriff:**
-Voll ausgestattetes Terminal mit Split-Screen-Unterstutzung (bis zu 4 Panels) mit einem browserahnlichen Tab-System. Enthalt Unterstutzung fur die Anpassung des Terminals einschliesslich gangiger Terminal-Themes, Schriftarten und anderer Komponenten.
+**SSH-Terminal:**
+Ein vollwertiges Terminal mit Tabs wie im Browser und geteiltem Bildschirm, bis zu 6 Bereiche gleichzeitig. Thema, Schrift und Farben wรคhlst du selbst. รber jeder Sitzung sitzt eine Leiste mit CPU, Speicher und Festplatte in Echtzeit sowie Verknรผpfungen zu Dateien, Docker, Tunneln und Metriken dieses Hosts.
-**Remote-Desktop-Zugriff:**
-RDP-, VNC- und Telnet-Unterstutzung uber den Browser mit vollstandiger Anpassung und Split-Screen.
+**Remotedesktop:**
+RDP, VNC und Telnet im Browser, in Tabs und geteiltem Bildschirm wie jede andere Sitzung. Mit Dateibrowser fรผr RDP-Laufwerke und Hochladen per Drag-and-drop. Auf dem Windows-Desktop kannst du einen Host auch im nativen RDP-Client รถffnen.
-**SSH-Tunnelverwaltung:**
-Erstellen und verwalten Sie Server-zu-Server-SSH-Tunnel mit automatischer Wiederverbindung, Gesundheitsuberwachung sowie lokaler, entfernter oder dynamischer SOCKS-Weiterleitung. Desktop-Client-zu-Server-Tunneleinstellungen werden lokal pro Desktop-Installation gespeichert, optionale C2S-Preset-Snapshots konnen auf dem Server gespeichert, umbenannt, geladen oder geloscht werden, wenn Sie eine lokale Tunnelkonfiguration zwischen Clients ubertragen mochten.
+**SSH-Tunnel:**
+Lokale, entfernte und dynamische SOCKS-Weiterleitung mit automatischem Neuverbinden und Statusprรผfungen. Client-zu-Server-Tunnel der Desktop-App bleiben auf diesem Rechner, und du kannst Voreinstellungen auf dem Server speichern, um eine Konfiguration auf einen anderen Rechner zu รผbernehmen.
-**Remote-Dateimanager:**
-Verwalten Sie Dateien direkt auf Remote-Servern mit Unterstutzung fur das Anzeigen und Bearbeiten von Code, Bildern, Audio und Video. Laden Sie Dateien hoch, herunter, benennen Sie sie um, loschen oder verschieben Sie sie nahtlos mit Sudo-Unterstutzung. Enthalt Unterstutzung fur das Verschieben von Dateien von Server zu Server.
+**Dateimanager:**
+Dateien รผber SFTP durchsuchen, bearbeiten, hochladen, herunterladen, umbenennen, verschieben und lรถschen, auch mit sudo. Code, Bilder, Audio und Video ansehen und bearbeiten. Dateien direkt von einem Server zum anderen kopieren, wobei der schnellste Weg fรผr dich gewรคhlt und die รbertragung auf Fehler geprรผft wird.
-**Docker- und Podman-Verwaltung:**
-Container starten, stoppen, pausieren, entfernen. Container-Statistiken anzeigen. Container uber Docker-Exec-Terminal steuern. Unterstutzt sowohl Docker als auch Podman als Container-Laufzeitumgebung. Es wurde nicht entwickelt, um Portainer oder Dockge zu ersetzen, sondern um Ihre Container einfach zu verwalten, anstatt sie zu erstellen.
+**Docker und Podman:**
+Container starten, stoppen, pausieren und entfernen, ihre Auslastung ansehen und eine Shell darin รถffnen. Funktioniert mit Docker und mit Podman. Es soll Portainer oder Dockge nicht ersetzen, sondern nur die Container verwalten, die du schon hast.
-**SSH-Host-Manager:**
-Speichern, organisieren und verwalten Sie Ihre SSH-Verbindungen mit Tags und Ordnern (Ordneranpassung und verschachtelte Ordner werden unterstutzt) und speichern Sie einfach wiederverwendbare Anmeldeinformationen mit der Moglichkeit, die Bereitstellung von SSH-Schlusseln zu automatisieren.
+**Hostverwaltung:**
+Hosts mit Tags und verschachtelten Ordnern ordnen, die du benennen und einfรคrben kannst. Gespeicherte Zugangsdaten fรผr mehrere Hosts wiederverwenden, SSH-Schlรผssel automatisch verteilen, Hosts unter einem รผbergeordneten Host gruppieren, in groรen Mengen bearbeiten und exportieren. Fรผr einmalige Verbindungen, die du nicht speichern willst, gibt es Schnellverbindung.
@@ -111,83 +111,139 @@ Speichern, organisieren und verwalten Sie Ihre SSH-Verbindungen mit Tags und Ord
**Host-Metriken:**
-CPU-, Arbeitsspeicher- und Festplattenauslastung, Netzwerk, Betriebszeit, Systeminformationen, Firewall, Port-Monitor, Log-Viewer, Benutzer/Berechtigungen, Zertifikate und vieles mehr anzeigen, was auf den meisten Linux-basierten Servern funktioniert. Enthalt Zeitreihen-Verlaufsdiagramme und schwellenwertbasierte Warnmeldungen mit ntfy- und Webhook-Unterstutzung.
+CPU, Speicher, Festplatte, Netzwerk, Temperatur, Laufzeit, Prozesse, Ports, Anmeldungen und Systeminfos auf den meisten Linux-Servern, mit Verlaufsgrafiken. รber Verwaltungskarten kรผmmerst du dich um Dienste, Cronjobs, Pakete, Benutzer, Firewallregeln, WireGuard, Tailscale, SSL-Zertifikate, Logs und Statusprรผfungen, ohne Termix zu verlassen.
-**Benutzerauthentifizierung:**
-Sichere Benutzerverwaltung mit Admin-Kontrollen (kann Informationen anderer Benutzer bearbeiten) und OIDC-/LDAP-/SSO-Unterstutzung (mit Zugriffskontrolle), 2FA (TOTP) und Passkey (WebAuthn)-Unterstutzung. Aktive Benutzersitzungen uber alle Plattformen anzeigen und Berechtigungen widerrufen. OIDC-/Lokale Konten miteinander verknupfen. Audit-Protokoll aller Benutzeraktionen anzeigen.
+**Automatisierungen:**
+Wรคhle einen Auslรถser und lege fest, was passieren soll. Auslรถser sind unter anderem eine Metrik รผber einem Schwellwert, ein Host der hoch- oder runtergeht, eine geรคnderte Statusprรผfung, ein Zeitplan, ein Container-Ereignis oder ein eingehender Webhook. Schritte kรถnnen Befehle und Snippets ausfรผhren, Container und Tunnel steuern, einen Host aufwecken, eine URL aufrufen, warten, sich nach einer Bedingung verzweigen, eine andere Automatisierung starten und dich รผber ntfy, Discord oder einen Webhook benachrichtigen. Mit Testlรคufen probierst du alles gefahrlos aus.
-**Tailscale-Integration:**
-Gerate aus Ihrem Tailnet auflisten, um sie schnell als Hosts hinzuzufugen, und mit Tailscale SSH als Authentifizierungsmethode verbinden, sodass Ihre Tailnet-ACLs die Autorisierung ubernehmen, ohne Anmeldedaten speichern zu mussen.
+**Flotten:**
+Fasse Hosts zu einer Flotte zusammen, entweder von Hand oder รผber Tag-Regeln, damit neue Hosts von selbst dazukommen. Fรผhre einen Befehl auf allen Hosts gleichzeitig aus, schiebe und hole Dateien auf allen, installiere Pakete und sammle eine รbersicht รผber Betriebssystem, Kernel, Architektur und Laufzeit.
-**RBAC/Freigabe:**
-Erstellen Sie Rollen und teilen Sie Hosts uber Benutzer/Rollen hinweg. Unterstutzt alle Authentifizierungstypen und alle Host-Protokolle.
+**KI-Assistent:**
+Optional und aus, bis du ihn einschaltest. Verbinde OpenAI, Anthropic, Gemini, Ollama oder einen beliebigen OpenAI-kompatiblen Endpunkt und frag ihn zu deiner Umgebung. Er liest Hosts, Flotten, Snippets und Warnungen und schlรคgt รnderungen vor, die du bestรคtigst, statt sie selbst vorzunehmen. An Zugangsdaten, Benutzer und Einstellungen kommt er nie heran. Administratoren kรถnnen ihn fรผr die ganze Instanz auslassen, und du kannst ihn schon bei der Einrichtung ausblenden.
-**Serielle Verbindungen:**
-Verbinden Sie sich direkt vom Browser oder der Desktop-App aus mit seriellen Geraten (Router, Switches, Mikrocontroller usw.). Konfigurieren Sie Baudrate, Datenbits, Stoppbits und Paritat. Verwendet die Web Serial API in unterstutzten Browsern oder ein natives Backend in der Electron-App.
+**Anmeldung und Benutzer:**
+Lokale Konten sowie Anmeldung รผber OIDC, LDAP, GitHub und Google, dazu Zwei-Faktor-Authentifizierung (TOTP), Passkeys (WebAuthn) und vertrauenswรผrdige Gerรคte. Administratoren kรถnnen Benutzer verwalten, OIDC-Gruppen auf Rollen abbilden, alle aktiven Sitzungen รผber alle Plattformen hinweg sehen und beenden. Verknรผpfe dein lokales Konto mit deinem OIDC-Konto und lies im Prรผfprotokoll nach, wer was gemacht hat.
-**Warnmeldungen:**
-Legen Sie schwellenwertbasierte Warnregeln fur Host-Metriken (CPU, Arbeitsspeicher, Festplatte usw.) fest und erhalten Sie Benachrichtigungen uber ntfy oder Webhooks, wenn diese ausgelost werden. Zeigen Sie ausgeloste und aufgeloste Warnmeldungen in einem Verlaufsprotokoll an.
+**Rollen und Freigaben:**
+Lege Rollen an und teile Hosts mit Benutzern oder Rollen auf vier Stufen: Verbinden, Ansehen, Bearbeiten und Verwalten. Das funktioniert mit jeder Authentifizierungsart und jedem Protokoll, und du kannst die Zugangsdaten fรผr einen geteilten Host รผberschreiben.
+**Warnungen:**
+Lege Regeln fรผr Host-Metriken wie CPU, Speicher und Festplatte fest und lass dich รผber ntfy, Discord oder einen Webhook benachrichtigen, wenn sie greifen. Sieh dir aktive und wieder behobene Warnungen im Verlauf an und blende aus, was dich nicht interessiert.
+
+
+
+
**Startseite:**
-Eine vollstandig anpassbare Startseite mit einem Drag-and-Drop-Widget-Raster. Fugen Sie Widgets fur Hoststatus, Service-Links, Uhren, Notizen, RSS-Feeds, Wetter, Docker-Container, Host-Metrik-Diagramme, eingebettete Terminals, iFrames und mehr hinzu.
-
-
-
-
-**Datenbankverschlusselung:**
-Backend gespeichert als verschlusselte SQLite-Datenbankdateien. Weitere Informationen in der [Dokumentation](https://docs.termix.site/security).
+Ein Raster aus Widgets, das du selbst per Drag-and-drop zusammenstellst. Widgets fรผr Hoststatus, Pings, Dienstlinks, Lesezeichen, Suche, Uhren, Kalender, Countdowns, Notizen, RSS, Wetter, Bilder, Iframes, Docker, Tunnel, Metrikdiagramme, eigene APIs und sogar ein laufendes Terminal.
-**Netzwerkgraph:**
-Passen Sie Ihr Dashboard an, um Ihr Homelab basierend auf Ihren SSH-Verbindungen mit Statusunterstutzung zu visualisieren.
+**Snippets und Werkzeuge:**
+Speichere Befehle, die du oft brauchst, und starte sie mit einem Klick, mit Variablen fรผr den Host und eigene Eingaben. Fรผhre einen Befehl in allen offenen Terminals zugleich aus und durchsuche deinen Befehlsverlauf mit Autovervollstรคndigung.
-**SSH-Werkzeuge:**
-Erstellen Sie wiederverwendbare Befehlsvorlagen, die mit einem einzigen Klick ausgefuhrt werden. Fuhren Sie einen Befehl gleichzeitig in mehreren geoffneten Terminals aus.
+**Sitzungsfreigabe:**
+Teile eine laufende Terminal-, RDP-, VNC- oder Telnet-Sitzung in Echtzeit. Verschicke einen Link, dem jeder ohne Konto beitreten kann, oder teile mit einem bestimmten Termix-Benutzer, nur lesend oder mit Schreibrechten. Freigaben kรถnnen von selbst ablaufen oder zurรผckgezogen werden und lassen sich global oder pro Host abschalten.
-**Persistente Tabs:**
-SSH-Sitzungen und Tabs bleiben uber Gerate/Aktualisierungen hinweg offen, wenn im Benutzerprofil aktiviert.
+**Sitzungsaufzeichnung und Protokolle:**
+Zeichne Terminal-, RDP- und VNC-Sitzungen auf und spiel sie spรคter ab. Lade einfache Textprotokolle einer Sitzung herunter und sieh im Verbindungsprotokoll nach, was wรคhrend einer Verbindung genau passiert ist.
+
+
+
+
+**Serielle Verbindungen:**
+Sprich mit seriellen Gerรคten wie Routern, Switches und Mikrocontrollern, aus dem Browser oder der Desktop-App. Stelle Baudrate, Datenbits, Stoppbits und Paritรคt ein. Nutzt die Web-Serial-API in passenden Browsern oder ein natives Backend in der Desktop-App.
+
+
+
+
+
+
+**Tailscale:**
+Hol Gerรคte aus deinem Tailnet, um sie mit ein paar Klicks als Hosts anzulegen, und verbinde dich per Tailscale SSH, damit deine Tailnet-ACLs den Zugriff regeln und keine Zugangsdaten gespeichert werden. Headscale und eigene Endpunkte gehen auch.
+
+
+
+
+**Proxmox:**
+Importiere Hosts direkt aus einer Proxmox-Instanz und beobachte Knoten- und Gastwerte wie CPU, Speicher und Storage in einem eigenen Tab.
+
+
+
+
+
+
+**Arbeitsbereiche und Tabs:**
+Speichere eine Reihe von Tabs samt Aufteilung und รถffne alles mit einem Klick wieder. Termix merkt sich auch deine letzte Sitzung, sodass deine Tabs nach einem Neuladen und auf anderen Gerรคten wieder da sind.
+
+
+
+
+**Gefรผhrte Einrichtung:**
+Eine kurze Einrichtung fรผhrt dich durch die Wahl einer Oberflรคchenvorlage, deines Themas, der gewรผnschten Funktionen und deines ersten Hosts. Der einfache Modus blendet aus, was du nicht nutzt, und du kannst die Einrichtung jederzeit erneut starten oder die Vorlage wechseln.
+
+
+
+
+
+
+**Desktop eigenstรคndig und Synchronisierung:**
+Die Desktop-App lรคuft eigenstรคndig mit lokalem Backend und eigener Datenbank, ganz ohne Server. Du kannst sie auch mit einem Termix-Server verbinden, um Hosts, Zugangsdaten, Snippets und mehr in beide Richtungen abzugleichen, und wรคhlen, ob Verbindungen lokal oder รผber den Server aufgebaut werden.
+
+
+
+
+**Kommandozeile:**
+Ein `termix`-CLI fรผr deine Shell und deine Skripte. Terminals รถffnen, einen Befehl auf einem Host oder einer ganzen Flotte ausfรผhren, Dateien per SFTP verschieben und Hosts, Snippets und Zugangsdaten verwalten. Installiere es mit `npm install -g @termix-cli/cli` oder nimm eine eigenstรคndige Binรคrdatei. Siehe die [CLI-Dokumentation](https://docs.termix.site/cli).
+
+
+
+
+
+
+**Sicherheit:**
+Passwรถrter, Schlรผssel und andere Geheimnisse werden pro Benutzer verschlรผsselt, und die Datenbankdateien selbst lassen sich auf der Festplatte verschlรผsseln. Wie das funktioniert, steht in der [Dokumentation](https://docs.termix.site/security).
**Sprachen:**
-Integrierte Unterstutzung fur ca. 30 Sprachen (verwaltet uber [Crowdin](https://docs.termix.site/translations)).
+Rund 30 Sprachen sind eingebaut, verwaltet รผber [Crowdin](https://docs.termix.site/translations).
@@ -199,36 +255,39 @@ Integrierte Unterstutzung fur ca. 30 Sprachen (verwaltet uber [Crowdin](https://
Weitere Funktionen
Plattform
-Distribution
+Bezugsquelle
Web Jeder moderne Browser (Chrome, Safari, Firefox) ยท PWA-Unterstutzung
+Jeder moderne Browser (Chrome, Safari, Firefox) ยท PWA-fรคhig
Windows x64/ia32 Portabel ยท MSI-Installationsprogramm ยท Chocolatey
+Portabel ยท MSI-Installer ยท Chocolatey
Linux x64/ia32
@@ -325,10 +410,6 @@ Interessiert an einer bezahlten Platzierung zur Unterstutzung der Entwicklung? S
-
-
-
@@ -340,14 +421,17 @@ Interessiert an einer bezahlten Platzierung zur Unterstutzung der Entwicklung? S
-
+
+
+
Update-Ubersichten auf YouTube ansehen
+รbersichten zu Updates auf YouTube ansehen
-Einige Videos und Bilder konnen veraltet sein oder Funktionen moglicherweise nicht perfekt darstellen.
+Manche Videos und Bilder sind vielleicht veraltet oder zeigen die Funktionen nicht perfekt.
@@ -407,10 +491,10 @@ Wenn Sie Hilfe benotigen oder eine Funktion fur Termix anfragen mochten, besuche
## Geplante Funktionen
-Siehe [Projekte](https://github.com/orgs/Termix-SSH/projects/5) fur alle geplanten Funktionen. Wenn Sie beitragen mochten, siehe [Mitwirken](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Alle geplanten Funktionen stehen unter [Projects](https://github.com/orgs/Termix-SSH/projects/5). Wenn du mitarbeiten mรถchtest, sieh dir [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) an.
Termix
-Gestiรณn SSH autoalojada y acceso a escritorio remoto
+Gestiรณn de servidores autoalojada, desde SSH y escritorio remoto hasta automatizaciones
English ยท
@@ -37,7 +37,7 @@
Logrado el 1 de septiembre de 2025
+ Conseguido el 1 de septiembre de 2025
-**Acceso a Terminal SSH:**
-Terminal completo con soporte de pantalla dividida (hasta 4 paneles) con un sistema de pestanas similar al navegador. Incluye soporte para personalizar el terminal incluyendo temas comunes de terminal, fuentes y otros componentes.
+**Terminal SSH:**
+Un terminal completo con pestaรฑas como las del navegador y pantalla dividida, hasta 6 paneles a la vez. Elige tu tema, tu fuente y tus colores. Sobre cada sesiรณn hay una barra con CPU, memoria y disco en vivo, ademรกs de accesos rรกpidos a los archivos, Docker, tรบneles y mรฉtricas de ese host.
-**Acceso a Escritorio Remoto:**
-Soporte RDP, VNC y Telnet a traves del navegador con personalizacion completa y pantalla dividida.
+**Escritorio remoto:**
+RDP, VNC y Telnet en el navegador, en pestaรฑas y pantalla dividida como cualquier otra sesiรณn. Incluye un explorador de archivos para las unidades RDP y subida arrastrando y soltando. En el escritorio de Windows tambiรฉn puedes abrir un host en el cliente RDP nativo.
-**Gestion de Tuneles SSH:**
-Cree y gestione tuneles SSH de servidor a servidor con reconexion automatica, monitoreo de estado y reenvio local, remoto o dinamico SOCKS. La configuracion de tuneles de cliente de escritorio a servidor se almacena localmente por instalacion de escritorio, los snapshots de presets C2S opcionales pueden guardarse en el servidor, renombrarse, cargarse o eliminarse cuando desee mover una configuracion de tunel local entre clientes.
+**Tรบneles SSH:**
+Reenvรญo local, remoto y SOCKS dinรกmico, con reconexiรณn automรกtica y comprobaciones de estado. Los tรบneles de cliente a servidor de la aplicaciรณn de escritorio se guardan en ese equipo, y puedes guardar ajustes en el servidor para llevarte una configuraciรณn a otro equipo.
-**Gestor Remoto de Archivos:**
-Gestione archivos directamente en servidores remotos con soporte para visualizar y editar codigo, imagenes, audio y video. Suba, descargue, renombre, elimine y mueva archivos sin problemas con soporte sudo. Incluye soporte para mover archivos de servidor a servidor.
+**Gestor de archivos:**
+Navega, edita, sube, descarga, renombra, mueve y borra archivos por SFTP, con soporte para sudo. Mira y edita cรณdigo, imรกgenes, audio y vรญdeo. Copia archivos directamente de un servidor a otro, con la ruta mรกs rรกpida elegida por ti y las transferencias verificadas.
-**Gestion de Docker y Podman:**
-Inicie, detenga, pause, elimine contenedores. Vea estadisticas de contenedores. Controle contenedores usando el terminal docker exec. Compatible con Docker y Podman como entorno de ejecucion de contenedores. No fue creado para reemplazar Portainer o Dockge, sino para simplemente gestionar sus contenedores en lugar de crearlos.
+**Docker y Podman:**
+Arranca, para, pausa y elimina contenedores, mira sus estadรญsticas y abre una consola dentro de uno. Funciona con Docker y con Podman. No pretende sustituir a Portainer ni a Dockge, solo gestionar los contenedores que ya tienes.
-**Gestor de Hosts SSH:**
-Guarde, organice y gestione sus conexiones SSH con etiquetas y carpetas (con personalizacion de carpetas y soporte de carpetas anidadas), y guarde facilmente informacion de inicio de sesion reutilizable con la capacidad de automatizar el despliegue de claves SSH.
+**Gestor de hosts:**
+Guarda y organiza hosts con etiquetas y carpetas anidadas que puedes nombrar y colorear. Reutiliza credenciales guardadas entre hosts, despliega claves SSH automรกticamente, agrupa hosts bajo un host padre, edita y exporta en lote, y usa la conexiรณn rรกpida para conexiones puntuales que no quieres guardar.
-**Metricas del Host:**
-Vea el uso de CPU, memoria y disco, red, tiempo de actividad, informacion del sistema, firewall, monitor de puertos, visor de registros, usuarios/permisos, certificados y muchos mas, que funcionan en la mayoria de los servidores basados en Linux. Incluye graficos de historial de series temporales y alertas basadas en umbrales con soporte para ntfy y webhooks.
+**Mรฉtricas de host:**
+CPU, memoria, disco, red, temperatura, tiempo encendido, procesos, puertos, inicios de sesiรณn e informaciรณn del sistema en la mayorรญa de servidores Linux, con grรกficas de histรณrico. Las tarjetas de gestiรณn te dejan manejar servicios, tareas cron, paquetes, usuarios, reglas del cortafuegos, WireGuard, Tailscale, certificados SSL, registros y comprobaciones de estado sin salir de Termix.
-**Autenticacion de Usuarios:**
-Gestion segura de usuarios con controles de administrador (puede editar la informacion de otros usuarios) y soporte para OIDC/LDAP/SSO (con control de acceso), 2FA (TOTP) y soporte para passkeys (WebAuthn). Vea sesiones activas de usuarios en todas las plataformas y revoque permisos. Vincule sus cuentas OIDC/Locales entre si. Vea el registro de auditoria de las acciones de todos los usuarios.
+**Automatizaciones:**
+Elige un disparador y luego di quรฉ debe pasar. Los disparadores incluyen una mรฉtrica que supera un umbral, un host que se cae o vuelve, una comprobaciรณn de estado que cambia, una programaciรณn, un evento de contenedor o un webhook entrante. Los pasos pueden ejecutar comandos y fragmentos, controlar contenedores y tรบneles, despertar un host, llamar a una URL, esperar, ramificarse segรบn una condiciรณn, ejecutar otra automatizaciรณn y avisarte por ntfy, Discord o un webhook. Las ejecuciones de prueba te dejan probarlo sin riesgo.
-**Integracion con Tailscale:**
-Liste dispositivos de su red Tailscale para agregarlos rapidamente como hosts y conectese usando Tailscale SSH como metodo de autenticacion, permitiendo que las ACL de Tailscale gestionen la autorizacion sin almacenar credenciales.
+**Flotas:**
+Agrupa hosts en una flota eligiรฉndolos o con reglas de etiquetas, para que los nuevos entren solos. Ejecuta un comando en todos los hosts a la vez, envรญa y recoge archivos de todos ellos, instala paquetes y reรบne un inventario del sistema, el kernel, la arquitectura y el tiempo encendido.
-**RBAC/Compartir:**
-Cree roles y comparta hosts entre usuarios/roles. Compatible con todos los tipos de autenticacion y todos los protocolos de host.
+**Asistente de IA:**
+Es opcional y estรก apagado hasta que tรบ lo enciendas. Conecta OpenAI, Anthropic, Gemini, Ollama o cualquier punto de acceso compatible con OpenAI y pregรบntale sobre tu instalaciรณn. Puede leer hosts, flotas, fragmentos y alertas, y propone cambios para que los apruebes en lugar de hacerlos รฉl. Nunca puede tocar credenciales, usuarios ni ajustes. Los administradores pueden dejarlo apagado para toda la instancia, y tรบ puedes ocultarlo durante la configuraciรณn.
-**Conexiones Serie:**
-Conectese a dispositivos serie (routers, switches, microcontroladores, etc.) directamente desde el navegador o la aplicacion de escritorio. Configure la tasa de baudios, bits de datos, bits de parada y paridad. Utiliza la Web Serial API en navegadores compatibles o un backend nativo en la aplicacion Electron.
+**Acceso y usuarios:**
+Cuentas locales mรกs inicio de sesiรณn con OIDC, LDAP, GitHub y Google, con doble factor (TOTP), llaves de acceso (WebAuthn) y dispositivos de confianza. Los administradores pueden gestionar usuarios, asignar grupos de OIDC a roles, ver todas las sesiones activas en cualquier plataforma y revocarlas. Enlaza tu cuenta local con la de OIDC y consulta el registro de auditorรญa de lo que ha hecho cada uno.
+**Roles y comparticiรณn:**
+Crea roles y comparte hosts con usuarios o roles en cuatro niveles: conectar, ver, editar y gestionar. Funciona con todos los tipos de autenticaciรณn y todos los protocolos, y puedes cambiar las credenciales que se usan en un host compartido.
+
+
+
+
+
+
**Alertas:**
-Configure reglas de alerta basadas en umbrales para metricas del host (CPU, memoria, disco, etc.) y reciba notificaciones a traves de ntfy o webhooks cuando se activen. Vea las alertas activas y resueltas en un historial de registros.
+Pon reglas sobre mรฉtricas de host como CPU, memoria y disco, y recibe avisos por ntfy, Discord o un webhook cuando salten. Consulta las alertas activas y resueltas en un histรณrico y descarta las que no te importan.
+
+
+
+
+**Pรกgina de inicio:**
+Una rejilla de widgets que montas tรบ mismo arrastrando y soltando. Hay widgets para el estado de los hosts, pings, enlaces a servicios, marcadores, bรบsqueda, relojes, calendarios, cuentas atrรกs, notas, RSS, tiempo, imรกgenes, iframes, Docker, tรบneles, grรกficas de mรฉtricas, APIs propias e incluso un terminal en vivo.
-**Pagina de Inicio:**
-Una pagina de inicio completamente personalizable con una cuadricula de widgets de arrastrar y soltar. Agregue widgets para estado del host, enlaces de servicios, relojes, notas, feeds RSS, clima, contenedores Docker, graficos de metricas del host, terminales integrados, iframes y mas.
+**Fragmentos y herramientas:**
+Guarda los comandos que usas a menudo y lรกnzalos con un clic, con variables para el host y para lo que tรบ escribas. Ejecuta un mismo comando en todos los terminales abiertos y busca en tu historial con autocompletado.
-**Cifrado de Base de Datos:**
-Backend almacenado como archivos de base de datos SQLite cifrados. Consulte la [documentacion](https://docs.termix.site/security) para mas informacion.
+**Compartir sesiรณn:**
+Comparte en directo una sesiรณn de terminal, RDP, VNC o Telnet. Manda un enlace al que cualquiera puede entrar sin cuenta, o compรกrtela con un usuario concreto de Termix, en solo lectura o con escritura. Las comparticiones pueden caducar solas o revocarse, y se pueden desactivar globalmente o por host.
-**Grafico de Red:**
-Personalice su Dashboard para visualizar su homelab basado en sus conexiones SSH con soporte de estado.
+**Grabaciรณn y registros de sesiรณn:**
+Graba sesiones de terminal, RDP y VNC y reprodรบcelas despuรฉs. Descarga registros de texto de una sesiรณn y mira el registro de conexiรณn para ver exactamente quรฉ pasรณ durante ella.
-**Herramientas SSH:**
-Cree fragmentos de comandos reutilizables que se ejecutan con un solo clic. Ejecute un comando simultaneamente en multiples terminales abiertos.
+**Conexiones serie:**
+Habla con dispositivos serie como routers, switches y microcontroladores desde el navegador o la aplicaciรณn de escritorio. Ajusta velocidad, bits de datos, bits de parada y paridad. Usa la API Web Serial en los navegadores compatibles, o un backend nativo en la aplicaciรณn de escritorio.
-**Pestanas Persistentes:**
-Las sesiones SSH y pestanas permanecen abiertas entre dispositivos/actualizaciones si esta habilitado en el perfil de usuario.
+**Tailscale:**
+Trae dispositivos de tu tailnet para aรฑadirlos como hosts en un par de clics, y conรฉctate con Tailscale SSH para que las ACL de tu tailnet controlen el acceso sin guardar credenciales. Tambiรฉn funcionan Headscale y los puntos de acceso personalizados.
+
+
+
+
+**Proxmox:**
+Importa hosts directamente desde una instancia de Proxmox y observa las estadรญsticas de nodos e invitados, incluidas CPU, memoria y almacenamiento, en su propia pestaรฑa.
+
+
+
+
+
+
+**Espacios de trabajo y pestaรฑas:**
+Guarda un conjunto de pestaรฑas con su distribuciรณn dividida y reรกbrelo entero con un clic. Termix tambiรฉn recuerda tu รบltima sesiรณn, asรญ que tus pestaรฑas vuelven tras recargar y en otros dispositivos.
+
+
+
+
+**Configuraciรณn guiada:**
+Una configuraciรณn corta te lleva por elegir un preajuste de interfaz, tu tema, las funciones que quieres y tu primer host. El modo sencillo esconde lo que no usas, y puedes repetir la configuraciรณn o cambiar de preajuste cuando quieras.
+
+
+
+
+
+
+**Escritorio independiente y sincronizaciรณn:**
+La aplicaciรณn de escritorio funciona sola, con su backend y su base de datos locales, sin necesidad de servidor. Tambiรฉn puedes conectarla a un servidor Termix para sincronizar en ambos sentidos hosts, credenciales, fragmentos y mรกs, y decidir si las conexiones salen de tu equipo o pasan por el servidor.
+
+
+
+
+**Lรญnea de comandos:**
+Un CLI `termix` para tu shell y tus scripts. Abre terminales, ejecuta un comando en un host o en una flota entera, mueve archivos por SFTP y gestiona hosts, fragmentos y credenciales. Instรกlalo con `npm install -g @termix-cli/cli` o coge un binario independiente. Consulta la [documentaciรณn del CLI](https://docs.termix.site/cli).
+
+
+
+
+
+
+**Seguridad:**
+Las contraseรฑas, las claves y otros secretos se cifran por usuario, y los propios archivos de la base de datos se pueden cifrar en disco. Mira la [documentaciรณn](https://docs.termix.site/security) para saber cรณmo funciona.
**Idiomas:**
-Soporte integrado para aproximadamente 30 idiomas (gestionado por [Crowdin](https://docs.termix.site/translations)).
+Unos 30 idiomas incluidos, gestionados a travรฉs de [Crowdin](https://docs.termix.site/translations).
@@ -196,35 +252,38 @@ Soporte integrado para aproximadamente 30 idiomas (gestionado por [Crowdin](http
-Mas caracteristicas Mรกs caracterรญsticas
Plataforma
-Distribucion
+Distribuciรณn
Web Cualquier navegador moderno (Chrome, Safari, Firefox) ยท Soporte PWA
+Cualquier navegador moderno (Chrome, Safari, Firefox) ยท Compatible con PWA
Windows x64/ia32
@@ -325,10 +410,6 @@ Interesado en un espacio patrocinado de pago para apoyar el desarrollo? Escriba
-
-
-
@@ -340,18 +421,21 @@ Interesado en un espacio patrocinado de pago para apoyar el desarrollo? Escriba
-
+
+
+
@@ -359,7 +443,7 @@ Si necesita ayuda o desea solicitar una funcion para Termix, visite la pagina de
[](https://www.youtube.com/@TermixSSH/videos)
-Ver resรบmenes de actualizaciones en YouTube
+Mira los resรบmenes de las actualizaciones en YouTube
-Algunos videos e imagenes pueden estar desactualizados o no mostrar perfectamente las caracteristicas.
+Algunos vรญdeos e imรกgenes pueden estar desactualizados o no mostrar del todo bien las funciones.
Termix
-Gestion SSH auto-hebergee et acces bureau a distance
+Gestion de serveurs auto-hรฉbergรฉe, du SSH au bureau ร distance jusqu'aux automatisations
English ยท
@@ -37,7 +37,7 @@
-**Acces terminal SSH:**
-Terminal complet avec support d'ecran partage (jusqu'a 4 panneaux) et un systeme d'onglets inspire des navigateurs. Inclut la personnalisation du terminal avec des themes courants, des polices et d'autres composants.
+**Terminal SSH:**
+Un vrai terminal avec des onglets faรงon navigateur et un รฉcran divisรฉ, jusqu'ร 6 panneaux ร la fois. Choisissez votre thรจme, votre police et vos couleurs. Une barre d'outils au-dessus de chaque session affiche le CPU, la mรฉmoire et le disque en direct, avec des raccourcis vers les fichiers, Docker, les tunnels et les mรฉtriques de cet hรดte.
-**Acces Bureau a Distance:**
-Support RDP, VNC et Telnet via navigateur avec personnalisation complete et ecran partage.
+**Bureau ร distance:**
+RDP, VNC et Telnet dans le navigateur, en onglets et en รฉcran divisรฉ comme n'importe quelle autre session. Comprend un explorateur de fichiers pour les lecteurs RDP et l'envoi par glisser-dรฉposer. Sur le bureau Windows, vous pouvez aussi ouvrir un hรดte dans le client RDP natif.
-**Gestion des tunnels SSH:**
-Creez et gerez des tunnels SSH de serveur a serveur avec reconnexion automatique, surveillance de l'etat et transfert local, distant ou SOCKS dynamique. Les parametres de tunnel client-bureau-vers-serveur sont stockes localement par installation bureau ; des instantanes de prereglages C2S optionnels peuvent etre sauvegardes sur le serveur, renommes, charges ou supprimes pour deplacer une configuration de tunnel locale entre clients.
+**Tunnels SSH:**
+Redirection locale, distante et SOCKS dynamique, avec reconnexion automatique et vรฉrification de l'รฉtat. Les tunnels client vers serveur de l'application de bureau restent sur cette machine, et vous pouvez enregistrer des prรฉrรฉglages sur le serveur pour reprendre une configuration sur un autre poste.
-**Gestionnaire de fichiers distant:**
-Gerez les fichiers directement sur les serveurs distants avec support de la visualisation et de l'edition de code, images, audio et video. Televersez, telechargez, renommez, supprimez et deplacez des fichiers de maniere fluide avec support sudo. Inclut la prise en charge du deplacement de fichiers de serveur a serveur.
+**Gestionnaire de fichiers:**
+Parcourez, modifiez, envoyez, tรฉlรฉchargez, renommez, dรฉplacez et supprimez des fichiers en SFTP, avec sudo. Affichez et modifiez du code, des images, de l'audio et de la vidรฉo. Copiez des fichiers directement d'un serveur ร l'autre : le chemin le plus rapide est choisi pour vous et l'intรฉgritรฉ des transferts est vรฉrifiรฉe.
-**Gestion Docker et Podman:**
-Demarrez, arretez, mettez en pause, supprimez des conteneurs. Consultez les statistiques des conteneurs. Controlez les conteneurs via le terminal docker exec. Compatible avec Docker et Podman comme environnement d'execution de conteneurs. Non concu pour remplacer Portainer ou Dockge, mais plutot pour gerer simplement vos conteneurs plutot que de les creer.
+**Docker et Podman:**
+Dรฉmarrez, arrรชtez, mettez en pause et supprimez des conteneurs, suivez leurs statistiques et ouvrez un shell ร l'intรฉrieur. Fonctionne avec Docker comme avec Podman. Le but n'est pas de remplacer Portainer ou Dockge, juste de gรฉrer les conteneurs que vous avez dรฉjร .
-**Gestionnaire d'hotes SSH:**
-Enregistrez, organisez et gerez vos connexions SSH avec des tags et des dossiers (personnalisation des dossiers et prise en charge des dossiers imbriques), et sauvegardez facilement les informations de connexion reutilisables tout en automatisant le deploiement des cles SSH.
+**Gestionnaire d'hรดtes:**
+Rangez vos hรดtes avec des รฉtiquettes et des dossiers imbriquรฉs que vous pouvez nommer et colorer. Rรฉutilisez des identifiants enregistrรฉs sur plusieurs hรดtes, dรฉployez des clรฉs SSH automatiquement, regroupez des hรดtes sous un hรดte parent, modifiez et exportez en lot, et utilisez la connexion rapide pour les connexions ponctuelles que vous ne voulez pas garder.
-**Metriques d'hote:**
-Visualisez l'utilisation du CPU, de la memoire, du disque, le reseau, le temps de fonctionnement, les informations systeme, le pare-feu, le moniteur de ports, le visualiseur de journaux, les utilisateurs/permissions, les certificats et bien plus encore sur la plupart des serveurs Linux. Inclut des graphiques d'historique en serie temporelle et des alertes basees sur des seuils avec support ntfy et webhook.
+**Mรฉtriques des hรดtes:**
+CPU, mรฉmoire, disque, rรฉseau, tempรฉrature, temps de fonctionnement, processus, ports, connexions et informations systรจme sur la plupart des serveurs Linux, avec des graphiques d'historique. Les cartes de gestion vous permettent de gรฉrer les services, les tรขches cron, les paquets, les utilisateurs, les rรจgles de pare-feu, WireGuard, Tailscale, les certificats SSL, les journaux et les vรฉrifications d'รฉtat sans quitter Termix.
-**Authentification des utilisateurs:**
-Gestion securisee des utilisateurs avec controles administrateur (peut modifier les informations des autres utilisateurs) et support OIDC/LDAP/SSO (avec controle d'acces), 2FA (TOTP), et support des passkeys (WebAuthn). Visualisez les sessions utilisateur actives sur toutes les plateformes et revoquez les permissions. Liez vos comptes OIDC/locaux ensemble. Consultez le journal d'audit des actions de tous les utilisateurs.
+**Automatisations:**
+Choisissez un dรฉclencheur, puis dites ce qui doit se passer. Les dรฉclencheurs peuvent รชtre une mรฉtrique qui dรฉpasse un seuil, un hรดte qui tombe ou revient, une vรฉrification d'รฉtat qui change, un horaire, un รฉvรฉnement de conteneur ou un webhook entrant. Les รฉtapes peuvent lancer des commandes et des extraits, piloter des conteneurs et des tunnels, rรฉveiller un hรดte, appeler une URL, attendre, se diviser selon une condition, lancer une autre automatisation et vous prรฉvenir via ntfy, Discord ou un webhook. Les essais ร blanc vous permettent de tester sans risque.
-**Integration Tailscale:**
-Listez les appareils de votre reseau Tailscale pour les ajouter rapidement comme hotes, et connectez-vous en utilisant Tailscale SSH comme methode d'authentification, laissant les ACL de votre reseau gerer l'autorisation sans stocker de credentials.
+**Flottes:**
+Regroupez des hรดtes dans une flotte en les choisissant ou avec des rรจgles d'รฉtiquettes, pour que les nouveaux hรดtes s'ajoutent tout seuls. Lancez une commande sur tous les hรดtes d'un coup, envoyez et rรฉcupรฉrez des fichiers sur l'ensemble, installez des paquets et collectez un inventaire de l'OS, du noyau, de l'architecture et du temps de fonctionnement.
-**RBAC/Partage:**
-Creez des roles et partagez des hotes entre utilisateurs/roles. Prend en charge tous les types d'authentification et tous les protocoles d'hote.
+**Assistant IA:**
+Optionnel, et dรฉsactivรฉ tant que vous ne l'activez pas. Connectez OpenAI, Anthropic, Gemini, Ollama ou n'importe quel point d'accรจs compatible OpenAI et posez des questions sur votre installation. Il lit les hรดtes, les flottes, les extraits et les alertes, et propose des changements que vous validez au lieu de les appliquer lui-mรชme. Il ne peut jamais toucher aux identifiants, aux utilisateurs ni aux rรฉglages. Les administrateurs peuvent le laisser dรฉsactivรฉ pour toute l'instance, et vous pouvez le masquer pendant la configuration.
-**Connexions Serie:**
-Connectez-vous a des appareils serie (routeurs, commutateurs, microcontroleurs, etc.) directement depuis le navigateur ou l'application bureau. Configurez le debit en bauds, les bits de donnees, les bits d'arret et la parite. Utilise l'API Web Serial dans les navigateurs compatibles ou un backend natif dans l'application Electron.
+**Connexion et utilisateurs:**
+Comptes locaux ainsi que connexion OIDC, LDAP, GitHub et Google, avec double authentification (TOTP), clรฉs d'accรจs (WebAuthn) et appareils de confiance. Les administrateurs peuvent gรฉrer les utilisateurs, associer les groupes OIDC aux rรดles, voir toutes les sessions actives sur toutes les plateformes et les rรฉvoquer. Reliez vos comptes local et OIDC, et consultez le journal d'audit de ce que chacun a fait.
+**Rรดles et partage:**
+Crรฉez des rรดles et partagez des hรดtes avec des utilisateurs ou des rรดles selon quatre niveaux : connexion, lecture, modification et gestion. Cela fonctionne avec tous les types d'authentification et tous les protocoles, et vous pouvez remplacer les identifiants utilisรฉs pour un hรดte partagรฉ.
+
+
+
+
+
+
**Alertes:**
-Definissez des regles d'alerte basees sur des seuils pour les metriques d'hote (CPU, memoire, disque, etc.) et recevez des notifications via ntfy ou webhooks lorsqu'elles se declenchent. Consultez les alertes actives et resolues dans un journal d'historique.
+Dรฉfinissez des rรจgles sur les mรฉtriques des hรดtes comme le CPU, la mรฉmoire et le disque, et recevez une notification via ntfy, Discord ou un webhook quand elles se dรฉclenchent. Consultez les alertes en cours et rรฉsolues dans un historique, et รฉcartez celles qui ne vous intรฉressent pas.
-
-
**Page d'accueil:**
-Une page d'accueil entierement personnalisable avec une grille de widgets glisser-deposer. Ajoutez des widgets pour l'etat des hotes, les liens de services, les horloges, les notes, les flux RSS, la meteo, les conteneurs Docker, les graphiques de metriques d'hote, les terminaux integres, les iframes et plus encore.
-
-
-
-
-**Chiffrement de la base de donnees:**
-Le backend est stocke sous forme de fichiers de base de donnees SQLite chiffres. Consultez la [documentation](https://docs.termix.site/security) pour plus de details.
+Une grille de widgets en glisser-dรฉposer que vous construisez vous-mรชme. Des widgets pour l'รฉtat des hรดtes, les pings, les liens de services, les favoris, la recherche, les horloges, les calendriers, les comptes ร rebours, les notes, les flux RSS, la mรฉtรฉo, les images, les iframes, Docker, les tunnels, les graphiques de mรฉtriques, les API personnalisรฉes et mรชme un terminal en direct.
-**Graphe reseau:**
-Personnalisez votre tableau de bord pour visualiser votre homelab base sur vos connexions SSH avec support des statuts.
+**Extraits et outils:**
+Enregistrez les commandes que vous lancez souvent et exรฉcutez-les en un clic, avec des variables pour l'hรดte et vos propres saisies. Lancez une mรชme commande dans tous les terminaux ouverts, et cherchez dans votre historique avec la complรฉtion automatique.
-**Outils SSH:**
-Creez des extraits de commandes reutilisables executables en un seul clic. Executez une commande simultanement sur plusieurs terminaux ouverts.
+**Partage de session:**
+Partagez en direct une session terminal, RDP, VNC ou Telnet. Envoyez un lien que n'importe qui peut rejoindre sans compte, ou partagez avec un utilisateur Termix prรฉcis, en lecture seule ou en lecture-รฉcriture. Les partages peuvent expirer d'eux-mรชmes ou รชtre rรฉvoquรฉs, et se dรฉsactivent globalement ou hรดte par hรดte.
-**Onglets Persistants:**
-Les sessions SSH et les onglets restent ouverts sur tous les appareils/actualisations si active dans le profil utilisateur.
+**Enregistrement et journaux de session:**
+Enregistrez les sessions terminal, RDP et VNC pour les revoir plus tard. Tรฉlรฉchargez les journaux d'une session en texte simple, et consultez le journal de connexion pour voir exactement ce qui s'est passรฉ pendant une connexion.
+
+
+
+
+**Connexions sรฉrie:**
+Dialoguez avec des appareils sรฉrie comme des routeurs, des commutateurs et des microcontrรดleurs depuis le navigateur ou l'application de bureau. Rรฉglez la vitesse, les bits de donnรฉes, les bits d'arrรชt et la paritรฉ. Utilise l'API Web Serial dans les navigateurs compatibles, ou un backend natif dans l'application de bureau.
+
+
+
+
+
+
+**Tailscale:**
+Rรฉcupรฉrez les appareils de votre tailnet pour les ajouter comme hรดtes en quelques clics, et connectez-vous avec Tailscale SSH pour que les ACL de votre tailnet gรจrent les accรจs, sans stocker d'identifiants. Headscale et les points d'accรจs personnalisรฉs fonctionnent aussi.
+
+
+
+
+**Proxmox:**
+Importez des hรดtes directement depuis une instance Proxmox, et suivez les statistiques des nลuds et des invitรฉs, dont le CPU, la mรฉmoire et le stockage, dans un onglet dรฉdiรฉ.
+
+
+
+
+
+
+**Espaces de travail et onglets:**
+Enregistrez un ensemble d'onglets avec leur disposition en รฉcran divisรฉ et rouvrez le tout en un clic. Termix retient aussi votre derniรจre session, donc vos onglets reviennent aprรจs un rafraรฎchissement ou sur un autre appareil.
+
+
+
+
+**Configuration guidรฉe:**
+Une courte configuration vous aide ร choisir un prรฉrรฉglage d'interface, votre thรจme, les fonctionnalitรฉs que vous voulez et votre premier hรดte. Le mode simple masque ce que vous n'utilisez pas, et vous pouvez relancer la configuration ou changer de prรฉrรฉglage quand vous voulez.
+
+
+
+
+
+
+**Application de bureau autonome et synchronisation:**
+L'application de bureau fonctionne toute seule, avec son propre backend et sa base de donnรฉes, sans serveur. Vous pouvez aussi la relier ร un serveur Termix pour synchroniser dans les deux sens les hรดtes, les identifiants, les extraits et le reste, et choisir si les connexions partent de votre machine ou passent par le serveur.
+
+
+
+
+**Ligne de commande:**
+Un CLI `termix` pour votre shell et vos scripts. Ouvrez des terminaux, lancez une commande sur un hรดte ou une flotte entiรจre, dรฉplacez des fichiers en SFTP et gรฉrez hรดtes, extraits et identifiants. Installez-le avec `npm install -g @termix-cli/cli` ou rรฉcupรฉrez un binaire autonome. Voir la [documentation du CLI](https://docs.termix.site/cli).
+
+
+
+
+
+
+**Sรฉcuritรฉ:**
+Les mots de passe, les clรฉs et les autres secrets sont chiffrรฉs par utilisateur, et les fichiers de base de donnรฉes eux-mรชmes peuvent รชtre chiffrรฉs sur le disque. Voir la [documentation](https://docs.termix.site/security) pour le dรฉtail.
**Langues:**
-Support integre d'environ 30 langues (gere par [Crowdin](https://docs.termix.site/translations)).
+Une trentaine de langues intรฉgrรฉes, gรฉrรฉes via [Crowdin](https://docs.termix.site/translations).
@@ -196,26 +252,29 @@ Support integre d'environ 30 langues (gere par [Crowdin](https://docs.termix.sit
-Plus de fonctionnalites Plus de fonctionnalitรฉs
@@ -224,11 +283,11 @@ Support integre d'environ 30 langues (gere par [Crowdin](https://docs.termix.sit
Web Tout navigateur moderne (Chrome, Safari, Firefox) ยท Support PWA
+Tout navigateur rรฉcent (Chrome, Safari, Firefox) ยท Compatible PWA
Windows x64/ia32 Portable ยท MSI Installateur ยท Chocolatey
+Portable ยท Installeur MSI ยท Chocolatey
Linux x64/ia32
@@ -325,10 +410,6 @@ Interesse par un placement payant pour soutenir le developpement ? Envoyez un em
-
-
-
@@ -340,18 +421,21 @@ Interesse par un placement payant pour soutenir le developpement ? Envoyez un em
-
+
+
+
@@ -359,7 +443,7 @@ Si vous avez besoin d'aide ou souhaitez demander une fonctionnalite pour Termix,
[](https://www.youtube.com/@TermixSSH/videos)
-Regarder les aperรงus des mises a jour sur YouTube
+Regarder les prรฉsentations des mises ร jour sur YouTube
-Certaines videos et images peuvent etre obsoletes ou ne pas presenter parfaitement les fonctionnalites.
+Certaines vidรฉos et images peuvent รชtre dรฉpassรฉes ou ne pas montrer parfaitement les fonctionnalitรฉs.
Termix
-เคธเฅเคต-เคนเฅเคธเฅเคเฅเคก SSH เคชเฅเคฐเคฌเคเคงเคจ เคเคฐ เคฐเคฟเคฎเฅเค เคกเฅเคธเฅเคเคเฅเคช เคเคเฅเคธเฅเคธ
+เคธเฅเคฒเฅเคซ-เคนเฅเคธเฅเคเฅเคก เคธเคฐเฅเคตเคฐ เคชเฅเคฐเคฌเคเคงเคจ, SSH เคเคฐ เคฐเคฟเคฎเฅเค เคกเฅเคธเฅเคเคเฅเคช เคธเฅ เคฒเฅเคเคฐ เคเคเฅเคฎเฅเคถเคจ เคคเค
English ยท
@@ -37,7 +37,7 @@
1 เคธเคฟเคคเคเคฌเคฐ, 2025 เคเฅ เคชเฅเคฐเคพเคชเฅเคค
+ 1 เคธเคฟเคคเคเคฌเคฐ 2025 เคเฅ เคนเคพเคธเคฟเคฒ เคเคฟเคฏเคพ เคเคฏเคพ
@@ -58,7 +58,7 @@ Termix เคฎเฅเคซเคผเฅเคค เคเคฐ เคเคชเคจ เคธเฅเคฐเฅเคธ เคนเฅเฅค เคฏเคฆเคฟ
## เค
เคตเคฒเฅเคเคจ
-Termix เคเค เคเคชเคจ-เคธเฅเคฐเฅเคธ, เคนเคฎเฅเคถเคพ เคเฅ เคฒเคฟเค เคฎเฅเคซเคผเฅเคค, เคธเฅเคฒเฅเคซ-เคนเฅเคธเฅเคเฅเคก เคเคฒ-เคเคจ-เคตเคจ เคธเคฐเฅเคตเคฐ เคชเฅเคฐเคฌเคเคงเคจ เคชเฅเคฒเฅเคเคซเคผเฅเคฐเฅเคฎ เคนเฅเฅค เคฏเคน เคเค เคเคเคฒ, เคธเคนเค เคเคเคเคฐเคซเคผเฅเคธ เคเฅ เคฎเคพเคงเฅเคฏเคฎ เคธเฅ เคเคชเคเฅ เคธเคฐเฅเคตเคฐ เคเคฐ เคฌเฅเคจเคฟเคฏเคพเคฆเฅ เคขเคพเคเคเฅ เคเฅ เคชเฅเคฐเคฌเคเคงเคจ เคเฅ เคฒเคฟเค เคเค เคฎเคฒเฅเคเฅ-เคชเฅเคฒเฅเคเคซเคผเฅเคฐเฅเคฎ เคธเคฎเคพเคงเคพเคจ เคชเฅเคฐเคฆเคพเคจ เคเคฐเคคเคพ เคนเฅเฅค Termix SSH เคเคฐเฅเคฎเคฟเคจเคฒ เคเคเฅเคธเฅเคธ, เคฐเคฟเคฎเฅเค เคกเฅเคธเฅเคเคเฅเคช เคเคเคเฅเคฐเฅเคฒ (RDP, VNC, Telnet), SSH เคเคจเคฒเคฟเคเค เคเฅเคทเคฎเคคเคพเคเค, เคฐเคฟเคฎเฅเค เคซเคผเคพเคเคฒ เคชเฅเคฐเคฌเคเคงเคจ, เคเคฐ เคเค เค
เคจเฅเคฏ เคเคชเคเคฐเคฃ เคชเฅเคฐเคฆเคพเคจ เคเคฐเคคเคพ เคนเฅเฅค Termix เคธเคญเฅ เคชเฅเคฒเฅเคเคซเคผเฅเคฐเฅเคฎ เคชเคฐ เคเคชเคฒเคฌเฅเคง Termius เคเคพ เคธเคนเฅ เคฎเฅเคซเคผเฅเคค เคเคฐ เคธเฅเคฒเฅเคซ-เคนเฅเคธเฅเคเฅเคก เคตเคฟเคเคฒเฅเคช เคนเฅเฅค
+Termix เคเคชเคเฅ เคธเคฐเฅเคตเคฐ เคธเคเคญเคพเคฒเคจเฅ เคเฅ เคฒเคฟเค เคเค เคฎเฅเคซเคผเฅเคค, เคเคชเคจ เคธเฅเคฐเฅเคธ, เคธเฅเคฒเฅเคซ-เคนเฅเคธเฅเคเฅเคก เคชเฅเคฒเฅเคเคซเคผเฅเคฐเฅเคฎ เคนเฅเฅค เคฏเคน SSH เคเคฐเฅเคฎเคฟเคจเคฒ, เคฐเคฟเคฎเฅเค เคกเฅเคธเฅเคเคเฅเคช (RDP, VNC, Telnet), เคซเคผเคพเคเคฒ เคเฅเคฐเคพเคเคธเคซเคผเคฐ, เคเคจเคฒ, Docker, เคฎเฅเคเฅเคฐเคฟเคเฅเคธ เคเคฐ เคเคเฅเคฎเฅเคถเคจ เคเฅ เคเค เคนเฅ เคเคเคน เคฒเคพเคคเคพ เคนเฅ, เคตเฅเคฌ, เคกเฅเคธเฅเคเคเฅเคช เคเคฐ เคฎเฅเคฌเคพเคเคฒ เคชเคฐเฅค เคฏเคน Termius เคเคพ เคธเฅเคฒเฅเคซ-เคนเฅเคธเฅเคเฅเคก เคตเคฟเคเคฒเฅเคช เคนเฅ เคเฅ เคนเคฎเฅเคถเคพ เคฎเฅเคซเคผเฅเคค เคฐเคนเฅเคเคพเฅค
-**SSH เคเคฐเฅเคฎเคฟเคจเคฒ เคเคเฅเคธเฅเคธ:**
-เคฌเฅเคฐเคพเคเคเคผเคฐ เคเฅเคธเฅ เคเฅเคฌ เคชเฅเคฐเคฃเคพเคฒเฅ เคเฅ เคธเคพเคฅ เคธเฅเคชเฅเคฒเคฟเค-เคธเฅเคเฅเคฐเฅเคจ เคธเคชเฅเคฐเฅเค (4 เคชเฅเคจเคฒ เคคเค) เคตเคพเคฒเคพ เคชเฅเคฐเฅเคฃ-เคตเคฟเคถเฅเคทเคคเคพ เคตเคพเคฒเคพ เคเคฐเฅเคฎเคฟเคจเคฒเฅค เคเคธเคฎเฅเค เคฒเฅเคเคชเฅเคฐเคฟเคฏ เคเคฐเฅเคฎเคฟเคจเคฒ เคฅเฅเคฎ, เคซเคผเฅเคจเฅเค เคเคฐ เค
เคจเฅเคฏ เคเคเคชเฅเคจเฅเคเค เคธเคนเคฟเคค เคเคฐเฅเคฎเคฟเคจเคฒ เคเฅ เคเคธเฅเคเคฎเคพเคเคเคผ เคเคฐเคจเฅ เคเคพ เคธเคชเฅเคฐเฅเค เคถเคพเคฎเคฟเคฒ เคนเฅเฅค
+**SSH เคเคฐเฅเคฎเคฟเคจเคฒ:**
+เคฌเฅเคฐเคพเคเคเคผเคฐ เคเฅเคธเฅ เคเฅเคฌ เคเคฐ เคธเฅเคชเฅเคฒเคฟเค เคธเฅเคเฅเคฐเฅเคจ เคตเคพเคฒเคพ เคชเฅเคฐเคพ เคเคฐเฅเคฎเคฟเคจเคฒ, เคเค เคธเคพเคฅ 6 เคชเฅเคจเคฒ เคคเคเฅค เคฅเฅเคฎ, เคซเคผเฅเคจเฅเค เคเคฐ เคฐเคเค เคเคช เคเฅเคฆ เคเฅเคจเฅเคเฅค เคนเคฐ เคธเคคเฅเคฐ เคเฅ เคเคชเคฐ เคเค เคเฅเคฒเคฌเคพเคฐ เคฐเคนเคคเคพ เคนเฅ เคเคฟเคธเคฎเฅเค CPU, เคฎเฅเคฎเฅเคฐเฅ เคเคฐ เคกเคฟเคธเฅเค เคฒเคพเคเคต เคฆเคฟเคเคคเฅ เคนเฅเค, เคธเคพเคฅ เคนเฅ เคเคธ เคนเฅเคธเฅเค เคเฅ เคซเคผเคพเคเคฒเฅเค, Docker, เคเคจเคฒ เคเคฐ เคฎเฅเคเฅเคฐเคฟเคเฅเคธ เคคเค เคเคพเคจเฅ เคเฅ เคถเฅเคฐเฅเคเคเค เคญเฅเฅค
-**เคฐเคฟเคฎเฅเค เคกเฅเคธเฅเคเคเฅเคช เคเคเฅเคธเฅเคธ:**
-เคฌเฅเคฐเคพเคเคเคผเคฐ เคชเคฐ RDP, VNC เคเคฐ Telnet เคธเคชเฅเคฐเฅเค, เคชเฅเคฐเฅเคฃ เคเคธเฅเคเคฎเคพเคเคเคผเฅเคถเคจ เคเคฐ เคธเฅเคชเฅเคฒเคฟเค เคธเฅเคเฅเคฐเฅเคจ เคเฅ เคธเคพเคฅเฅค
+**เคฐเคฟเคฎเฅเค เคกเฅเคธเฅเคเคเฅเคช:**
+เคฌเฅเคฐเคพเคเคเคผเคฐ เคฎเฅเค RDP, VNC เคเคฐ Telnet, เคฌเคพเคเฅ เคธเคคเฅเคฐเฅเค เคเฅ เคคเคฐเคน เคเฅเคฌ เคเคฐ เคธเฅเคชเฅเคฒเคฟเค เคธเฅเคเฅเคฐเฅเคจ เคฎเฅเคเฅค เคเคธเคฎเฅเค RDP เคกเฅเคฐเคพเคเคต เคเฅ เคฒเคฟเค เคซเคผเคพเคเคฒ เคฌเฅเคฐเคพเคเคเคผเคฐ เคเคฐ เคเฅเคเคเคเคฐ เคเฅเคกเคผเคจเฅ เคตเคพเคฒเคพ เค
เคชเคฒเฅเคก เคญเฅ เคนเฅเฅค Windows เคกเฅเคธเฅเคเคเฅเคช เคชเคฐ เคเคช เคนเฅเคธเฅเค เคเฅ เคธเคฟเคธเฅเคเคฎ เคเฅ เค
เคชเคจเฅ RDP เคเฅเคฒเคพเคเคเค เคฎเฅเค เคญเฅ เคเฅเคฒ เคธเคเคคเฅ เคนเฅเคเฅค
-**SSH เคเคจเคฒ เคชเฅเคฐเคฌเคเคงเคจ:**
-เคเคเฅเคฎเฅเคเคฟเค เคฐเฅเคเคจเฅเคเฅเคถเคจ, เคนเฅเคฒเฅเคฅ เคฎเฅเคจเคฟเคเคฐเคฟเคเค เคเคฐ เคฒเฅเคเคฒ, เคฐเคฟเคฎเฅเค เคฏเคพ เคกเคพเคฏเคจเฅเคฎเคฟเค SOCKS เคซเฅเคฐเคตเคฐเฅเคกเคฟเคเค เคเฅ เคธเคพเคฅ เคธเคฐเฅเคตเคฐ-เคเฅ-เคธเคฐเฅเคตเคฐ SSH เคเคจเคฒ เคฌเคจเคพเคเค เคเคฐ เคชเฅเคฐเคฌเคเคงเคฟเคค เคเคฐเฅเคเฅค เคกเฅเคธเฅเคเคเฅเคช เคเฅเคฒเคพเคเคเค-เคเฅ-เคธเคฐเฅเคตเคฐ เคเคจเคฒ เคธเฅเคเคฟเคเคเฅเคธ เคชเฅเคฐเคคเฅเคฏเฅเค เคกเฅเคธเฅเคเคเฅเคช เคเคเคธเฅเคเฅเคฒ เคฎเฅเค เคธเฅเคฅเคพเคจเฅเคฏ เคฐเฅเคช เคธเฅ เคธเคเคเฅเคฐเคนเฅเคค เคนเฅเคคเฅ เคนเฅเค; เคตเฅเคเคฒเฅเคชเคฟเค C2S เคชเฅเคฐเฅเคธเฅเค เคธเฅเคจเฅเคชเคถเฅเค เคธเคฐเฅเคตเคฐ เคชเคฐ เคธเฅเคต เคเคฟเค เคเคพ เคธเคเคคเฅ เคนเฅเค, เคคเคฅเคพ เคเคฌ เคเคช เคเคฟเคธเฅ เคฒเฅเคเคฒ เคเคจเคฒ เคเฅเคจเฅเคซเคผเคฟเคเคฐเฅเคถเคจ เคเฅ เคเฅเคฒเคพเคเคเค เคเฅ เคฌเฅเค เคธเฅเคฅเคพเคจเคพเคเคคเคฐเคฟเคค เคเคฐเคจเคพ เคเคพเคนเฅเค เคคเฅ เคเคจเฅเคนเฅเค เคฐเฅเคจเฅเคฎ, เคฒเฅเคก เคฏเคพ เคกเคฟเคฒเฅเค เคเคฟเคฏเคพ เคเคพ เคธเคเคคเคพ เคนเฅเฅค
+**SSH เคเคจเคฒ:**
+เคฒเฅเคเคฒ, เคฐเคฟเคฎเฅเค เคเคฐ เคกเคพเคฏเคจเคพเคฎเคฟเค SOCKS เคซเคผเฅเคฐเคตเคฐเฅเคกเคฟเคเค, เค
เคชเคจเฅ เคเคช เคฆเฅเคฌเคพเคฐเคพ เคเฅเคกเคผเคจเฅ เคเคฐ เคธเฅเคฅเคฟเคคเคฟ เคเคพเคเค เคเฅ เคธเคพเคฅเฅค เคกเฅเคธเฅเคเคเฅเคช เคเคช เคเฅ เคเฅเคฒเคพเคเคเค เคธเฅ เคธเคฐเฅเคตเคฐ เคตเคพเคฒเฅ เคเคจเคฒ เคเคธเฅ เคฎเคถเฅเคจ เคชเคฐ เคฐเคนเคคเฅ เคนเฅเค, เคเคฐ เคเคช เคธเฅเคเคฟเคเค เคธเคฐเฅเคตเคฐ เคชเคฐ เคธเคนเฅเคเคเคฐ เคเคธเฅ เคฆเฅเคธเคฐเฅ เคฎเคถเฅเคจ เคชเคฐ เคฒเฅ เคเคพ เคธเคเคคเฅ เคนเฅเคเฅค
-**เคฐเคฟเคฎเฅเค เคซเคผเคพเคเคฒ เคฎเฅเคจเฅเคเคฐ:**
-เคเฅเคก, เคเคฎเฅเค, เคเคกเคฟเคฏเฅ เคเคฐ เคตเฅเคกเคฟเคฏเฅ เคฆเฅเคเคจเฅ เคเคฐ เคธเคเคชเคพเคฆเคฟเคค เคเคฐเคจเฅ เคเฅ เคธเคชเฅเคฐเฅเค เคเฅ เคธเคพเคฅ เคฐเคฟเคฎเฅเค เคธเคฐเฅเคตเคฐ เคชเคฐ เคธเฅเคงเฅ เคซเคผเคพเคเคฒเฅเค เคชเฅเคฐเคฌเคเคงเคฟเคค เคเคฐเฅเคเฅค sudo เคธเคชเฅเคฐเฅเค เคเฅ เคธเคพเคฅ เคซเคผเคพเคเคฒเฅเค เค
เคชเคฒเฅเคก, เคกเคพเคเคจเคฒเฅเคก, เคฐเฅเคจเฅเคฎ, เคกเคฟเคฒเฅเค เคเคฐ เคฎเฅเคต เคเคฐเฅเคเฅค เคเคธเคฎเฅเค เคซเคผเคพเคเคฒเฅเค เคเฅ เคเค เคธเคฐเฅเคตเคฐ เคธเฅ เคฆเฅเคธเคฐเฅ เคธเคฐเฅเคตเคฐ เคฎเฅเค เคธเฅเคฅเคพเคจเคพเคเคคเคฐเคฟเคค เคเคฐเคจเฅ เคเคพ เคธเคชเฅเคฐเฅเค เคญเฅ เคถเคพเคฎเคฟเคฒ เคนเฅเฅค
+**เคซเคผเคพเคเคฒ เคฎเฅเคจเฅเคเคฐ:**
+SFTP เคธเฅ เคซเคผเคพเคเคฒเฅเค เคฆเฅเคเฅเค, เคธเคเคชเคพเคฆเคฟเคค เคเคฐเฅเค, เค
เคชเคฒเฅเคก เคเคฐ เคกเคพเคเคจเคฒเฅเคก เคเคฐเฅเค, เคจเคพเคฎ เคฌเคฆเคฒเฅเค, เคนเคเคพเคเค เคเคฐ เคเคฟเคธเคเคพเคเค, sudo เคเฅ เคธเคพเคฅ เคญเฅเฅค เคเฅเคก, เคคเคธเฅเคตเฅเคฐเฅเค, เคเคกเคฟเคฏเฅ เคเคฐ เคตเฅเคกเคฟเคฏเฅ เคฆเฅเคเฅเค เคเคฐ เคฌเคฆเคฒเฅเคเฅค เคซเคผเคพเคเคฒเฅเค เคธเฅเคงเฅ เคเค เคธเคฐเฅเคตเคฐ เคธเฅ เคฆเฅเคธเคฐเฅ เคชเคฐ เคเฅเคชเฅ เคเคฐเฅเค, เคธเคฌเคธเฅ เคคเฅเคเคผ เคฐเคพเคธเฅเคคเคพ เค
เคชเคจเฅ เคเคช เคเฅเคจเคพ เคเคพเคคเคพ เคนเฅ เคเคฐ เคเฅเคฐเคพเคเคธเคซเคผเคฐ เคเฅ เคเคพเคเค เคญเฅ เคนเฅเคคเฅ เคนเฅเฅค
-**Docker เคเคฐ Podman เคชเฅเคฐเคฌเคเคงเคจ:**
-เคเคเคเฅเคจเคฐ เคถเฅเคฐเฅ, เคฌเคเคฆ, เคชเฅเคเคผ, เคนเคเคพเคเคเฅค เคเคเคเฅเคจเคฐ เคธเฅเคเฅเคเฅเคธ เคฆเฅเคเฅเคเฅค docker exec เคเคฐเฅเคฎเคฟเคจเคฒ เคเคพ เคเคชเคฏเฅเค เคเคฐเคเฅ เคเคเคเฅเคจเคฐ เคเฅ เคจเคฟเคฏเคเคคเฅเคฐเคฟเคค เคเคฐเฅเคเฅค Docker เคเคฐ Podman เคฆเฅเคจเฅเค เคเฅ เคเคเคเฅเคจเคฐ เคฐเคจเคเคพเคเคฎ เคเฅ เคฐเฅเคช เคฎเฅเค เคธเคชเฅเคฐเฅเค เคเคฐเคคเคพ เคนเฅเฅค เคเคธเฅ Portainer เคฏเคพ Dockge เคเฅ เคเคเคน เคฒเฅเคจเฅ เคเฅ เคฒเคฟเค เคจเคนเฅเค เคฌเคจเคพเคฏเคพ เคเคฏเคพ เคฌเคฒเฅเคเคฟ เคเคเคเฅเคจเคฐ เคฌเคจเคพเคจเฅ เคเฅ เคคเฅเคฒเคจเคพ เคฎเฅเค เคเคจเฅเคนเฅเค เคธเคฐเคฒเคคเคพ เคธเฅ เคชเฅเคฐเคฌเคเคงเคฟเคค เคเคฐเคจเฅ เคเฅ เคฒเคฟเค เคฌเคจเคพเคฏเคพ เคเคฏเคพ เคนเฅเฅค
+**Docker เคเคฐ Podman:**
+เคเคเคเฅเคจเคฐ เคเคพเคฒเฅ เคเคฐเฅเค, เคฐเฅเคเฅเค, เคฅเคพเคฎเฅเค เคเคฐ เคนเคเคพเคเค, เคเคจเคเฅ เคเคเคเคกเคผเฅ เคฆเฅเคเฅเค, เคเคฐ เคเคฟเคธเฅ เคเค เคเฅ เค
เคเคฆเคฐ เคถเฅเคฒ เคเฅเคฒเฅเคเฅค Docker เคเคฐ Podman เคฆเฅเคจเฅเค เคเฅ เคธเคพเคฅ เคเคฒเคคเคพ เคนเฅเฅค เคฏเคน Portainer เคฏเคพ Dockge เคเฅ เคเคเคน เคฒเฅเคจเฅ เคเฅ เคฒเคฟเค เคจเคนเฅเค เคนเฅ, เคธเคฟเคฐเฅเคซเคผ เคเคชเคเฅ เคชเคนเคฒเฅ เคธเฅ เคฎเฅเคเฅเคฆ เคเคเคเฅเคจเคฐ เคธเคเคญเคพเคฒเคจเฅ เคเฅ เคฒเคฟเค เคนเฅเฅค
-**SSH เคนเฅเคธเฅเค เคฎเฅเคจเฅเคเคฐ:**
-เคเฅเค เคเคฐ เคซเคผเฅเคฒเฅเคกเคฐ (เคซเคผเฅเคฒเฅเคกเคฐ เคเคธเฅเคเคฎเคพเคเคเคผเฅเคถเคจ เคเคฐ เคจเฅเคธเฅเคเฅเคก เคซเคผเฅเคฒเฅเคกเคฐ เคธเคชเฅเคฐเฅเค เคเฅ เคธเคพเคฅ) เคเฅ เคธเคพเคฅ เค
เคชเคจเฅ SSH เคเคจเฅเคเฅเคถเคจ เคธเคนเฅเคเฅเค, เคตเฅเคฏเคตเคธเฅเคฅเคฟเคค เคเคฐเฅเค เคเคฐ เคชเฅเคฐเคฌเคเคงเคฟเคค เคเคฐเฅเค, เคเคฐ SSH เคเฅเคเคเคฟเคฏเฅเค เคเฅ เคคเฅเคจเคพเคคเฅ เคเฅ เคธเฅเคตเคเคพเคฒเคฟเคค เคเคฐเคจเฅ เคเฅ เคเฅเคทเคฎเคคเคพ เคเฅ เคธเคพเคฅ เคชเฅเคจ: เคเคชเคฏเฅเค เคฏเฅเคเฅเคฏ เคฒเฅเคเคฟเคจ เคเคพเคจเคเคพเคฐเฅ เคเคธเคพเคจเฅ เคธเฅ เคธเคนเฅเคเฅเคเฅค
+**เคนเฅเคธเฅเค เคฎเฅเคจเฅเคเคฐ:**
+เคเฅเค เคเคฐ เคจเคพเคฎ เคต เคฐเคเค เคตเคพเคฒเฅ เคจเฅเคธเฅเคเฅเคก เคซเคผเฅเคฒเฅเคกเคฐ เคธเฅ เคนเฅเคธเฅเค เคธเคนเฅเคเฅเค เคเคฐ เคตเฅเคฏเคตเคธเฅเคฅเคฟเคค เคเคฐเฅเคเฅค เคธเคนเฅเคเฅ เคเค เคเฅเคฐเฅเคกเฅเคเคถเคฟเคฏเคฒ เคเค เคนเฅเคธเฅเค เคชเคฐ เคฆเฅเคฌเคพเคฐเคพ เคเคธเฅเคคเฅเคฎเคพเคฒ เคเคฐเฅเค, SSH เคเฅเคเคเคฟเคฏเคพเค เค
เคชเคจเฅ เคเคช เคญเฅเคเฅเค, เคนเฅเคธเฅเค เคเฅ เคเคฟเคธเฅ เคฎเฅเคเฅเคฏ เคนเฅเคธเฅเค เคเฅ เคจเฅเคเฅ เคฐเคเฅเค, เคเค เคธเคพเคฅ เคเค เคฎเฅเค เคฌเคฆเคฒเคพเคต เคเคฐเฅเค เคเคฐ เคจเคฟเคฐเฅเคฏเคพเคค เคเคฐเฅเค, เคเคฐ เคเคฟเคจ เคเคจเฅเคเฅเคถเคจเฅเค เคเฅ เคธเคนเฅเคเคจเคพ เคจเคนเฅเค เคเคพเคนเคคเฅ เคเคจเคเฅ เคฒเคฟเค เคเฅเคตเคฟเค เคเคจเฅเคเฅเค เคเคธเฅเคคเฅเคฎเคพเคฒ เคเคฐเฅเคเฅค
@@ -111,83 +111,139 @@ Termix เคเค เคเคชเคจ-เคธเฅเคฐเฅเคธ, เคนเคฎเฅเคถเคพ เคเฅ เคฒเคฟเค เคฎเฅ
**เคนเฅเคธเฅเค เคฎเฅเคเฅเคฐเคฟเคเฅเคธ:**
-เค
เคงเคฟเคเคพเคเคถ Linux เคเคงเคพเคฐเคฟเคค เคธเคฐเฅเคตเคฐ เคชเคฐ CPU, เคฎเฅเคฎเฅเคฐเฅ, เคกเคฟเคธเฅเค เคเคชเคฏเฅเค, เคจเฅเคเคตเคฐเฅเค, เค
เคชเคเคพเคเคฎ, เคธเคฟเคธเฅเคเคฎ เคเคพเคจเคเคพเคฐเฅ, เคซเคผเคพเคฏเคฐเคตเฅเคฒ, เคชเฅเคฐเฅเค เคฎเฅเคจเคฟเคเคฐ, เคฒเฅเค เคตเฅเคฏเฅเค
เคฐ, เคเคชเคฏเฅเคเคเคฐเฅเคคเคพ/เค
เคจเฅเคฎเคคเคฟเคฏเคพเค, เคธเคฐเฅเคเคฟเคซเคผเคฟเคเฅเค เคเคฐ เคญเฅ เคฌเคนเฅเคค เคเฅเค เคฆเฅเคเฅเคเฅค เคเคธเคฎเฅเค เคเคพเคเคฎ-เคธเฅเคฐเฅเคเคผ เคนเคฟเคธเฅเคเฅเคฐเฅ เคเฅเคฐเคพเคซเคผ เคเคฐ ntfy เคต webhook เคธเคชเฅเคฐเฅเค เคเฅ เคธเคพเคฅ เคฅเฅเคฐเฅเคถเฅเคฒเฅเคก-เคเคงเคพเคฐเคฟเคค เค
เคฒเคฐเฅเค เคถเคพเคฎเคฟเคฒ เคนเฅเคเฅค
+เคเคผเฅเคฏเคพเคฆเคพเคคเคฐ Linux เคธเคฐเฅเคตเคฐ เคชเคฐ CPU, เคฎเฅเคฎเฅเคฐเฅ, เคกเคฟเคธเฅเค, เคจเฅเคเคตเคฐเฅเค, เคคเคพเคชเคฎเคพเคจ, เค
เคชเคเคพเคเคฎ, เคชเฅเคฐเฅเคธเฅเคธ, เคชเฅเคฐเฅเค, เคฒเฅเคเคฟเคจ เคเคฐ เคธเคฟเคธเฅเคเคฎ เคเคพเคจเคเคพเคฐเฅ, เคชเฅเคฐเคพเคจเฅ เคเคเคเคกเคผเฅเค เคเฅ เคเฅเคฐเคพเคซเคผ เคเฅ เคธเคพเคฅเฅค เคฎเฅเคจเฅเคเคฐ เคเคพเคฐเฅเคก เคธเฅ เคเคช เคธเคฐเฅเคตเคฟเคธ, cron เคเคพเคฐเฅเคฏ, เคชเฅเคเฅเค, เคเคชเคฏเฅเคเคเคฐเฅเคคเคพ, เคซเคผเคพเคฏเคฐเคตเฅเคฒ เคจเคฟเคฏเคฎ, WireGuard, Tailscale, SSL เคชเฅเคฐเคฎเคพเคฃเคชเคคเฅเคฐ, เคฒเฅเค เคเคฐ เคนเฅเคฒเฅเคฅ เคเฅเค Termix เคเฅเคกเคผเฅ เคฌเคฟเคจเคพ เคธเคเคญเคพเคฒ เคธเคเคคเฅ เคนเฅเคเฅค
-**เคเคชเคฏเฅเคเคเคฐเฅเคคเคพ เคชเฅเคฐเคฎเคพเคฃเฅเคเคฐเคฃ:**
-เคตเฅเคฏเคตเคธเฅเคฅเคพเคชเค เคจเคฟเคฏเคเคคเฅเคฐเคฃ (เค
เคจเฅเคฏ เคเคชเคฏเฅเคเคเคฐเฅเคคเคพเคเค เคเฅ เคเคพเคจเคเคพเคฐเฅ เคธเคเคชเคพเคฆเคฟเคค เคเคฐ เคธเคเคคเฅ เคนเฅเค) เคเคฐ OIDC/LDAP/SSO (เคเคเฅเคธเฅเคธ เคเคเคเฅเคฐเฅเคฒ เคเฅ เคธเคพเคฅ), 2FA (TOTP), เคเคฐ เคชเคพเคธเคเฅ (WebAuthn) เคธเคชเฅเคฐเฅเค เคเฅ เคธเคพเคฅ เคธเฅเคฐเคเฅเคทเคฟเคค เคเคชเคฏเฅเคเคเคฐเฅเคคเคพ เคชเฅเคฐเคฌเคเคงเคจเฅค เคธเคญเฅ เคชเฅเคฒเฅเคเคซเคผเฅเคฐเฅเคฎ เคชเคฐ เคธเคเฅเคฐเคฟเคฏ เคเคชเคฏเฅเคเคเคฐเฅเคคเคพ เคธเคคเฅเคฐ เคฆเฅเคเฅเค เคเคฐ เค
เคจเฅเคฎเคคเคฟเคฏเคพเค เคฐเคฆเฅเคฆ เคเคฐเฅเคเฅค เค
เคชเคจเฅ OIDC/เคธเฅเคฅเคพเคจเฅเคฏ เคเคพเคคเฅเค เคเฅ เคเค เคธเคพเคฅ เคเฅเคกเคผเฅเคเฅค เคธเคญเฅ เคเคชเคฏเฅเคเคเคฐเฅเคคเคพเคเค เคเฅ เคเคพเคฐเฅเคฐเคตเคพเคเคฏเฅเค เคเคพ เคเคกเคฟเค เคฒเฅเค เคฆเฅเคเฅเคเฅค
+**เคเคเฅเคฎเฅเคถเคจ:**
+เคชเคนเคฒเฅ เคเค เคเฅเคฐเคฟเคเคฐ เคเฅเคจเฅเค, เคซเคฟเคฐ เคฌเคคเคพเคเค เคเคฟ เคเฅเคฏเคพ เคนเฅเคจเคพ เคเคพเคนเคฟเคเฅค เคเฅเคฐเคฟเคเคฐ เคฎเฅเค เคเคฟเคธเฅ เคฎเฅเคเฅเคฐเคฟเค เคเคพ เคคเคฏ เคธเฅเคฎเคพ เคชเคพเคฐ เคเคฐเคจเคพ, เคนเฅเคธเฅเค เคเคพ เคฌเคเคฆ เคนเฅเคจเคพ เคฏเคพ เคตเคพเคชเคธ เคเคจเคพ, เคนเฅเคฒเฅเคฅ เคเฅเค เคเคพ เคฌเคฆเคฒเคจเคพ, เคเฅเค เคคเคฏ เคธเคฎเคฏ, เคเคเคเฅเคจเคฐ เคเฅ เคเฅเค เคเคเคจเคพ, เคฏเคพ เคเคจเฅ เคตเคพเคฒเคพ webhook เคถเคพเคฎเคฟเคฒ เคนเฅเฅค เคเคฆเคฎเฅเค เคฎเฅเค เคเคฎเคพเคเคก เคเคฐ เคธเฅเคจเคฟเคชเฅเค เคเคฒเคพเคจเคพ, เคเคเคเฅเคจเคฐ เคเคฐ เคเคจเคฒ เคธเคเคญเคพเคฒเคจเคพ, เคฎเคถเฅเคจ เคเคเคพเคจเคพ, เคเฅเค URL เคฌเฅเคฒเคพเคจเคพ, เคเคเคคเคเคผเคพเคฐ เคเคฐเคจเคพ, เคถเคฐเฅเคค เคเฅ เคนเคฟเคธเคพเคฌ เคธเฅ เคฐเคพเคธเฅเคคเคพ เคฌเคฆเคฒเคจเคพ, เคฆเฅเคธเคฐเคพ เคเคเฅเคฎเฅเคถเคจ เคเคฒเคพเคจเคพ, เคเคฐ ntfy, Discord เคฏเคพ webhook เคธเฅ เคเคชเคเฅ เคฌเคคเคพเคจเคพ เคถเคพเคฎเคฟเคฒ เคนเฅเฅค เคเฅเคธเฅเค เคฐเคจ เคธเฅ เคเคช เคชเคนเคฒเฅ เคธเฅเคฐเคเฅเคทเคฟเคค เคคเคฐเฅเคเฅ เคธเฅ เคเคเคผเคฎเคพ เคธเคเคคเฅ เคนเฅเคเฅค
-**Tailscale เคเคเฅเคเคฐเคฃ:**
-เค
เคชเคจเฅ Tailscale เคจเฅเคเคตเคฐเฅเค เคเฅ เคกเคฟเคตเคพเคเคธ เคธเฅเคเฅเคฌเคฆเฅเคง เคเคฐเฅเค เคคเคพเคเคฟ เคเคจเฅเคนเฅเค เคเคฒเฅเคฆเฅ เคธเฅ เคนเฅเคธเฅเค เคเฅ เคฐเฅเคช เคฎเฅเค เคเฅเคกเคผเคพ เคเคพ เคธเคเฅ, เคเคฐ Tailscale SSH เคเฅ เคชเฅเคฐเคฎเคพเคฃเฅเคเคฐเคฃ เคตเคฟเคงเคฟ เคเฅ เคฐเฅเคช เคฎเฅเค เคเคชเคฏเฅเค เคเคฐเคเฅ เคเคจเฅเคเฅเค เคเคฐเฅเค, เคเคฟเคธเคธเฅ เคเคชเคเฅ Tailscale ACL เคเฅเคฐเฅเคกเฅเคเคถเคฟเคฏเคฒ เคธเคเคเฅเคฐเคนเฅเคค เคเคฟเค เคฌเคฟเคจเคพ เคชเฅเคฐเคพเคงเคฟเคเคฐเคฃ เคธเคเคญเคพเคฒ เคธเคเฅเคเฅค
+**เคซเคผเฅเคฒเฅเค:**
+เคนเฅเคธเฅเค เคเฅเคจเคเคฐ เคฏเคพ เคเฅเค เคจเคฟเคฏเคฎเฅเค เคธเฅ เคเค เคซเคผเฅเคฒเฅเค เคฌเคจเคพเคเค, เคคเคพเคเคฟ เคจเค เคนเฅเคธเฅเค เค
เคชเคจเฅ เคเคช เคเฅเคกเคผ เคเคพเคเคเฅค เคเค เคนเฅ เคเคฎเคพเคเคก เคธเคญเฅ เคนเฅเคธเฅเค เคชเคฐ เคเค เคธเคพเคฅ เคเคฒเคพเคเค, เคธเคฌ เคชเคฐ เคซเคผเคพเคเคฒเฅเค เคญเฅเคเฅเค เคเคฐ เคเคจเคธเฅ เคฒเคพเคเค, เคชเฅเคเฅเค เคเคเคธเฅเคเฅเคฒ เคเคฐเฅเค, เคเคฐ OS, เคเคฐเฅเคจเฅเคฒ, เคเคฐเฅเคเคฟเคเฅเคเฅเคเคฐ เคเคฐ เค
เคชเคเคพเคเคฎ เคเฅ เคธเฅเคเฅ เคเคเคเฅเค เคพ เคเคฐเฅเคเฅค
-**RBAC/เคถเฅเคฏเคฐเคฟเคเค:**
-เคญเฅเคฎเคฟเคเคพเคเค เคฌเคจเคพเคเค เคเคฐ เคเคชเคฏเฅเคเคเคฐเฅเคคเคพเคเค/เคญเฅเคฎเคฟเคเคพเคเค เคฎเฅเค เคนเฅเคธเฅเค เคธเคพเคเคพ เคเคฐเฅเคเฅค เคธเคญเฅ เคชเฅเคฐเคฎเคพเคฃเฅเคเคฐเคฃ เคชเฅเคฐเคเคพเคฐเฅเค เคเคฐ เคธเคญเฅ เคนเฅเคธเฅเค เคชเฅเคฐเฅเคเฅเคเฅเคฒ เคเคพ เคธเคชเฅเคฐเฅเค เคเคฐเคคเคพ เคนเฅเฅค
+**AI เคธเคนเคพเคฏเค:**
+เคฏเคน เคตเฅเคเคฒเฅเคชเคฟเค เคนเฅ เคเคฐ เคเคฌ เคคเค เคเคช เคเฅเคฆ เคเคพเคฒเฅ เคจ เคเคฐเฅเค, เคฌเคเคฆ เคฐเคนเคคเคพ เคนเฅเฅค OpenAI, Anthropic, Gemini, Ollama เคฏเคพ OpenAI เคเฅ เค
เคจเฅเคฐเฅเคช เคเฅเค เคญเฅ เคเคเคกเคชเฅเคเคเค เคเฅเคกเคผเฅเค เคเคฐ เค
เคชเคจเฅ เคธเฅเคเค
เคช เคเฅ เคฌเคพเคฐเฅ เคฎเฅเค เคชเฅเคเฅเคเฅค เคฏเคน เคนเฅเคธเฅเค, เคซเคผเฅเคฒเฅเค, เคธเฅเคจเคฟเคชเฅเค เคเคฐ เค
เคฒเคฐเฅเค เคชเคขเคผ เคธเคเคคเคพ เคนเฅ, เคเคฐ เคฌเคฆเคฒเคพเคต เคเฅเคฆ เคเคฐเคจเฅ เคเฅ เคฌเคเคพเคฏ เคเคชเคเฅ เคฎเคเคเคผเฅเคฐเฅ เคเฅ เคฒเคฟเค เคธเฅเคเคพเคคเคพ เคนเฅเฅค เคฏเคน เคเฅเคฐเฅเคกเฅเคเคถเคฟเคฏเคฒ, เคเคชเคฏเฅเคเคเคฐเฅเคคเคพเคเค เคฏเคพ เคธเฅเคเคฟเคเคเฅเคธ เคคเค เคเคญเฅ เคจเคนเฅเค เคชเคนเฅเคเค เคธเคเคคเคพเฅค เคเคกเคฎเคฟเคจ เคเคธเฅ เคชเฅเคฐเฅ เคเคเคธเฅเคเฅเคเคธ เคเฅ เคฒเคฟเค เคฌเคเคฆ เคฐเค เคธเคเคคเฅ เคนเฅเค, เคเคฐ เคเคช เคเคธเฅ เคถเฅเคฐเฅเคเคคเฅ เคธเฅเคเค
เคช เคฎเฅเค เคนเฅ เคเคฟเคชเคพ เคธเคเคคเฅ เคนเฅเคเฅค
-**เคธเฅเคฐเคฟเคฏเคฒ เคเคจเฅเคเฅเคถเคจ:**
-เคธเฅเคฐเคฟเคฏเคฒ เคกเคฟเคตเคพเคเคธ (เคฐเคพเคเคเคฐ, เคธเฅเคตเคฟเค, เคฎเคพเคเคเฅเคฐเฅเคเคเคเฅเคฐเฅเคฒเคฐ เคเคฆเคฟ) เคธเฅ เคธเฅเคงเฅ เคฌเฅเคฐเคพเคเคเคผเคฐ เคฏเคพ เคกเฅเคธเฅเคเคเฅเคช เคเคช เคธเฅ เคเคจเฅเคเฅเค เคเคฐเฅเคเฅค เคฌเฅเคก เคฐเฅเค, เคกเฅเคเคพ เคฌเคฟเคเฅเคธ, เคธเฅเคเฅเคช เคฌเคฟเคเฅเคธ เคเคฐ เคชเฅเคฐเคฟเคเฅ เคเฅเคจเฅเคซเคผเคฟเคเคฐ เคเคฐเฅเคเฅค เคธเคฎเคฐเฅเคฅเคฟเคค เคฌเฅเคฐเคพเคเคเคผเคฐ เคฎเฅเค Web Serial API เคฏเคพ Electron เคเคช เคฎเฅเค เคจเฅเคเคฟเคต เคฌเฅเคเคเคเคก เคเคพ เคเคชเคฏเฅเค เคเคฐเคคเคพ เคนเฅเฅค
+**เคฒเฅเคเคฟเคจ เคเคฐ เคเคชเคฏเฅเคเคเคฐเฅเคคเคพ:**
+เคฒเฅเคเคฒ เคเคพเคคเฅเค เคเฅ เคธเคพเคฅ OIDC, LDAP, GitHub เคเคฐ Google เคธเฅ เคฒเฅเคเคฟเคจ, เคเคฐ เคฆเฅ เคเคฐเคฃเฅเค เคตเคพเคฒเคพ เคธเคคเฅเคฏเคพเคชเคจ (TOTP), เคชเคพเคธเคเฅ (WebAuthn) เคคเคฅเคพ เคญเคฐเฅเคธเฅเคฎเคเคฆ เคกเคฟเคตเคพเคเคธเฅค เคเคกเคฎเคฟเคจ เคเคชเคฏเฅเคเคเคฐเฅเคคเคพเคเค เคเฅ เคธเคเคญเคพเคฒ เคธเคเคคเฅ เคนเฅเค, OIDC เคธเคฎเฅเคนเฅเค เคเฅ เคญเฅเคฎเคฟเคเคพเคเค เคธเฅ เคเฅเคกเคผ เคธเคเคคเฅ เคนเฅเค, เคนเคฐ เคชเฅเคฒเฅเคเคซเคผเฅเคฐเฅเคฎ เคชเคฐ เคเคพเคฒเฅ เคธเคคเฅเคฐ เคฆเฅเค เคเคฐ เคฐเคฆเฅเคฆ เคเคฐ เคธเคเคคเฅ เคนเฅเคเฅค เค
เคชเคจเฅ เคฒเฅเคเคฒ เคเคฐ OIDC เคเคพเคคเฅ เคเคชเคธ เคฎเฅเค เคเฅเคกเคผเฅเค, เคเคฐ เคเคกเคฟเค เคฒเฅเค เคฎเฅเค เคฆเฅเคเฅเค เคเคฟ เคเคฟเคธเคจเฅ เคเฅเคฏเคพ เคเคฟเคฏเคพเฅค
+**เคญเฅเคฎเคฟเคเคพเคเค เคเคฐ เคธเคพเคเคพเคเคฐเคฃ:**
+เคญเฅเคฎเคฟเคเคพเคเค เคฌเคจเคพเคเค เคเคฐ เคนเฅเคธเฅเค เคเฅ เคเคชเคฏเฅเคเคเคฐเฅเคคเคพเคเค เคฏเคพ เคญเฅเคฎเคฟเคเคพเคเค เคเฅ เคธเคพเคฅ เคเคพเคฐ เคธเฅเคคเคฐเฅเค เคชเคฐ เคธเคพเคเคพ เคเคฐเฅเค: เคเคจเฅเคเฅเค, เคฆเฅเคเคจเคพ, เคฌเคฆเคฒเคจเคพ เคเคฐ เคชเฅเคฐเคฌเคเคงเคจเฅค เคฏเคน เคนเคฐ เคคเคฐเคน เคเฅ เคชเฅเคฐเคฎเคพเคฃเฅเคเคฐเคฃ เคเคฐ เคนเคฐ เคชเฅเคฐเฅเคเฅเคเฅเคฒ เคเฅ เคธเคพเคฅ เคเคฒเคคเคพ เคนเฅ, เคเคฐ เคธเคพเคเคพ เคนเฅเคธเฅเค เคเฅ เคฒเคฟเค เคเคธเฅเคคเฅเคฎเคพเคฒ เคนเฅเคจเฅ เคตเคพเคฒเฅ เคเฅเคฐเฅเคกเฅเคเคถเคฟเคฏเคฒ เคเคช เคฌเคฆเคฒ เคญเฅ เคธเคเคคเฅ เคนเฅเคเฅค
+
+
+
+
+
+
**เค
เคฒเคฐเฅเค:**
-เคนเฅเคธเฅเค เคฎเฅเคเฅเคฐเคฟเคเฅเคธ (CPU, เคฎเฅเคฎเฅเคฐเฅ, เคกเคฟเคธเฅเค เคเคฆเคฟ) เคชเคฐ เคฅเฅเคฐเฅเคถเฅเคฒเฅเคก-เคเคงเคพเคฐเคฟเคค เค
เคฒเคฐเฅเค เคจเคฟเคฏเคฎ เคธเฅเค เคเคฐเฅเค เคเคฐ เคเคฌ เคตเฅ เคเฅเคฐเคฟเคเคฐ เคนเฅเค เคคเฅ ntfy เคฏเคพ webhooks เคเฅ เคฎเคพเคงเฅเคฏเคฎ เคธเฅ เคธเฅเคเคจเคพ เคชเคพเคเคเฅค เคเคคเคฟเคนเคพเคธ เคฒเฅเค เคฎเฅเค เคธเคเฅเคฐเคฟเคฏ เคเคฐ เคนเคฒ เคเคฟเค เคเค เค
เคฒเคฐเฅเค เคฆเฅเคเฅเคเฅค
+CPU, เคฎเฅเคฎเฅเคฐเฅ เคเคฐ เคกเคฟเคธเฅเค เคเฅเคธเฅ เคนเฅเคธเฅเค เคฎเฅเคเฅเคฐเคฟเคเฅเคธ เคชเคฐ เคจเคฟเคฏเคฎ เคฒเคเคพเคเค, เคเคฐ เคเคจเคเฅ เคเคฒเคจเฅ เคชเคฐ ntfy, Discord เคฏเคพ webhook เคธเฅ เคธเฅเคเคจเคพ เคชเคพเคเคเฅค เคเคฒ เคฐเคนเฅ เคเคฐ เค เฅเค เคนเฅ เคเฅเคเฅ เค
เคฒเคฐเฅเค เคเคคเคฟเคนเคพเคธ เคฎเฅเค เคฆเฅเคเฅเค, เคเคฐ เคเฅ เคเคชเคเฅ เคเคพเคฎ เคเฅ เคจเคนเฅเค เคเคจเฅเคนเฅเค เคนเคเคพ เคฆเฅเคเฅค
-
-
**เคนเฅเคฎเคชเฅเค:**
-เคกเฅเคฐเฅเค-เคเคเคก-เคกเฅเคฐเฅเคช เคตเคฟเคเฅเค เคเฅเคฐเคฟเคก เคเฅ เคธเคพเคฅ เคชเฅเคฐเฅ เคคเคฐเคน เคธเฅ เคเคธเฅเคเคฎเคพเคเคเคผ เคเคฐเคจเฅ เคฏเฅเคเฅเคฏ เคนเฅเคฎเคชเฅเคเฅค เคนเฅเคธเฅเค เคธเฅเคเฅเคเคธ, เคธเคฐเฅเคตเคฟเคธ เคฒเคฟเคเค, เคเคกเคผเคฟเคฏเคพเค, เคจเฅเคเฅเคธ, RSS เคซเคผเฅเคก, เคฎเฅเคธเคฎ, Docker เคเคเคเฅเคจเคฐ, เคนเฅเคธเฅเค เคฎเฅเคเฅเคฐเคฟเคเฅเคธ เคเคพเคฐเฅเค, เคเคฎเฅเคฌเฅเคกเฅเคก เคเคฐเฅเคฎเคฟเคจเคฒ, iframes เคเคฐ เค
เคจเฅเคฏ เคเฅ เคฒเคฟเค เคตเคฟเคเฅเค เคเฅเคกเคผเฅเคเฅค
-
-
-
-
-**เคกเฅเคเคพเคฌเฅเคธ เคเคจเฅเคเฅเคฐเคฟเคชเฅเคถเคจ:**
-เคฌเฅเคเคเคเคก เคเคจเฅเคเฅเคฐเคฟเคชเฅเคเฅเคก SQLite เคกเฅเคเคพเคฌเฅเคธ เคซเคผเคพเคเคฒเฅเค เคเฅ เคฐเฅเคช เคฎเฅเค เคธเคเคเฅเคฐเคนเฅเคคเฅค เค
เคงเคฟเค เคเคพเคจเคเคพเคฐเฅ เคเฅ เคฒเคฟเค [เคกเฅเคเฅเคธ](https://docs.termix.site/security) เคฆเฅเคเฅเคเฅค
+เคเฅเคเคเคเคฐ เคเฅเคกเคผเคจเฅ เคตเคพเคฒเคพ เคตเคฟเคเฅเค เคเฅเคฐเคฟเคก เคเคฟเคธเฅ เคเคช เคเฅเคฆ เคฌเคจเคพเคคเฅ เคนเฅเคเฅค เคนเฅเคธเฅเค เคเฅ เคธเฅเคฅเคฟเคคเคฟ, เคชเคฟเคเค, เคธเคฐเฅเคตเคฟเคธ เคฒเคฟเคเค, เคฌเฅเคเคฎเคพเคฐเฅเค, เคเฅเค, เคเคกเคผเคฟเคฏเคพเค, เคเฅเคฒเฅเคเคกเคฐ, เคเคฒเคเฅ เคเคฟเคจเคคเฅ, เคจเฅเคเฅเคธ, RSS, เคฎเฅเคธเคฎ, เคคเคธเฅเคตเฅเคฐเฅเค, iframe, Docker, เคเคจเคฒ, เคฎเฅเคเฅเคฐเคฟเคเฅเคธ เคเฅ เคเฅเคฐเคพเคซเคผ, เค
เคชเคจเฅ API เคเคฐ เคฏเคนเคพเค เคคเค เคเคฟ เคเคพเคฒเฅ เคเคฐเฅเคฎเคฟเคจเคฒ เคคเค เคเฅ เคตเคฟเคเฅเค เคฎเฅเคเฅเคฆ เคนเฅเคเฅค
-**เคจเฅเคเคตเคฐเฅเค เคเฅเคฐเคพเคซเคผ:**
-เคธเฅเคฅเคฟเคคเคฟ เคธเคชเฅเคฐเฅเค เคเฅ เคธเคพเคฅ เค
เคชเคจเฅ SSH เคเคจเฅเคเฅเคถเคจ เคเฅ เคเคงเคพเคฐ เคชเคฐ เค
เคชเคจเฅ เคนเฅเคฎเคฒเฅเคฌ เคเฅ เคตเคฟเคเคผเฅเค
เคฒเคพเคเคเคผ เคเคฐเคจเฅ เคเฅ เคฒเคฟเค เค
เคชเคจเคพ เคกเฅเคถเคฌเฅเคฐเฅเคก เคเคธเฅเคเคฎเคพเคเคเคผ เคเคฐเฅเคเฅค
+**เคธเฅเคจเคฟเคชเฅเค เคเคฐ เคเคชเคเคฐเคฃ:**
+เคเฅ เคเคฎเคพเคเคก เคเคช เคฌเคพเคฐ-เคฌเคพเคฐ เคเคฒเคพเคคเฅ เคนเฅเค เคเคจเฅเคนเฅเค เคธเคนเฅเคเฅเค เคเคฐ เคเค เคเฅเคฒเคฟเค เคฎเฅเค เคเคฒเคพเคเค, เคนเฅเคธเฅเค เคเคฐ เค
เคชเคจเฅ เคเคจเคชเฅเค เคเฅ เคฒเคฟเค เคตเฅเคฐเคฟเคเคฌเคฒ เคเฅ เคธเคพเคฅเฅค เคเค เคนเฅ เคเคฎเคพเคเคก เคธเคญเฅ เคเฅเคฒเฅ เคเคฐเฅเคฎเคฟเคจเคฒเฅเค เคชเคฐ เคเคฒเคพเคเค, เคเคฐ เค
เคชเคจเฅ เคเคฎเคพเคเคก เคเคคเคฟเคนเคพเคธ เคฎเฅเค เคเคเฅ-เคเคเคชเฅเคฒเฅเค เคเฅ เคธเคพเคฅ เคเฅเคเฅเคเฅค
-**SSH เคเฅเคฒเฅเคธ:**
-เคเค เคเฅเคฒเคฟเค เคธเฅ เคจเคฟเคทเฅเคชเคพเคฆเคฟเคค เคนเฅเคจเฅ เคตเคพเคฒเฅ เคชเฅเคจ: เคเคชเคฏเฅเค เคฏเฅเคเฅเคฏ เคเคฎเคพเคเคก เคธเฅเคจเคฟเคชเฅเค เคฌเคจเคพเคเคเฅค เคเค เคธเคพเคฅ เคเค เคเฅเคฒเฅ เคเคฐเฅเคฎเคฟเคจเคฒเฅเค เคฎเฅเค เคเค เคเคฎเคพเคเคก เคเคฒเคพเคเคเฅค
+**เคธเคคเฅเคฐ เคธเคพเคเคพ เคเคฐเคจเคพ:**
+เคเคพเคฒเฅ เคเคฐเฅเคฎเคฟเคจเคฒ, RDP, VNC เคฏเคพ Telnet เคธเคคเฅเคฐ เคฒเคพเคเคต เคธเคพเคเคพ เคเคฐเฅเคเฅค เคเคธเคพ เคฒเคฟเคเค เคญเฅเคเฅเค เคเคฟเคธเคธเฅ เคเฅเค เคญเฅ เคฌเคฟเคจเคพ เคเคพเคคเฅ เคเฅ เคเฅเคกเคผ เคธเคเฅ, เคฏเคพ เคเคฟเคธเฅ เคเคพเคธ Termix เคเคชเคฏเฅเคเคเคฐเฅเคคเคพ เคเฅ เคธเคพเคฅ เคธเคพเคเคพ เคเคฐเฅเค, เคธเคฟเคฐเฅเคซเคผ เคฆเฅเคเคจเฅ เคฏเคพ เคฒเคฟเคเคจเฅ เคเฅ เค
เคจเฅเคฎเคคเคฟ เคเฅ เคธเคพเคฅเฅค เคธเคพเคเคพเคเคฐเคฃ เค
เคชเคจเฅ เคเคช เคเคคเฅเคฎ เคนเฅ เคธเคเคคเคพ เคนเฅ เคฏเคพ เคเคญเฅ เคญเฅ เคฐเคฆเฅเคฆ เคเคฟเคฏเคพ เคเคพ เคธเคเคคเคพ เคนเฅ, เคเคฐ เคเคธเฅ เคชเฅเคฐเฅ เคคเคฐเคน เคฏเคพ เคนเคฐ เคนเฅเคธเฅเค เคเฅ เคฒเคฟเค เค
เคฒเค เคธเฅ เคฌเคเคฆ เคเคฟเคฏเคพ เคเคพ เคธเคเคคเคพ เคนเฅเฅค
-**เคชเคฐเคธเคฟเคธเฅเคเฅเคเค เคเฅเคฌ:**
-เคเคชเคฏเฅเคเคเคฐเฅเคคเคพ เคชเฅเคฐเฅเคซเคผเคพเคเคฒ เคฎเฅเค เคธเคเฅเคทเคฎ เคนเฅเคจเฅ เคชเคฐ SSH เคธเฅเคถเคจ เคเคฐ เคเฅเคฌ เคกเคฟเคตเคพเคเคธ/เคฐเฅเคซเฅเคฐเฅเคถ เคเฅ เคชเคพเคฐ เคเฅเคฒเฅ เคฐเคนเคคเฅ เคนเฅเคเฅค
+**เคธเคคเฅเคฐ เคฐเคฟเคเฅเคฐเฅเคกเคฟเคเค เคเคฐ เคฒเฅเค:**
+เคเคฐเฅเคฎเคฟเคจเคฒ, RDP เคเคฐ VNC เคธเคคเฅเคฐ เคฐเคฟเคเฅเคฐเฅเคก เคเคฐเฅเค เคเคฐ เคฌเคพเคฆ เคฎเฅเค เคฆเฅเคเฅเคเฅค เคธเคคเฅเคฐ เคเฅ เคธเคพเคฆเฅ เคเฅเคเฅเคธเฅเค เคฒเฅเค เคกเคพเคเคจเคฒเฅเคก เคเคฐเฅเค, เคเคฐ เคเคจเฅเคเฅเคถเคจ เคฒเฅเค เคฆเฅเคเคเคฐ เคเคพเคจเฅเค เคเคฟ เคเฅเคกเคผเคคเฅ เคธเคฎเคฏ เค
เคธเคฒ เคฎเฅเค เคเฅเคฏเคพ เคนเฅเคเฅค
+
+
+
+
+**เคธเฅเคฐเคฟเคฏเคฒ เคเคจเฅเคเฅเคถเคจ:**
+เคฐเคพเคเคเคฐ, เคธเฅเคตเคฟเค เคเคฐ เคฎเคพเคเคเฅเคฐเฅเคเคเคเฅเคฐเฅเคฒเคฐ เคเฅเคธเฅ เคธเฅเคฐเคฟเคฏเคฒ เคเคชเคเคฐเคฃเฅเค เคธเฅ เคฌเฅเคฐเคพเคเคเคผเคฐ เคฏเคพ เคกเฅเคธเฅเคเคเฅเคช เคเคช เคธเฅ เคฌเคพเคค เคเคฐเฅเคเฅค เคฌเฅเคก เคฐเฅเค, เคกเฅเคเคพ เคฌเคฟเค, เคธเฅเคเฅเคช เคฌเคฟเค เคเคฐ เคชเฅเคฐเคฟเคเฅ เคธเฅเค เคเคฐเฅเคเฅค เคธเคนเคฏเฅเคเฅ เคฌเฅเคฐเคพเคเคเคผเคฐเฅเค เคฎเฅเค Web Serial API เคเคฐ เคกเฅเคธเฅเคเคเฅเคช เคเคช เคฎเฅเค เคฎเฅเคฒ เคฌเฅเคเคเคเคก เคเคธเฅเคคเฅเคฎเคพเคฒ เคนเฅเคคเคพ เคนเฅเฅค
+
+
+
+
+
+
+**Tailscale:**
+เค
เคชเคจเฅ tailnet เคธเฅ เคกเคฟเคตเคพเคเคธ เคฒเคพเคเคฐ เคเฅเค เคนเฅ เคเฅเคฒเคฟเค เคฎเฅเค เคนเฅเคธเฅเค เคเฅ เคฐเฅเคช เคฎเฅเค เคเฅเคกเคผเฅเค, เคเคฐ Tailscale SSH เคธเฅ เคเฅเคกเคผเฅเค เคคเคพเคเคฟ เคชเคนเฅเคเค เคเคพ เคเคพเคฎ เคเคชเคเฅ tailnet เคเฅ ACL เคธเคเคญเคพเคฒเฅเค เคเคฐ เคเฅเค เคเฅเคฐเฅเคกเฅเคเคถเคฟเคฏเคฒ เคธเคนเฅเคเคจเคพ เคจ เคชเคกเคผเฅเฅค Headscale เคเคฐ เค
เคชเคจเฅ เคเคเคกเคชเฅเคเคเค เคญเฅ เคเคฒเคคเฅ เคนเฅเคเฅค
+
+
+
+
+**Proxmox:**
+เคนเฅเคธเฅเค เคธเฅเคงเฅ เคเคฟเคธเฅ Proxmox เคเคเคธเฅเคเฅเคเคธ เคธเฅ เคฒเคพเคเค, เคเคฐ เคจเฅเคก เคคเคฅเคพ เคเฅเคธเฅเค เคเฅ เคเคเคเคกเคผเฅ, เคเคฟเคจเคฎเฅเค CPU, เคฎเฅเคฎเฅเคฐเฅ เคเคฐ เคธเฅเคเฅเคฐเฅเค เคถเคพเคฎเคฟเคฒ เคนเฅเค, เค
เคฒเค เคเฅเคฌ เคฎเฅเค เคฆเฅเคเฅเคเฅค
+
+
+
+
+
+
+**เคตเคฐเฅเคเคธเฅเคชเฅเคธ เคเคฐ เคเฅเคฌ:**
+เคเฅเคฌ เคเคพ เคเค เคธเฅเค เคเคจเคเฅ เคธเฅเคชเฅเคฒเคฟเค เคฒเฅเคเคเค เคเฅ เคธเคพเคฅ เคธเคนเฅเคเฅเค เคเคฐ เคชเฅเคฐเคพ เคเคพ เคชเฅเคฐเคพ เคเค เคเฅเคฒเคฟเค เคฎเฅเค เคซเคฟเคฐ เคเฅเคฒเฅเคเฅค Termix เคเคชเคเคพ เคชเคฟเคเคฒเคพ เคธเคคเฅเคฐ เคญเฅ เคฏเคพเคฆ เคฐเคเคคเคพ เคนเฅ, เคเคธเคฒเคฟเค เคชเฅเค เคฐเฅเคซเคผเฅเคฐเฅเคถ เคเคฐเคจเฅ เคชเคฐ เคเคฐ เคฆเฅเคธเคฐเฅ เคกเคฟเคตเคพเคเคธ เคชเคฐ เคญเฅ เคเคชเคเฅ เคเฅเคฌ เคฒเฅเค เคเคคเฅ เคนเฅเคเฅค
+
+
+
+
+**เคจเคฟเคฐเฅเคฆเฅเคถเคฟเคค เคธเฅเคเค
เคช:**
+เคเค เคเฅเคเคพ เคธเคพ เคธเฅเคเค
เคช เคเคชเคเฅ เคเคเคเคฐเคซเคผเฅเคธ เคชเฅเคฐเฅเคธเฅเค, เคฅเฅเคฎ, เคฎเคจเคเคพเคนเฅ เคธเฅเคตเคฟเคงเคพเคเค เคเคฐ เคชเคนเคฒเคพ เคนเฅเคธเฅเค เคเฅเคจเคจเฅ เคฎเฅเค เคฎเคฆเคฆ เคเคฐเคคเคพ เคนเฅเฅค เคธเคฐเคฒ เคฎเฅเคก เคตเคน เคธเคฌ เคเคฟเคชเคพ เคฆเฅเคคเคพ เคนเฅ เคเฅ เคเคช เคเคธเฅเคคเฅเคฎเคพเคฒ เคจเคนเฅเค เคเคฐเคคเฅ, เคเคฐ เคเคช เคธเฅเคเค
เคช เคฆเฅเคฌเคพเคฐเคพ เคเคฒเคพ เคธเคเคคเฅ เคนเฅเค เคฏเคพ เคชเฅเคฐเฅเคธเฅเค เคเคญเฅ เคญเฅ เคฌเคฆเคฒ เคธเคเคคเฅ เคนเฅเคเฅค
+
+
+
+
+
+
+**เคธเฅเคตเคคเคเคคเฅเคฐ เคกเฅเคธเฅเคเคเฅเคช เคเคช เคเคฐ เคธเคฟเคเค:**
+เคกเฅเคธเฅเคเคเฅเคช เคเคช เค
เคชเคจเฅ เคฒเฅเคเคฒ เคฌเฅเคเคเคเคก เคเคฐ เคกเฅเคเคพเคฌเฅเคธ เคเฅ เคธเคพเคฅ เคฌเคฟเคจเคพ เคเคฟเคธเฅ เคธเคฐเฅเคตเคฐ เคเฅ เค
เคเฅเคฒเฅ เคเคฒเคคเคพ เคนเฅเฅค เคเคช เคเคธเฅ เคเคฟเคธเฅ Termix เคธเคฐเฅเคตเคฐ เคธเฅ เคเฅเคกเคผเคเคฐ เคนเฅเคธเฅเค, เคเฅเคฐเฅเคกเฅเคเคถเคฟเคฏเคฒ, เคธเฅเคจเคฟเคชเฅเค เคตเคเฅเคฐเคน เคฆเฅเคจเฅเค เคคเคฐเคซเคผ เคธเคฟเคเค เคเคฐ เคธเคเคคเฅ เคนเฅเค, เคเคฐ เคเฅเคจ เคธเคเคคเฅ เคนเฅเค เคเคฟ เคเคจเฅเคเฅเคถเคจ เคเคชเคเฅ เคฎเคถเฅเคจ เคธเฅ เคถเฅเคฐเฅ เคนเฅเค เคฏเคพ เคธเคฐเฅเคตเคฐ เคเฅ เคฐเคพเคธเฅเคคเฅเฅค
+
+
+
+
+**เคเคฎเคพเคเคก เคฒเคพเคเคจ:**
+เคเคชเคเฅ เคถเฅเคฒ เคเคฐ เคธเฅเคเฅเคฐเคฟเคชเฅเค เคเฅ เคฒเคฟเค `termix` CLIเฅค เคเคฐเฅเคฎเคฟเคจเคฒ เคเฅเคฒเฅเค, เคเคฟเคธเฅ เคเค เคนเฅเคธเฅเค เคฏเคพ เคชเฅเคฐเฅ เคซเคผเฅเคฒเฅเค เคชเคฐ เคเคฎเคพเคเคก เคเคฒเคพเคเค, SFTP เคธเฅ เคซเคผเคพเคเคฒเฅเค เคญเฅเคเฅเค, เคเคฐ เคนเฅเคธเฅเค, เคธเฅเคจเคฟเคชเฅเค เคต เคเฅเคฐเฅเคกเฅเคเคถเคฟเคฏเคฒ เคธเคเคญเคพเคฒเฅเคเฅค `npm install -g @termix-cli/cli` เคธเฅ เคเคเคธเฅเคเฅเคฒ เคเคฐเฅเค เคฏเคพ เค
เคฒเค เคฌเคพเคเคจเคฐเฅ เคฒเฅเคเฅค [CLI เคฆเคธเฅเคคเคพเคตเฅเคเคผ](https://docs.termix.site/cli) เคฆเฅเคเฅเคเฅค
+
+
+
+
+
+
+**เคธเฅเคฐเคเฅเคทเคพ:**
+เคชเคพเคธเคตเคฐเฅเคก, เคเฅเคเคเคฟเคฏเคพเค เคเคฐ เคฌเคพเคเฅ เคเฅเคชเคจเฅเคฏ เคเคพเคจเคเคพเคฐเฅ เคนเคฐ เคเคชเคฏเฅเคเคเคฐเฅเคคเคพ เคเฅ เคฒเคฟเค เค
เคฒเค เคธเฅ เคเคจเฅเคเฅเคฐเคฟเคชเฅเค เคนเฅเคคเฅ เคนเฅ, เคเคฐ เคกเฅเคเคพเคฌเฅเคธ เคซเคผเคพเคเคฒเฅเค เคญเฅ เคกเคฟเคธเฅเค เคชเคฐ เคเคจเฅเคเฅเคฐเคฟเคชเฅเค เคเฅ เคเคพ เคธเคเคคเฅ เคนเฅเคเฅค เคฏเคน เคเฅเคธเฅ เคเคพเคฎ เคเคฐเคคเคพ เคนเฅ, เคฏเคน [เคฆเคธเฅเคคเคพเคตเฅเคเคผ](https://docs.termix.site/security) เคฎเฅเค เคฆเฅเคเฅเคเฅค
**เคญเคพเคทเคพเคเค:**
-เคฒเคเคญเค 30 เคญเคพเคทเคพเคเค เคเคพ เคฌเคฟเคฒเฅเค-เคเคจ เคธเคชเฅเคฐเฅเค ([Crowdin](https://docs.termix.site/translations) เคฆเฅเคตเคพเคฐเคพ เคชเฅเคฐเคฌเคเคงเคฟเคค)เฅค
+เคฒเคเคญเค 30 เคญเคพเคทเคพเคเค เคชเคนเคฒเฅ เคธเฅ เคฎเฅเคเฅเคฆ เคนเฅเค, เคเคฟเคจเฅเคนเฅเค [Crowdin](https://docs.termix.site/translations) เคธเฅ เคธเคเคญเคพเคฒเคพ เคเคพเคคเคพ เคนเฅเฅค
@@ -196,20 +252,23 @@ Termix เคเค เคเคชเคจ-เคธเฅเคฐเฅเคธ, เคนเคฎเฅเคถเคพ เคเฅ เคฒเคฟเค เคฎเฅ
-เค
เคงเคฟเค เคตเคฟเคถเฅเคทเคคเคพเคเค เคเคฐ เคญเฅ เคตเคฟเคถเฅเคทเคคเคพเคเค
@@ -252,9 +311,9 @@ Termix เคเค เคเคชเคจ-เคธเฅเคฐเฅเคธ, เคนเคฎเฅเคถเคพ เคเฅ เคฒเคฟเค เคฎเฅ
## เคเคเคธเฅเคเฅเคฒเฅเคถเคจ
-เคธเคญเฅ เคชเฅเคฒเฅเคเคซเคผเฅเคฐเฅเคฎ เคชเคฐ เคชเฅเคฐเฅเคฃ เคเคเคธเฅเคเฅเคฒเฅเคถเคจ เคจเคฟเคฐเฅเคฆเฅเคถเฅเค เคเฅ เคฒเคฟเค Termix [เคกเฅเคเฅเคธ](https://docs.termix.site/install) เคชเคฐ เคเคพเคเคเฅค
+เคธเคญเฅ เคชเฅเคฒเฅเคเคซเคผเฅเคฐเฅเคฎ เคชเคฐ เคชเฅเคฐเฅ เคเคเคธเฅเคเฅเคฒเฅเคถเคจ เคเคพเคจเคเคพเคฐเฅ เคเฅ เคฒเคฟเค [Termix เคฆเคธเฅเคคเคพเคตเฅเคเคผ](https://docs.termix.site/install) เคฆเฅเคเฅเคเฅค
-เคจเคฎเฅเคจเคพ Docker Compose เคซเคผเคพเคเคฒ (เคฏเคฆเคฟ เคเคช เคฐเคฟเคฎเฅเค เคกเฅเคธเฅเคเคเฅเคช เคธเฅเคตเคฟเคงเคพเคเค เคเคพ เคเคชเคฏเฅเค เคเคฐเคจเฅ เคเฅ เคฏเฅเคเคจเคพ เคจเคนเฅเค เคฌเคจเคพ เคฐเคนเฅ เคนเฅเค เคคเฅ เคเคช `guacd` เคเคฐ เคจเฅเคเคตเคฐเฅเค เคเฅ เคนเคเคพ เคธเคเคคเฅ เคนเฅเค):
+Docker Compose เคซเคผเคพเคเคฒ เคเคพ เคจเคฎเฅเคจเคพ (เค
เคเคฐ เคเคช เคฐเคฟเคฎเฅเค เคกเฅเคธเฅเคเคเฅเคช เคเคธเฅเคคเฅเคฎเคพเคฒ เคจเคนเฅเค เคเคฐเคจเฅ เคตเคพเคฒเฅ เคคเฅ `guacd` เคเคฐ เคจเฅเคเคตเคฐเฅเค เคตเคพเคฒเคพ เคนเคฟเคธเฅเคธเคพ เคนเคเคพ เคธเคเคคเฅ เคนเฅเค):
```yaml
services:
@@ -291,11 +350,37 @@ networks:
driver: bridge
```
+### เคเคฎเคพเคเคก เคฒเคพเคเคจ
+
+Termix เคฎเฅเค CLI เคญเฅ เคนเฅ, เคคเคพเคเคฟ เคเคช เคเคฐเฅเคฎเคฟเคจเคฒ เคธเฅ เค
เคชเคจเฅ เคธเคฐเฅเคตเคฐ เคธเคเคญเคพเคฒ เคธเคเฅเค เคเคฐ Termix เคเฅ เค
เคชเคจเฅ เคธเฅเคเฅเคฐเคฟเคชเฅเค เคฎเฅเค เคเคธเฅเคคเฅเคฎเคพเคฒ เคเคฐ เคธเคเฅเคเฅค
+
+```bash
+npm install -g @termix-cli/cli
+termix login --url https://termix.example.com
+termix ssh 1
+```
+
+เคฏเคน เคเคฐเฅเคฎเคฟเคจเคฒ เคเฅเคฒ เคธเคเคคเคพ เคนเฅ, เคเค เคนเฅเคธเฅเค เคฏเคพ เคชเฅเคฐเฅ เคซเคผเฅเคฒเฅเค เคชเคฐ เคเคฎเคพเคเคก เคเคฒเคพ เคธเคเคคเคพ เคนเฅ, SFTP เคธเฅ เคซเคผเคพเคเคฒเฅเค เคฒเฅ เคเคพ เคธเคเคคเคพ เคนเฅ, เคเคฐ เคนเฅเคธเฅเค, เคธเฅเคจเคฟเคชเฅเค เคต เคเฅเคฐเฅเคกเฅเคเคถเคฟเคฏเคฒ เคธเคเคญเคพเคฒ เคธเคเคคเคพ เคนเฅเฅค เคชเฅเคฐเคพ เคฆเคธเฅเคคเคพเคตเฅเคเคผ [docs.termix.site/cli](https://docs.termix.site/cli) เคชเคฐ เคนเฅเฅค
+
+### เคเฅเคฒเคพเคเคก เคนเฅเคธเฅเคเคฟเคเค
+
+เคเคช Termix เคธเคฐเฅเคตเคฐ เคเฅ เค
เคชเคจเฅ เคจเฅเคเคตเคฐเฅเค เคเฅ เคฌเคเคพเคฏ เคเคฟเคธเฅ VPS เคชเคฐ เคญเฅ เคเคฒเคพ เคธเคเคคเฅ เคนเฅเคเฅค เค
เคเคฐ Termix เคเคธเฅ เคจเฅเคเคตเคฐเฅเค เคชเคฐ เคเคฒ เคฐเคนเคพ เคนเฅ เคเคฟเคธเฅ เคตเคน เคธเคเคญเคพเคฒเคคเคพ เคนเฅ, เคคเฅ เคเคกเคผเคฌเคกเคผเฅ เคนเฅเคจเฅ เคชเคฐ เคตเคน เคญเฅ เคธเคพเคฅ เคนเฅ เคฌเคเคฆ เคนเฅ เคเคพเคเคเคพ, เค เฅเค เคเคธเฅ เคตเคเฅเคค เคเคฌ เคเคชเคเฅ เคเคธเฅ เค เฅเค เคเคฐเคจเฅ เคเฅ เคฒเคฟเค เคเคพเคนเคฟเคเฅค เคฌเคพเคนเคฐ เคเคฒเคพเคจเฅ เคชเคฐ เคตเคน เคนเคฎเฅเคถเคพ เคชเคนเฅเคเค เคฎเฅเค เคฐเคนเคคเคพ เคนเฅ, เคเค เคธเฅเคฅเคฟเคฐ IP เคฆเฅเคคเคพ เคนเฅ, เคเคฐ เคฌเคฟเคจเคพ VPN เคฏเคพ เคชเฅเคฐเฅเค เคซเคผเฅเคฐเคตเคฐเฅเคก เคเฅ เคเคนเฅเค เคธเฅ เคญเฅ เคชเคนเฅเคเค เคฎเคฟเคฒเคคเฅ เคนเฅเฅค
+
+[GINERNET](https://docs.termix.site/install/ginernet) Termix เคเฅ เคชเฅเคฐเคพเคฏเฅเคเคฟเคค เคเคฐเคคเคพ เคนเฅ, เคเคฐ เคฆเคธเฅเคคเคพเคตเฅเคเคผ เคฎเฅเค เคเคจเคเฅ VPS เคชเฅเคฒเฅเคเคซเคผเฅเคฐเฅเคฎ เคชเคฐ เคคเฅเคจเคพเคคเฅ เคเฅ เคเคฆเคฎ-เคฆเคฐ-เคเคฆเคฎ เคเคพเคเคก เคฎเฅเคเฅเคฆ เคนเฅเฅค
+
+
@@ -325,10 +410,6 @@ Termix เคฎเฅเคซเคผเฅเคค เคเคฐ เคเคชเคจ เคธเฅเคฐเฅเคธ เคนเฅ, เคฌเคฟเคจเคพ
-
-
-
@@ -340,14 +421,17 @@ Termix เคฎเฅเคซเคผเฅเคค เคเคฐ เคเคชเคจ เคธเฅเคฐเฅเคธ เคนเฅ, เคฌเคฟเคจเคพ
-
+
+
+
YouTube เคชเคฐ เค
เคชเคกเฅเค เคเฅ เคธเคฎเฅเคเฅเคทเคพเคเค เคฆเฅเคเฅเค
+YouTube เคชเคฐ เค
เคชเคกเฅเค เคเฅ เคเคพเคจเคเคพเคฐเฅ เคฆเฅเคเฅเค
-เคเฅเค เคตเฅเคกเคฟเคฏเฅ เคเคฐ เคเคตเคฟเคฏเคพเค เคชเฅเคฐเคพเคจเฅ เคนเฅ เคธเคเคคเฅ เคนเฅเค เคฏเคพ เคตเคฟเคถเฅเคทเคคเคพเคเค เคเฅ เคชเฅเคฐเฅ เคคเคฐเคน เคธเฅ เคชเฅเคฐเคฆเคฐเฅเคถเคฟเคค เคจเคนเฅเค เคเคฐ เคธเคเคคเฅ เคนเฅเคเฅค
+เคเฅเค เคตเฅเคกเคฟเคฏเฅ เคเคฐ เคคเคธเฅเคตเฅเคฐเฅเค เคชเฅเคฐเคพเคจเฅ เคนเฅ เคธเคเคคเฅ เคนเฅเค เคฏเคพ เคธเฅเคตเคฟเคงเคพเคเค เคเฅ เคชเฅเคฐเฅ เคคเคฐเคน เคจเคนเฅเค เคฆเคฟเคเคพ เคชเคพเคคเฅเคเฅค
@@ -407,10 +491,10 @@ Termix เคฎเฅเคซเคผเฅเคค เคเคฐ เคเคชเคจ เคธเฅเคฐเฅเคธ เคนเฅ, เคฌเคฟเคจเคพ
## เคจเคฟเคฏเฅเคเคฟเคค เคตเคฟเคถเฅเคทเคคเคพเคเค
-เคธเคญเฅ เคจเคฟเคฏเฅเคเคฟเคค เคตเคฟเคถเฅเคทเคคเคพเคเค เคเฅ เคฒเคฟเค [เคชเฅเคฐเฅเคเฅเคเฅเคเฅเคธ](https://github.com/orgs/Termix-SSH/projects/5) เคฆเฅเคเฅเคเฅค เคฏเคฆเคฟ เคเคช เคฏเฅเคเคฆเคพเคจ เคฆเฅเคจเคพ เคเคพเคนเคคเฅ เคนเฅเค, เคคเฅ [เคฏเฅเคเคฆเคพเคจ](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) เคฆเฅเคเฅเคเฅค
+เคธเคญเฅ เคจเคฟเคฏเฅเคเคฟเคค เคธเฅเคตเคฟเคงเคพเคเค [Projects](https://github.com/orgs/Termix-SSH/projects/5) เคฎเฅเค เคนเฅเคเฅค เค
เคเคฐ เคเคช เคฏเฅเคเคฆเคพเคจ เคฆเฅเคจเคพ เคเคพเคนเคคเฅ เคนเฅเค, เคคเฅ [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) เคฆเฅเคเฅเคเฅค
Termix
-Gestione SSH self-hosted e accesso al desktop remoto
+Gestione dei server self-hosted, da SSH e desktop remoto fino alle automazioni
English ยท
@@ -32,12 +32,12 @@
-
-**Accesso Terminale SSH:**
-Terminale completo con supporto schermo diviso (fino a 4 pannelli) con un sistema di schede in stile browser. Include il supporto per la personalizzazione del terminale, inclusi temi, font e altri componenti comuni.
+**Terminale SSH:**
+Un terminale completo con schede come quelle del browser e schermo diviso, fino a 6 pannelli insieme. Scegli tema, carattere e colori. Sopra ogni sessione c'รจ una barra con CPU, memoria e disco in tempo reale, piรน scorciatoie ai file, a Docker, ai tunnel e alle metriche di quell'host.
-**Accesso Desktop Remoto:**
-Supporto RDP, VNC e Telnet tramite browser con personalizzazione completa e schermo diviso.
+**Desktop remoto:**
+RDP, VNC e Telnet nel browser, in schede e schermo diviso come qualsiasi altra sessione. Include un browser dei file per le unitร RDP e il caricamento trascinando i file. Sul desktop Windows puoi anche aprire un host nel client RDP nativo.
-**Gestione Tunnel SSH:**
-Crea e gestisci tunnel SSH da server a server con riconnessione automatica, monitoraggio dello stato e inoltro locale, remoto o SOCKS dinamico. Le impostazioni del tunnel da client desktop a server sono archiviate localmente per ogni installazione desktop; gli snapshot di preset C2S opzionali possono essere salvati sul server, rinominati, caricati o eliminati per spostare una configurazione di tunnel locale tra i client.
+**Tunnel SSH:**
+Inoltro locale, remoto e SOCKS dinamico, con riconnessione automatica e controlli di stato. I tunnel da client a server dell'app desktop restano su quella macchina, e puoi salvare delle preimpostazioni sul server per portare una configurazione su un altro computer.
-**Gestore File Remoto:**
-Gestisci i file direttamente sui server remoti con supporto per la visualizzazione e la modifica di codice, immagini, audio e video. Carica, scarica, rinomina, elimina e sposta file senza problemi con supporto sudo. Include il supporto per spostare file da server a server.
+**Gestore file:**
+Sfoglia, modifica, carica, scarica, rinomina, sposta ed elimina file via SFTP, anche con sudo. Guarda e modifica codice, immagini, audio e video. Copia i file direttamente da un server all'altro: il percorso piรน veloce viene scelto per te e i trasferimenti vengono verificati.
-**Gestione Docker e Podman:**
-Avvia, ferma, metti in pausa, rimuovi container. Visualizza le statistiche dei container. Controlla i container tramite terminale docker exec. Supporta sia Docker che Podman come runtime dei container. Non รจ stato creato per sostituire Portainer o Dockge, ma piuttosto per gestire semplicemente i tuoi container rispetto alla loro creazione.
+**Docker e Podman:**
+Avvia, ferma, metti in pausa ed elimina i container, guarda le loro statistiche e apri una shell dentro uno di essi. Funziona sia con Docker sia con Podman. Non vuole sostituire Portainer o Dockge, serve solo a gestire i container che hai giร .
-**Gestore Host SSH:**
-Salva, organizza e gestisci le tue connessioni SSH con tag e cartelle (con personalizzazione delle cartelle e supporto per cartelle annidate), salva facilmente le informazioni di accesso riutilizzabili e automatizza il deployment delle chiavi SSH.
+**Gestore host:**
+Salva e organizza gli host con etichette e cartelle annidate a cui puoi dare nome e colore. Riutilizza le credenziali salvate su piรน host, distribuisci le chiavi SSH in automatico, raggruppa gli host sotto un host padre, modifica ed esporta in blocco, e usa la connessione rapida per i collegamenti una tantum che non vuoi salvare.
-**Metriche Host:**
-Visualizza CPU, memoria, utilizzo del disco, rete, uptime, informazioni di sistema, firewall, monitoraggio porte, visualizzatore di log, utenti/permessi, certificati e molto altro, funzionanti sulla maggior parte dei server basati su Linux. Include grafici storici delle serie temporali e avvisi basati su soglie con supporto ntfy e webhook.
+**Metriche host:**
+CPU, memoria, disco, rete, temperatura, tempo di accensione, processi, porte, accessi e informazioni di sistema sulla maggior parte dei server Linux, con grafici storici. Le schede di gestione ti fanno seguire servizi, cron, pacchetti, utenti, regole del firewall, WireGuard, Tailscale, certificati SSL, log e controlli di stato senza uscire da Termix.
-**Autenticazione Utente:**
-Gestione utenti sicura con controlli amministrativi (puรฒ modificare le informazioni di altri utenti) e OIDC/LDAP/SSO (con controllo degli accessi), 2FA (TOTP) e supporto passkey (WebAuthn). Visualizza le sessioni utente attive su tutte le piattaforme e revoca i permessi. Collega i tuoi account OIDC/Locali tra loro. Visualizza il log di controllo delle azioni di tutti gli utenti.
+**Automazioni:**
+Scegli un evento che fa partire tutto, poi decidi cosa deve succedere. Gli eventi possono essere una metrica che supera una soglia, un host che cade o torna su, un controllo di stato che cambia, una pianificazione, un evento di un container o un webhook in arrivo. I passaggi possono eseguire comandi e frammenti, gestire container e tunnel, accendere un host, chiamare un URL, aspettare, seguire una condizione, avviare un'altra automazione e avvisarti via ntfy, Discord o webhook. Le prove a vuoto ti permettono di provare senza rischi.
-**Integrazione Tailscale:**
-Elenca i dispositivi della tua rete Tailscale per aggiungerli rapidamente come host, e connettiti utilizzando Tailscale SSH come metodo di autenticazione, lasciando che le ACL della tua rete gestiscano l'autorizzazione senza memorizzare credenziali.
+**Flotte:**
+Raggruppa gli host in una flotta scegliendoli o con regole sulle etichette, cosรฌ i nuovi host entrano da soli. Esegui un comando su tutti gli host in una volta, invia e recupera file su tutti quanti, installa pacchetti e raccogli un inventario di sistema operativo, kernel, architettura e tempo di accensione.
-**RBAC/Condivisione:**
-Crea ruoli e condividi host tra utenti/ruoli. Supporta tutti i tipi di autenticazione e tutti i protocolli host.
+**Assistente IA:**
+ร opzionale e resta spento finchรฉ non lo accendi tu. Collega OpenAI, Anthropic, Gemini, Ollama o qualsiasi endpoint compatibile con OpenAI e fai domande sulla tua installazione. Legge host, flotte, frammenti e avvisi, e propone modifiche da approvare invece di farle da solo. Non puรฒ mai toccare credenziali, utenti o impostazioni. Gli amministratori possono lasciarlo spento per tutta l'istanza, e tu puoi nasconderlo giร durante la configurazione.
-**Connessioni Seriali:**
-Connettiti a dispositivi seriali (router, switch, microcontrollori, ecc.) direttamente dal browser o dall'app desktop. Configura baud rate, bit di dati, bit di stop e paritร . Utilizza la Web Serial API nei browser supportati o un backend nativo nell'app Electron.
+**Accesso e utenti:**
+Account locali piรน accesso con OIDC, LDAP, GitHub e Google, con doppia autenticazione (TOTP), passkey (WebAuthn) e dispositivi fidati. Gli amministratori possono gestire gli utenti, collegare i gruppi OIDC ai ruoli, vedere tutte le sessioni attive su ogni piattaforma e revocarle. Collega il tuo account locale a quello OIDC e consulta il registro di controllo di quello che ha fatto ognuno.
+**Ruoli e condivisione:**
+Crea ruoli e condividi gli host con utenti o ruoli su quattro livelli: connessione, visualizzazione, modifica e gestione. Funziona con ogni tipo di autenticazione e ogni protocollo, e puoi cambiare le credenziali usate per un host condiviso.
+
+
+
+
+
+
**Avvisi:**
-Imposta regole di avviso basate su soglie per le metriche dell'host (CPU, memoria, disco, ecc.) e ricevi notifiche tramite ntfy o webhook quando si attivano. Visualizza gli avvisi attivi e risolti in un registro storico.
+Imposta regole sulle metriche degli host come CPU, memoria e disco, e ricevi una notifica via ntfy, Discord o webhook quando scattano. Guarda gli avvisi attivi e quelli rientrati in uno storico, e scarta quelli che non ti interessano.
+
+
+
+
+**Pagina iniziale:**
+Una griglia di widget che costruisci tu trascinandoli. Ci sono widget per stato degli host, ping, collegamenti ai servizi, segnalibri, ricerca, orologi, calendari, conti alla rovescia, note, RSS, meteo, immagini, iframe, Docker, tunnel, grafici delle metriche, API personalizzate e perfino un terminale dal vivo.
-**Homepage:**
-Una homepage completamente personalizzabile con una griglia di widget drag-and-drop. Aggiungi widget per lo stato dell'host, link ai servizi, orologi, note, feed RSS, meteo, container Docker, grafici delle metriche dell'host, terminali incorporati, iframe e altro ancora.
+**Frammenti e strumenti:**
+Salva i comandi che usi spesso e lanciali con un clic, con variabili per l'host e per quello che scrivi tu. Esegui uno stesso comando su tutti i terminali aperti e cerca nella cronologia con il completamento automatico.
-**Crittografia Database:**
-Il backend รจ archiviato come file di database SQLite crittografati. Consulta la [documentazione](https://docs.termix.site/security) per maggiori informazioni.
+**Condivisione sessione:**
+Condividi dal vivo una sessione di terminale, RDP, VNC o Telnet. Manda un link a cui chiunque puรฒ accedere senza account, oppure condividi con un utente Termix preciso, in sola lettura o anche in scrittura. Le condivisioni possono scadere da sole o essere revocate, e si possono spegnere per tutti o per singolo host.
-**Grafico di Rete:**
-Personalizza la tua Dashboard per visualizzare il tuo homelab basato sulle connessioni SSH con supporto dello stato.
+**Registrazione e log delle sessioni:**
+Registra le sessioni di terminale, RDP e VNC e riguardale dopo. Scarica i log di testo di una sessione e consulta il registro delle connessioni per vedere esattamente cosa รจ successo durante una connessione.
-**Strumenti SSH:**
-Crea snippet di comandi riutilizzabili che si eseguono con un singolo clic. Esegui un comando simultaneamente su piรน terminali aperti.
+**Connessioni seriali:**
+Parla con dispositivi seriali come router, switch e microcontrollori dal browser o dall'app desktop. Imposta velocitร , bit di dati, bit di stop e paritร . Usa l'API Web Serial nei browser compatibili, oppure un backend nativo nell'app desktop.
-**Schede Persistenti:**
-Le sessioni SSH e le schede rimangono aperte tra dispositivi/aggiornamenti se abilitato nel profilo utente.
+**Tailscale:**
+Prendi i dispositivi dalla tua tailnet per aggiungerli come host in pochi clic, e collegati con Tailscale SSH cosรฌ gli ACL della tailnet gestiscono l'accesso senza salvare credenziali. Funzionano anche Headscale e gli endpoint personalizzati.
+
+
+
+
+**Proxmox:**
+Importa gli host direttamente da un'istanza Proxmox e segui le statistiche di nodi e macchine ospiti, comprese CPU, memoria e spazio, in una scheda dedicata.
+
+
+
+
+
+
+**Spazi di lavoro e schede:**
+Salva un insieme di schede con la loro disposizione divisa e riapri tutto con un clic. Termix ricorda anche l'ultima sessione, cosรฌ le schede tornano dopo un ricaricamento e su altri dispositivi.
+
+
+
+
+**Configurazione guidata:**
+Una breve configurazione ti accompagna nella scelta di una preimpostazione dell'interfaccia, del tema, delle funzionalitร che vuoi e del primo host. La modalitร semplice nasconde quello che non usi, e puoi rifare la configurazione o cambiare preimpostazione quando vuoi.
+
+
+
+
+
+
+**Desktop autonomo e sincronizzazione:**
+L'app desktop funziona da sola, con backend e database locali, senza bisogno di un server. Puoi anche collegarla a un server Termix per sincronizzare nei due sensi host, credenziali, frammenti e altro, e scegliere se le connessioni partono dal tuo computer o passano dal server.
+
+
+
+
+**Riga di comando:**
+Una CLI `termix` per la tua shell e i tuoi script. Apri terminali, esegui un comando su un host o su un'intera flotta, sposta file via SFTP e gestisci host, frammenti e credenziali. Installala con `npm install -g @termix-cli/cli` oppure prendi un binario autonomo. Vedi la [documentazione della CLI](https://docs.termix.site/cli).
+
+
+
+
+
+
+**Sicurezza:**
+Password, chiavi e altri segreti sono cifrati per ogni utente, e gli stessi file del database possono essere cifrati su disco. Guarda la [documentazione](https://docs.termix.site/security) per capire come funziona.
**Lingue:**
-Supporto integrato per circa 30 lingue (gestito da [Crowdin](https://docs.termix.site/translations)).
+Circa 30 lingue incluse, gestite tramite [Crowdin](https://docs.termix.site/translations).
@@ -199,23 +255,26 @@ Supporto integrato per circa 30 lingue (gestito da [Crowdin](https://docs.termix
Altre funzionalitร
@@ -224,15 +283,15 @@ Supporto integrato per circa 30 lingue (gestito da [Crowdin](https://docs.termix
Web Qualsiasi browser moderno (Chrome, Safari, Firefox) ยท Supporto PWA
+Qualsiasi browser recente (Chrome, Safari, Firefox) ยท Supporto PWA
Windows x64/ia32 Portable ยท Installer MSI ยท Chocolatey
+Portatile ยท Installer MSI ยท Chocolatey
Linux x64/ia32 Portable ยท AUR ยท AppImage ยท Deb ยท Flatpak
+Portatile ยท AUR ยท AppImage ยท Deb ยท Flatpak
macOS x64/ia32, v12.0+
@@ -325,10 +410,6 @@ Interessato a un posizionamento a pagamento per supportare lo sviluppo? Scrivi a
-
-
-
@@ -340,14 +421,17 @@ Interessato a un posizionamento a pagamento per supportare lo sviluppo? Scrivi a
-
+
+
+
-Alcuni video e immagini potrebbero non essere aggiornati o potrebbero non mostrare perfettamente le funzionalitร .
+Alcuni video e immagini possono essere datati o non mostrare al meglio le funzionalitร .
Termix
-ใปใซใใในใๅ SSH ็ฎก็ใจใชใขใผใใในใฏใใใใขใฏใปใน
+SSH ใใชใขใผใใในใฏใใใใใ่ชๅๅใพใงใใปใซใใในใใฎใตใผใใผ็ฎก็
English ยท
@@ -37,7 +37,7 @@
2025ๅนด9ๆ1ๆฅใซ้ๆ
+ 2025ๅนด9ๆ1ๆฅ ้ๆ
@@ -58,7 +58,7 @@ Termix ใฏ็กๆใฎใชใผใใณใฝใผในใใญใธใงใฏใใงใใไพฟๅฉใ ใจ
## ๆฆ่ฆ
-Termixใฏใใชใผใใณใฝใผในใงๆฐธไน
็กๆใฎใปใซใใในใๅใชใผใซใคใณใฏใณใตใผใใผ็ฎก็ใใฉใใใใฉใผใ ใงใใๅไธใฎ็ดๆ็ใชใคใณใฟใผใใงใผในใ้ใใฆใใตใผใใผใจใคใณใใฉในใใฉใฏใใฃใ็ฎก็ใใใใซใใใฉใใใใฉใผใ ใฝใชใฅใผใทใงใณใๆไพใใพใใTermixใฏใSSHใฟใผใใใซใขใฏใปในใใชใขใผใใในใฏใใใๅถๅพก๏ผRDPใVNCใTelnet๏ผใSSHใใณใใชใณใฐๆฉ่ฝใใชใขใผใใใกใคใซ็ฎก็ใใใใณใใฎไปๅคใใฎใใผใซใๆไพใใพใใTermixใฏใใในใฆใฎใใฉใใใใฉใผใ ใงๅฉ็จๅฏ่ฝใชTermiusใฎๅฎๅ
จ็กๆใงใปใซใใในใๅฏ่ฝใชไปฃๆฟใฝใชใฅใผใทใงใณใงใใ
+Termix ใฏ็กๆใงใชใผใใณใฝใผในใฎใใปใซใใในใๅใตใผใใผ็ฎก็ใใฉใใใใฉใผใ ใงใใSSH ใฟใผใใใซใใชใขใผใใในใฏใใใ๏ผRDPใVNCใTelnet๏ผใใใกใคใซ่ปข้ใใใณใใซใDockerใใกใใชใฏในใ่ชๅๅใใฒใจใคใซใพใจใใใฆใงใใใในใฏใใใใใขใใคใซใงไฝฟใใพใใใใฃใจ็กๆใงไฝฟใใใใปใซใใในใ็ใฎ Termius ไปฃๆฟใงใใ
-**SSHใฟใผใใใซใขใฏใปใน:**
-ใใฉใฆใถ้ขจใฟใใทในใใ ใซใใๅๅฒ็ป้ขๅฏพๅฟ๏ผๆๅคง4ใใใซ๏ผใฎใใซๆฉ่ฝใฟใผใใใซใไธ่ฌ็ใชใฟใผใใใซใใผใใใใฉใณใใใใฎไปใฎใณใณใใผใใณใใๅซใใฟใผใใใซใซในใฟใใคใบใซๅฏพๅฟใใฆใใพใใ
+**SSH ใฟใผใใใซ:**
+ใใฉใฆใถใฎใใใชใฟใใจๅๅฒ็ป้ขใๅใใๆฌๆ ผ็ใชใฟใผใใใซใงใๆๅคง 6 ๅๅฒใพใงๅๆใซ่กจ็คบใงใใพใใใใผใใใใฉใณใใ้
่ฒใฏ่ช็ฑใซ้ธในใพใใๅใปใใทใงใณใฎไธใฎใใผใซใใผใซใฏ CPUใใกใขใชใใใฃในใฏใฎ็ถๆณใใชใขใซใฟใคใ ใง่กจ็คบใใใใใฎใในใใฎใใกใคใซใDockerใใใณใใซใใกใใชใฏในใธใใ็งปๅใงใใพใใ
-**ใชใขใผใใในใฏใใใใขใฏใปใน:**
-ใใฉใฆใถไธใงRDPใVNCใTelnetใใตใใผใใๅฎๅ
จใชใซในใฟใใคใบใจๅๅฒ็ป้ขใซๅฏพๅฟใใฆใใพใใ
+**ใชใขใผใใในใฏใใใ:**
+RDPใVNCใTelnet ใใใฉใฆใถใใๅฉ็จใงใใไปใฎใปใใทใงใณใจๅใใใใซใฟใใๅๅฒ็ป้ขใงๆฑใใพใใRDP ใใฉใคใ็จใฎใใกใคใซใใฉใฆใถใจใใฉใใฐ๏ผใใญใใใฎใขใใใญใผใใไฝฟใใพใใWindows ใฎใในใฏใใใ็ใงใฏใใในใใใใคใใฃใใฎ RDP ใฏใฉใคใขใณใใง้ใใใจใใงใใพใใ
-**SSHใใณใใซ็ฎก็:**
-่ชๅๅๆฅ็ถใจใใซในใขใใฟใชใณใฐใใญใผใซใซใปใชใขใผใใปใใคใใใใฏSOCKSใใฉใฏใผใใฃใณใฐใๅใใใตใผใใผ้SSHใใณใใซใฎไฝๆใป็ฎก็ใๅฏ่ฝใงใใใในใฏใใใใฏใฉใคใขใณใๅฏพใตใผใใผใฎใใณใใซ่จญๅฎใฏใในใฏใใใใคใณในใใผใซใใจใซใญใผใซใซใซไฟๅญใใใใชใใทใงใณใฎC2Sใใชใปใใในใใใใทใงใใใใตใผใใผใซไฟๅญใปๅๅๅคๆดใป่ชญใฟ่พผใฟใปๅ้คใใฆใฏใฉใคใขใณใ้ใงใญใผใซใซใใณใใซ่จญๅฎใ็งปๅใงใใพใใ
+**SSH ใใณใใซ:**
+ใญใผใซใซใใชใขใผใใใใคใใใใฏ SOCKS ใฎ่ปข้ใซๅฏพๅฟใใ่ชๅๅๆฅ็ถใจใใซในใใงใใฏใไปใใฆใใพใใใในใฏใใใ็ใฎใฏใฉใคใขใณใ้ใใณใใซใฏใใฎ็ซฏๆซใซไฟๅญใใใใใชใปใใใใตใผใใผใซไฟๅญใใฆใใใฐๅฅใฎ็ซฏๆซใซ่จญๅฎใ็งปใใพใใ
-**ใชใขใผใใใกใคใซใใใผใธใฃใผ:**
-ใณใผใใ็ปๅใ้ณๅฃฐใๅ็ปใฎ่กจ็คบใป็ทจ้ใซๅฏพๅฟใใใชใขใผใใตใผใใผไธใฎใใกใคใซใ็ดๆฅ็ฎก็ใงใใพใใsudoๅฏพๅฟใงใใกใคใซใฎใขใใใญใผใใใใฆใณใญใผใใๅๅๅคๆดใๅ้คใ็งปๅใใทใผใ ใฌในใซๅฎ่กใงใใพใใใตใผใใผ้ใงใฎใใกใคใซ็งปๅใซใๅฏพๅฟใใฆใใพใใ
+**ใใกใคใซใใใผใธใฃใผ:**
+SFTP ใงใใกใคใซใฎ้ฒ่ฆงใ็ทจ้ใใขใใใญใผใใใใฆใณใญใผใใๅๅๅคๆดใ็งปๅใๅ้คใใงใใsudo ใซใๅฏพๅฟใใฆใใพใใใณใผใใ็ปๅใ้ณๅฃฐใๅ็ปใ่กจ็คบใป็ทจ้ใงใใพใใใตใผใใผ้ใง็ดๆฅใใกใคใซใใณใใผใงใใๆ้ใฎ็ต่ทฏใ่ชๅใง้ธใฐใใ่ปข้ใฎๆดๅๆงใๆค่จผใใใพใใ
-**DockerใใใณPodman็ฎก็:**
-ใณใณใใใฎ่ตทๅใๅๆญขใไธๆๅๆญขใๅ้คใใณใณใใใฎ็ตฑ่จๆ
ๅ ฑใ่กจ็คบใdocker execใฟใผใใใซใงใณใณใใใๆไฝใDockerใจPodmanใฎไธกๆนใใณใณใใใฉใณใฟใคใ ใจใใฆใตใใผใใใฆใใพใใPortainerใDockgeใฎไปฃๆฟใงใฏใชใใใณใณใใใฎไฝๆใใใ็ฐกๆ็ใช็ฎก็ใ็ฎ็ใจใใฆใใพใใ
+**Docker ใจ Podman:**
+ใณใณใใใฎ่ตทๅใๅๆญขใไธๆๅๆญขใๅ้คใใงใใ็ถๆ
ใ็ขบ่ชใใใใไธญใงใทใงใซใ้ใใใใงใใพใใDocker ใจ Podman ใฎใฉใกใใงใๅใใพใใPortainer ใ Dockge ใ็ฝฎใๆใใใใใฎใใฎใงใฏใชใใใใงใซใใใณใณใใใๆฑใใใใฎใใฎใงใใ
-**SSHใในใใใใผใธใฃใผ:**
-ใฟใฐใใใฉใซใ๏ผใใฉใซใใฎใซในใฟใใคใบใจใในใใใฉใซใๅฏพๅฟ๏ผใงSSHๆฅ็ถใไฟๅญใๆด็ใ็ฎก็ใใๅๅฉ็จๅฏ่ฝใชใญใฐใคใณๆ
ๅ ฑใ็ฐกๅใซไฟๅญใใชใใSSHใญใผใฎใใใญใคใ่ชๅๅใงใใพใใ
+**ใในใ็ฎก็:**
+ใฟใฐใจใๅๅใ่ฒใไปใใใใๅ
ฅใๅญใฎใใฉใซใใงใในใใๆด็ใงใใพใใไฟๅญใใ่ช่จผๆ
ๅ ฑใ่คๆฐใฎใในใใงไฝฟใๅใใSSH ้ตใ่ชๅใง้
ๅธใใใในใใ่ฆชใในใใฎไธใซใพใจใใไธๆฌ็ทจ้ใใจใฏในใใผใใใงใใพใใไฟๅญใใใใชใไธๅบฆใใใฎๆฅ็ถใซใฏใฏใคใใฏๆฅ็ถใไฝฟใใพใใ
@@ -111,83 +111,139 @@ Termixใฏใใชใผใใณใฝใผในใงๆฐธไน
็กๆใฎใปใซใใในใๅใชใผ
**ใในใใกใใชใฏใน:**
-ใปใจใใฉใฎLinuxใใผในใฎใตใผใใผใงใCPUใใกใขใชใใใฃในใฏไฝฟ็จ้ใใใใใฏใผใฏใใขใใใฟใคใ ใใทในใใ ๆ
ๅ ฑใใใกใคใขใฆใฉใผใซใใใผใใขใใฟใผใใญใฐใใฅใผใขใใฆใผใถใผ/ๆจฉ้ใ่จผๆๆธใชใฉใใใใซๅคใใฎๆ
ๅ ฑใ่กจ็คบใงใใพใใๆ็ณปๅใฎๅฑฅๆญดใฐใฉใใจใntfyใใใณwebhookใซๅฏพๅฟใใใใใๅคใใผในใฎใขใฉใผใใๅซใฟใพใใ
+ใใใฆใใฎ Linux ใตใผใใผใง CPUใใกใขใชใใใฃในใฏใใใใใฏใผใฏใๆธฉๅบฆใ็จผๅๆ้ใใใญใปในใใใผใใใญใฐใคใณใใทในใใ ๆ
ๅ ฑใๅฑฅๆญดใฐใฉใไปใใง็ขบ่ชใงใใพใใใใใผใธใฃใผใซใผใใไฝฟใใฐใใตใผใในใcronใใใใฑใผใธใใฆใผใถใผใใใกใคใขใฆใฉใผใซใWireGuardใTailscaleใSSL ่จผๆๆธใใญใฐใใใซในใใงใใฏใ Termix ใใ้ขใใใซๆฑใใพใใ
-**ใฆใผใถใผ่ช่จผ:**
-็ฎก็่
ใณใณใใญใผใซ๏ผไปใฎใฆใผใถใผๆ
ๅ ฑใ็ทจ้ๅฏ่ฝ๏ผใจOIDC/LDAP/SSO๏ผใขใฏใปในๅถๅพกไปใ๏ผใ2FA๏ผTOTP๏ผใใในใญใผ๏ผWebAuthn๏ผๅฏพๅฟใซใใๅฎๅ
จใชใฆใผใถใผ็ฎก็ใใในใฆใฎใใฉใใใใฉใผใ ใงใขใฏใใฃใใชใฆใผใถใผใปใใทใงใณใ่กจ็คบใใๆจฉ้ใๅใๆถใๅฏ่ฝใOIDC/ใญใผใซใซใขใซใฆใณใใฎ้ฃๆบใๅฏ่ฝใงใใใในใฆใฎใฆใผใถใผๆไฝใฎ็ฃๆปใญใฐใ่กจ็คบใงใใพใใ
+**่ชๅๅ:**
+ใใฃใใใ้ธใใงใไฝใใใใใๆฑบใใใ ใใงใใใใฃใใใซใฏใใกใใชใฏในใใใใๅคใ่ถ
ใใใจใใใในใใไธใใฃใใ่ฝใกใใใใใจใใใใซในใใงใใฏใฎ็ถๆ
ใๅคใใฃใใจใใในใฑใธใฅใผใซใใณใณใใใฎใคใใณใใๅค้จใใใฎ Webhook ใใใใพใใในใใใใงใฏใณใใณใใในใใใใใฎๅฎ่กใใณใณใใใใใณใใซใฎๆไฝใใในใใฎ่ตทๅใURL ใฎๅผใณๅบใใๅพ
ๆฉใๆกไปถๅๅฒใๅฅใฎ่ชๅๅใฎๅฎ่กใใงใใntfyใDiscordใWebhook ใง้็ฅใงใใพใใใในใๅฎ่กใงๅฎๅ
จใซ่ฉฆใใพใใ
-**Tailscaleใคใณใใฐใฌใผใทใงใณ:**
-Tailnetใฎใใใคในใใชในใใใฆใในใใจใใฆใใฐใใ่ฟฝๅ ใใTailscale SSHใ่ช่จผๆนๆณใจใใฆไฝฟ็จใใฆๆฅ็ถใใพใใใใใซใใใTailnetใฎACLใ่ช่จผๆ
ๅ ฑใไฟๅญใใใซ่ชๅฏใๅฆ็ใใพใใ
+**ใใชใผใ:**
+ใในใใ้ธใถใใใฟใฐใฎใซใผใซใๆฑบใใฆใใชใผใใซใพใจใใใจใๆฐใใใในใใฏ่ชๅใงๅ
ฅใใพใใใในใฆใฎใในใใงๅใใณใใณใใไธๅบฆใซๅฎ่กใใๅ
จๅฐใซใใกใคใซใ้
ใฃใใ้ใใใใใใใฑใผใธใๅ
ฅใใใใOSใใซใผใใซใใขใผใญใใฏใใฃใ็จผๅๆ้ใฎไธ่ฆงใ้ใใใใพใใ
-**RBAC/ๅ
ฑๆ:**
-ใญใผใซใไฝๆใใใฆใผใถใผ/ใญใผใซ้ใงใในใใๅ
ฑๆใงใใพใใใในใฆใฎ่ช่จผใฟใคใใจใในใฆใฎใในใใใญใใณใซใซๅฏพๅฟใใฆใใพใใ
+**AI ใขใทในใฟใณใ:**
+ไปปๆใฎๆฉ่ฝใงใ่ชๅใงๆๅนใซใใใพใงใฏๅใใพใใใOpenAIใAnthropicใGeminiใOllamaใใพใใฏ OpenAI ไบๆใฎใจใณใใใคใณใใซใคใชใใงใ่ชๅใฎ็ฐๅขใซใคใใฆ่ณชๅใงใใพใใใในใใใใชใผใใในใใใใใใขใฉใผใใ่ชญใฟๅใใพใใใๅคๆดใฏ่ชๅใง่กใใใๆฟ่ชใใฆใใใใใใฎๆๆกใจใใฆๅบใใพใใ่ช่จผๆ
ๅ ฑใใฆใผใถใผใ่จญๅฎใซใฏๆฑบใใฆ่งฆใใใใพใใใ็ฎก็่
ใฏใคใณในใฟใณในๅ
จไฝใง็กๅนใซใงใใๅๆ่จญๅฎใง้่กจ็คบใซใใใใจใใงใใพใใ
-**ใทใชใขใซๆฅ็ถ:**
-ใใฉใฆใถใพใใฏใในใฏใใใใขใใชใใใทใชใขใซใใใคใน๏ผใซใผใฟใผใในใคใใใใใคใฏใญใณใณใใญใผใฉใผใชใฉ๏ผใซ็ดๆฅๆฅ็ถใงใใพใใใใผใฌใผใใใใผใฟใใใใในใใใใใใใใใชใใฃใ่จญๅฎใงใใพใใๅฏพๅฟใใฉใฆใถใงใฏWeb Serial APIใไฝฟ็จใใElectronใขใใชใงใฏใใคใใฃใใใใฏใจใณใใไฝฟ็จใใพใใ
+**ใญใฐใคใณใจใฆใผใถใผ:**
+ใญใผใซใซใขใซใฆใณใใซๅ ใใฆ OIDCใLDAPใGitHubใGoogle ใงใฎใตใคใณใคใณใซๅฏพๅฟใใ2 ่ฆ็ด ่ช่จผ๏ผTOTP๏ผใใในใญใผ๏ผWebAuthn๏ผใไฟก้ ผๆธใฟใใใคในใไฝฟใใพใใ็ฎก็่
ใฏใฆใผใถใผใฎ็ฎก็ใOIDC ใฐใซใผใใจใญใผใซใฎๅฏพๅฟไปใใๅ
จใใฉใใใใฉใผใ ใฎใขใฏใใฃใใชใปใใทใงใณใฎ็ขบ่ชใจๅคฑๅนใใงใใพใใใญใผใซใซใจ OIDC ใฎใขใซใฆใณใใ้ฃๆบใงใใ่ชฐใไฝใใใใใฏ็ฃๆปใญใฐใง็ขบ่ชใงใใพใใ
+**ใญใผใซใจๅ
ฑๆ:**
+ใญใผใซใไฝใใๆฅ็ถใ้ฒ่ฆงใ็ทจ้ใ็ฎก็ใจใใ 4 ๆฎต้ใงใในใใใฆใผใถใผใใญใผใซใซๅ
ฑๆใงใใพใใใในใฆใฎ่ช่จผๆนๅผใจใในใฆใฎใใญใใณใซใงไฝฟใใๅ
ฑๆใใใในใใงไฝฟใ่ช่จผๆ
ๅ ฑใไธๆธใใใใใจใใงใใพใใ
+
+
+
+
+
+
**ใขใฉใผใ:**
-ใในใใกใใชใฏใน๏ผCPUใใกใขใชใใใฃในใฏใชใฉ๏ผใซๅฏพใใฆใใใๅคใใผในใฎใขใฉใผใใซใผใซใ่จญๅฎใใ็บๅๆใซntfyใพใใฏwebhookใง้็ฅใๅใๅใใพใใ็บๅไธญใใใณ่งฃๆฑบๆธใฟใฎใขใฉใผใใๅฑฅๆญดใญใฐใง็ขบ่ชใงใใพใใ
+CPUใใกใขใชใใใฃในใฏใชใฉใฎใในใใกใใชใฏในใซใซใผใซใ่จญๅฎใใ็บๅ ฑใใใ ntfyใDiscordใWebhook ใง้็ฅใๅใๅใใพใใ็บๅ ฑไธญใจ่งฃๆถๆธใฟใฎใขใฉใผใใฏๅฑฅๆญดใง็ขบ่ชใงใใๆฐใซใใชใใใฎใฏๆถใใฆใใใพใใ
-
-
**ใใผใ ใใผใธ:**
-ใใฉใใฐ๏ผใใญใใใฎใฆใฃใธใงใใใฐใชใใใๅใใๅฎๅ
จใซในใฟใใคใบๅฏ่ฝใชใใผใ ใใผใธใใในใในใใผใฟในใใตใผใในใชใณใฏใๆ่จใใกใขใRSSใใฃใผใใๅคฉๆฐใDockerใณใณใใใใในใใกใใชใฏในใฐใฉใใๅใ่พผใฟใฟใผใใใซใiframeใชใฉใฎใฆใฃใธใงใใใ่ฟฝๅ ใงใใพใใ
-
-
-
-
-**ใใผใฟใใผในๆๅทๅ:**
-ใใใฏใจใณใใฏๆๅทๅใใใSQLiteใใผใฟใใผในใใกใคใซใจใใฆไฟๅญใใใพใใ่ฉณ็ดฐใฏ[ใใญใฅใกใณใ](https://docs.termix.site/security)ใใ่ฆงใใ ใใใ
+่ชๅใง็ตใฟ็ซใฆใใใฉใใฐ๏ผใใญใใใฎใฆใฃใธใงใใ็ป้ขใงใใใในใใฎ็ถๆ
ใPingใใตใผใในใชใณใฏใใใใฏใใผใฏใๆค็ดขใๆ่จใใซใฌใณใใผใใซใฆใณใใใฆใณใใกใขใRSSใๅคฉๆฐใ็ปๅใiframeใDockerใใใณใใซใใกใใชใฏในใฎใฐใฉใใ็ฌ่ช APIใใใใซใฏใฉใคใใฎใฟใผใใใซใพใงใฆใฃใธใงใใใจใใฆ็ฝฎใใพใใ
-**ใใใใฏใผใฏใฐใฉใ:**
-ใใใทใฅใใผใใใซในใฟใใคใบใใฆใSSHๆฅ็ถใซๅบใฅใใใผใ ใฉใใฎใใใใฏใผใฏใในใใผใฟใน่กจ็คบไปใใงๅฏ่ฆๅใงใใพใใ
+**ในใใใใใจใใผใซ:**
+ใใไฝฟใใณใใณใใไฟๅญใใฆใใฏใณใฏใชใใฏใงๅฎ่กใงใใพใใใในใใฎๅคใ่ชๅใงๅ
ฅๅใใๅคใๅคๆฐใจใใฆไฝฟใใพใใ้ใใฆใใใในใฆใฎใฟใผใใใซใงๅใใณใใณใใใพใจใใฆๅฎ่กใงใใใณใใณใๅฑฅๆญดใ่ฃๅฎไปใใงๆค็ดขใงใใพใใ
-**SSHใใผใซ:**
-ใฏใณใฏใชใใฏใงๅฎ่กใงใใๅๅฉ็จๅฏ่ฝใชใณใใณใในใใใใใฎไฝๆใ่คๆฐใฎ้ใใฆใใใฟใผใใใซใซๅฏพใใฆๅๆใซใณใใณใใๅฎ่กใงใใพใใ
+**ใปใใทใงใณๅ
ฑๆ:**
+ใฟใผใใใซใRDPใVNCใTelnet ใฎใปใใทใงใณใใชใขใซใฟใคใ ใงๅ
ฑๆใงใใพใใใขใซใฆใณใใชใใงๅๅ ใงใใใชใณใฏใ้ใใใ็นๅฎใฎ Termix ใฆใผใถใผใจๅ
ฑๆใใ้ฒ่ฆงใฎใฟใๆไฝๅฏ่ฝใใ้ธในใพใใๅ
ฑๆใฏ่ชๅใงๆ้ๅใใซใใใใคใงใๅใๆถใใซใใงใใๅ
จไฝใพใใฏใในใใใจใซใชใใซใงใใพใใ
-**ๆฐธ็ถใฟใ:**
-ใฆใผใถใผใใญใใฃใผใซใงๆๅนใซใใใจใSSHใปใใทใงใณใจใฟใใใใใคใน/ๆดๆฐใใพใใใง้ใใใพใพไฟๆใใใพใใ
+**ใปใใทใงใณ้ฒ็ปใจใญใฐ:**
+ใฟใผใใใซใRDPใVNC ใฎใปใใทใงใณใ้ฒ็ปใใฆใใใจใใๅ็ใงใใพใใใปใใทใงใณใฎใใญในใใญใฐใใใฆใณใญใผใใงใใๆฅ็ถใญใฐใ่ฆใใฐๆฅ็ถไธญใซไฝใ่ตทใใใใใใฎใพใพๅใใใพใใ
+
+
+
+
+**ใทใชใขใซๆฅ็ถ:**
+ใซใผใฟใผใในใคใใใใใคใณใณใชใฉใฎใทใชใขใซๆฉๅจใซใใใฉใฆใถใใในใฏใใใใขใใชใใๆฅ็ถใงใใพใใใใผใฌใผใใใใผใฟใใใใในใใใใใใใใใชใใฃใ่จญๅฎใงใใพใใๅฏพๅฟใใฉใฆใถใงใฏ Web Serial API ใใใในใฏใใใใขใใชใงใฏใใคใใฃใใฎใใใฏใจใณใใไฝฟใใพใใ
+
+
+
+
+
+
+**Tailscale:**
+tailnet ใใ็ซฏๆซใๅใ่พผใใงๆฐใฏใชใใฏใงใในใใจใใฆ่ฟฝๅ ใงใใTailscale SSH ใงๆฅ็ถใใใฐใขใฏใปในๅถๅพกใฏ tailnet ใฎ ACL ใซไปปใใใใ่ช่จผๆ
ๅ ฑใไฟๅญใใๅฟ
่ฆใใใใพใใใHeadscale ใ็ฌ่ชใฎใจใณใใใคใณใใซใๅฏพๅฟใใฆใใพใใ
+
+
+
+
+**Proxmox:**
+Proxmox ใฎใคใณในใฟใณในใใใใฎใพใพใในใใๅใ่พผใใพใใใใผใใใฒในใใฎ CPUใใกใขใชใในใใฌใผใธใชใฉใฎ็ถๆ
ใๅฐ็จใฎใฟใใง็ขบ่ชใงใใพใใ
+
+
+
+
+
+
+**ใฏใผใฏในใใผในใจใฟใ:**
+ใฟใใจๅๅฒใฌใคใขใฆใใฎใปใใใไฟๅญใใฆใใฏใณใฏใชใใฏใงใพใใใจ้ใ็ดใใพใใTermix ใฏๅๅใฎใปใใทใงใณใ่ฆใใฆใใใฎใงใๅ่ชญใฟ่พผใฟใใฆใ็ซฏๆซใๅคใใฆใใฟใใฏๆปใฃใฆใใพใใ
+
+
+
+
+**ใฌใคใไปใใปใใใขใใ:**
+็ญใใปใใใขใใใใ็ป้ขใฎใใชใปใใใใใผใใไฝฟใใใๆฉ่ฝใๆๅใฎใในใใฎ้ธๆใๆกๅ
ใใพใใใทใณใใซใขใผใใฏไฝฟใใชใใใฎใ้ ใใฆใใใพใใใปใใใขใใใฏใใคใงใใใ็ดใใพใใใใใชใปใใใๅใๆฟใใใใพใใ
+
+
+
+
+
+
+**ใในใฏใใใๅไฝๅฉ็จใจๅๆ:**
+ใในใฏใใใใขใใชใฏใญใผใซใซใฎใใใฏใจใณใใจใใผใฟใใผในใๆใกใใตใผใใผใชใใงๅไฝใงๅใใพใใTermix ใตใผใใผใซใคใชใใฐใใในใใ่ช่จผๆ
ๅ ฑใในใใใใใชใฉใๅๆนๅใงๅๆใงใใๆฅ็ถใใญใผใซใซใใๅงใใใใตใผใใผ็ต็ฑใซใใใใ้ธในใพใใ
+
+
+
+
+**ใณใใณใใฉใคใณใใผใซ:**
+ใทใงใซใในใฏใชใใใใไฝฟใใ `termix` CLI ใงใใใฟใผใใใซใ้ใใใในใ 1 ๅฐใพใใฏใใชใผใๅ
จไฝใงใณใใณใใๅฎ่กใใSFTP ใงใใกใคใซใ็งปๅใใใในใใในใใใใใ่ช่จผๆ
ๅ ฑใ็ฎก็ใงใใพใใ`npm install -g @termix-cli/cli` ใงๅ
ฅใใใใๅไฝใฎใใคใใชใไฝฟใฃใฆใใ ใใใ่ฉณใใใฏ [CLI ใใญใฅใกใณใ](https://docs.termix.site/cli)ใใ่ฆงใใ ใใใ
+
+
+
+
+
+
+**ใปใญใฅใชใใฃ:**
+ใในใฏใผใใ้ตใชใฉใฎ็งๅฏๆ
ๅ ฑใฏใฆใผใถใผใใจใซๆๅทๅใใใใใผใฟใใผในใฎใใกใคใซ่ชไฝใใใฃในใฏไธใงๆๅทๅใงใใพใใไป็ตใฟใฏ[ใใญใฅใกใณใ](https://docs.termix.site/security)ใใ่ฆงใใ ใใใ
**ๅค่จ่ชๅฏพๅฟ:**
-็ด30่จ่ชใฎ็ตใฟ่พผใฟใตใใผใ๏ผ[Crowdin](https://docs.termix.site/translations)ใง็ฎก็ใใใฆใใพใ๏ผใ
+็ด 30 ่จ่ชใซๅฏพๅฟใใฆใใใ[Crowdin](https://docs.termix.site/translations) ใง็ฎก็ใใฆใใพใใ
@@ -199,17 +255,20 @@ Tailnetใฎใใใคในใใชในใใใฆใในใใจใใฆใใฐใใ่ฟฝๅ ใ
ใใฎไปใฎๆฉ่ฝ
Web ใใใใๆๆฐใใฉใฆใถ๏ผChromeใSafariใFirefox๏ผยท PWAๅฏพๅฟ
+ๆ่ฟใฎใใฉใฆใถๅ
จ่ฌ๏ผChromeใSafariใFirefox๏ผยท PWA ๅฏพๅฟ
Windows x64/ia32 ใใผใฟใใซ็ ยท MSIใคใณในใใผใฉใผ ยท Chocolatey
+ใใผใฟใใซ ยท MSI ใคใณในใใผใฉใผ ยท Chocolatey
Linux x64/ia32 ใใผใฟใใซ็ ยท AUR ยท AppImage ยท Deb ยท Flatpak
+ใใผใฟใใซ ยท AUR ยท AppImage ยท Deb ยท Flatpak
macOS x64/ia32, v12.0+
@@ -325,10 +410,6 @@ Termixใฏ็กๆใฎใชใผใใณใฝใผในใใญใธใงใฏใใงใใใใตใใน
-
-
-
@@ -340,14 +421,17 @@ Termixใฏ็กๆใฎใชใผใใณใฝใผในใใญใธใงใฏใใงใใใใตใใน
-
+
+
+
YouTubeใงใขใใใใผใใฎๆฆ่ฆใ่ฆ่ดใใ
+YouTube ใงใขใใใใผใใฎ็ดนไปใ่ฆใ
-ๅ็ปใ็ปๅใฎไธ้จใฏๆๆฐใงใฏใชใๅ ดๅใใๆฉ่ฝใๅฎๅ
จใซ็ดนไปใงใใฆใใชใๅ ดๅใใใใพใใ
+ๅ็ปใ็ปๅใฏๅคใใชใฃใฆใใใใๆฉ่ฝใๅๅใซไผใใใใฆใใชใๅ ดๅใใใใพใใ
@@ -407,10 +491,10 @@ Termixใซ้ขใใใใซใใๆฉ่ฝใชใฏใจในใใๅฟ
่ฆใชๅ ดๅใฏใ[Issu
## ไบๅฎใใใฆใใๆฉ่ฝ
-ใในใฆใฎไบๅฎๆฉ่ฝใซใคใใฆใฏ[Projects](https://github.com/orgs/Termix-SSH/projects/5)ใใ่ฆงใใ ใใใใณใณใใชใใฅใผใใใๅธๆใฎๆนใฏ[Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)ใใ่ฆงใใ ใใใ
+ไบๅฎใใใฆใใๆฉ่ฝใฏใในใฆ [Projects](https://github.com/orgs/Termix-SSH/projects/5) ใซใใใพใใ่ฒข็ฎใใ่ใใฎๆนใฏ[ใณใณใใชใใฅใผใทใงใณใฌใคใ](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)ใใ่ฆงใใ ใใใ
Termix
-์
ํ ํธ์คํ
SSH ๊ด๋ฆฌ ๋ฐ ์๊ฒฉ ๋ฐ์คํฌํฑ ์ก์ธ์ค
+SSH์ ์๊ฒฉ ๋ฐ์คํฌํฑ๋ถํฐ ์๋ํ๊น์ง, ์
ํ ํธ์คํ
์๋ฒ ๊ด๋ฆฌ
English ยท
@@ -37,7 +37,7 @@
-**SSH ํฐ๋ฏธ๋ ์ ์:**
-๋ธ๋ผ์ฐ์ ์คํ์ผ ํญ ์์คํ
๊ณผ ๋ถํ ํ๋ฉด ์ง์(์ต๋ 4๊ฐ ํจ๋)์ ๊ฐ์ถ ์์ ํ ๊ธฐ๋ฅ์ ํฐ๋ฏธ๋. ์ผ๋ฐ ํฐ๋ฏธ๋ ํ
๋ง, ๊ธ๊ผด ๋ฐ ๊ธฐํ ๊ตฌ์ฑ ์์๋ฅผ ํฌํจํ ํฐ๋ฏธ๋ ์ฌ์ฉ์ ์ ์ ์ง์.
+**SSH ํฐ๋ฏธ๋:**
+๋ธ๋ผ์ฐ์ ๊ฐ์ ํญ๊ณผ ๋ถํ ํ๋ฉด์ ๊ฐ์ถ ์ ๋๋ก ๋ ํฐ๋ฏธ๋๋ก, ํ ๋ฒ์ ์ต๋ 6๊ฐ ํจ๋๊น์ง ๋์ธ ์ ์์ต๋๋ค. ํ
๋ง์ ๊ธ๊ผด, ์์ ๊ณจ๋ผ ์ธ ์ ์์ต๋๋ค. ๊ฐ ์ธ์
์์ ํด๋ฐ์๋ CPU, ๋ฉ๋ชจ๋ฆฌ, ๋์คํฌ๊ฐ ์ค์๊ฐ์ผ๋ก ํ์๋๊ณ , ํด๋น ํธ์คํธ์ ํ์ผ๊ณผ Docker, ํฐ๋, ์งํ๋ก ๋ฐ๋ก ๊ฐ ์ ์์ต๋๋ค.
-**์๊ฒฉ ๋ฐ์คํฌํฑ ์ ์:**
-์์ ํ ์ฌ์ฉ์ ์ ์์ ๋ถํ ํ๋ฉด์ ์ง์ํ๋ ๋ธ๋ผ์ฐ์ ๊ธฐ๋ฐ RDP, VNC, Telnet ์ง์.
+**์๊ฒฉ ๋ฐ์คํฌํฑ:**
+๋ธ๋ผ์ฐ์ ์์ RDP์ VNC, Telnet์ ์ธ ์ ์๊ณ ๋ค๋ฅธ ์ธ์
๊ณผ ๋๊ฐ์ด ํญ๊ณผ ๋ถํ ํ๋ฉด์ผ๋ก ๋ค๋ฃฐ ์ ์์ต๋๋ค. RDP ๋๋ผ์ด๋ธ์ฉ ํ์ผ ๋ธ๋ผ์ฐ์ ์ ๋์ด๋ค ๋๊ธฐ ์
๋ก๋๋ ์์ต๋๋ค. Windows ๋ฐ์คํฌํฑ์์๋ ํธ์คํธ๋ฅผ ๊ธฐ๋ณธ RDP ํด๋ผ์ด์ธํธ๋ก ์ด ์๋ ์์ต๋๋ค.
-**SSH ํฐ๋ ๊ด๋ฆฌ:**
-์๋ ์ฌ์ฐ๊ฒฐ, ์ํ ๋ชจ๋ํฐ๋ง, ๋ก์ปฌยท์๊ฒฉยท๋์ SOCKS ํฌ์๋ฉ์ ์ง์ํ๋ ์๋ฒ ๊ฐ SSH ํฐ๋ ์์ฑ ๋ฐ ๊ด๋ฆฌ. ๋ฐ์คํฌํฑ ํด๋ผ์ด์ธํธ-์๋ฒ ํฐ๋ ์ค์ ์ ๋ฐ์คํฌํฑ ์ค์น๋ณ๋ก ๋ก์ปฌ์ ์ ์ฅ๋๋ฉฐ, ์ ํ์ C2S ์ฌ์ ์ค์ ์ค๋
์ท์ ์๋ฒ์ ์ ์ฅยท์ด๋ฆ ๋ณ๊ฒฝยท๋ถ๋ฌ์ค๊ธฐยท์ญ์ ํ์ฌ ํด๋ผ์ด์ธํธ ๊ฐ ๋ก์ปฌ ํฐ๋ ๊ตฌ์ฑ์ ์ด๋ํ ์ ์์ต๋๋ค.
+**SSH ํฐ๋:**
+๋ก์ปฌ๊ณผ ์๊ฒฉ, ๋์ SOCKS ํฌ์๋ฉ์ ์ง์ํ๋ฉฐ ์๋ ์ฌ์ฐ๊ฒฐ๊ณผ ์ํ ํ์ธ์ด ๋ถ์ด ์์ต๋๋ค. ๋ฐ์คํฌํฑ ์ฑ์ ํด๋ผ์ด์ธํธ ๋ ์๋ฒ ํฐ๋์ ๊ทธ ์ปดํจํฐ์ ์ ์ฅ๋๊ณ , ํ๋ฆฌ์
์ ์๋ฒ์ ์ ์ฅํด ๋๋ฉด ๋ค๋ฅธ ์ปดํจํฐ๋ก ์ค์ ์ ์ฎ๊ธธ ์ ์์ต๋๋ค.
-**์๊ฒฉ ํ์ผ ๊ด๋ฆฌ์:**
-์ฝ๋, ์ด๋ฏธ์ง, ์ค๋์ค, ๋น๋์ค์ ๋ณด๊ธฐ ๋ฐ ํธ์ง์ ์ง์ํ์ฌ ์๊ฒฉ ์๋ฒ์์ ํ์ผ์ ์ง์ ๊ด๋ฆฌ. sudo ์ง์์ผ๋ก ํ์ผ ์
๋ก๋, ๋ค์ด๋ก๋, ์ด๋ฆ ๋ณ๊ฒฝ, ์ญ์ , ์ด๋์ ์ํํ๊ฒ ์ํ. ์๋ฒ ๊ฐ ํ์ผ ์ด๋๋ ์ง์ํฉ๋๋ค.
+**ํ์ผ ๊ด๋ฆฌ์:**
+SFTP๋ก ํ์ผ์ ์ดํด๋ณด๊ณ ํธ์งํ๊ณ ์ฌ๋ฆฌ๊ณ ๋ด๋ ค๋ฐ๊ณ ์ด๋ฆ์ ๋ฐ๊พธ๊ณ ์ฎ๊ธฐ๊ณ ์ง์ธ ์ ์์ผ๋ฉฐ sudo๋ ๋ฉ๋๋ค. ์ฝ๋์ ์ด๋ฏธ์ง, ์ค๋์ค, ๋น๋์ค๋ฅผ ๋ณด๊ณ ํธ์งํ ์ ์์ต๋๋ค. ์๋ฒ์์ ์๋ฒ๋ก ํ์ผ์ ๋ฐ๋ก ๋ณต์ฌํ ์ ์๋๋ฐ, ๊ฐ์ฅ ๋น ๋ฅธ ๊ฒฝ๋ก๊ฐ ์๋์ผ๋ก ์ ํ๋๊ณ ์ ์ก ๋ฌด๊ฒฐ์ฑ๋ ํ์ธํฉ๋๋ค.
-**Docker ๋ฐ Podman ๊ด๋ฆฌ:**
-์ปจํ
์ด๋ ์์, ์ค์ง, ์ผ์ ์ ์ง, ์ ๊ฑฐ. ์ปจํ
์ด๋ ํต๊ณ ๋ณด๊ธฐ. docker exec ํฐ๋ฏธ๋๋ก ์ปจํ
์ด๋ ์ ์ด. Docker์ Podman์ ๋ชจ๋ ์ปจํ
์ด๋ ๋ฐํ์์ผ๋ก ์ง์. Portainer๋ Dockge๋ฅผ ๋์ฒดํ๊ธฐ ์ํ ๊ฒ์ด ์๋๋ผ ์ปจํ
์ด๋ ์์ฑ๋ณด๋ค๋ ๊ฐํธํ ๊ด๋ฆฌ๋ฅผ ๋ชฉ์ ์ผ๋ก ํฉ๋๋ค.
+**Docker์ Podman:**
+์ปจํ
์ด๋๋ฅผ ์์ํ๊ณ ๋ฉ์ถ๊ณ ์ผ์ ์ ์งํ๊ณ ์ง์ธ ์ ์์ผ๋ฉฐ, ์ํ๋ฅผ ๋ณด๊ฑฐ๋ ์์์ ์
ธ์ ์ด ์ ์์ต๋๋ค. Docker์ Podman ๋ชจ๋์์ ๋์ํฉ๋๋ค. Portainer๋ Dockge๋ฅผ ๋์ ํ๋ ค๋ ๊ฒ์ด ์๋๋ผ, ์ด๋ฏธ ์๋ ์ปจํ
์ด๋๋ฅผ ๋ค๋ฃจ๊ธฐ ์ํ ๊ฒ์
๋๋ค.
-**SSH ํธ์คํธ ๊ด๋ฆฌ์:**
-ํ๊ทธ์ ํด๋(ํด๋ ์ฌ์ฉ์ ์ง์ ๋ฐ ์ค์ฒฉ ํด๋ ์ง์)๋ก SSH ์ฐ๊ฒฐ์ ์ ์ฅ, ์ ๋ฆฌ, ๊ด๋ฆฌํ๊ณ , ์ฌ์ฌ์ฉ ๊ฐ๋ฅํ ๋ก๊ทธ์ธ ์ ๋ณด๋ฅผ ์ฝ๊ฒ ์ ์ฅํ๋ฉด์ SSH ํค ๋ฐฐํฌ๋ฅผ ์๋ํ.
+**ํธ์คํธ ๊ด๋ฆฌ:**
+ํ๊ทธ์, ์ด๋ฆ๊ณผ ์์ ๋ถ์ผ ์ ์๋ ์ค์ฒฉ ํด๋๋ก ํธ์คํธ๋ฅผ ์ ๋ฆฌํฉ๋๋ค. ์ ์ฅํ ์๊ฒฉ ์ฆ๋ช
์ ์ฌ๋ฌ ํธ์คํธ์์ ๋ค์ ์ฐ๊ณ , SSH ํค๋ฅผ ์๋์ผ๋ก ๋ฐฐํฌํ๊ณ , ํธ์คํธ๋ฅผ ์์ ํธ์คํธ ์๋๋ก ๋ฌถ๊ณ , ํ๊บผ๋ฒ์ ํธ์งํ๊ฑฐ๋ ๋ด๋ณด๋ผ ์ ์์ต๋๋ค. ์ ์ฅํ๊ณ ์ถ์ง ์์ ์ผํ์ฑ ์ฐ๊ฒฐ์๋ ๋น ๋ฅธ ์ฐ๊ฒฐ์ ์ฐ๋ฉด ๋ฉ๋๋ค.
-**ํธ์คํธ ๋ฉํธ๋ฆญ:**
-๋๋ถ๋ถ์ Linux ๊ธฐ๋ฐ ์๋ฒ์์ CPU, ๋ฉ๋ชจ๋ฆฌ, ๋์คํฌ ์ฌ์ฉ๋, ๋คํธ์ํฌ, ์
ํ์, ์์คํ
์ ๋ณด, ๋ฐฉํ๋ฒฝ, ํฌํธ ๋ชจ๋ํฐ, ๋ก๊ทธ ๋ทฐ์ด, ์ฌ์ฉ์/๊ถํ, ์ธ์ฆ์ ๋ฑ ๋ค์ํ ์ ๋ณด๋ฅผ ํ์. ์๊ณ์ด ํ์คํ ๋ฆฌ ๊ทธ๋ํ์ ntfy ๋ฐ ์นํ
์ ์ง์ํ๋ ์๊ณ๊ฐ ๊ธฐ๋ฐ ์๋ฆผ์ ํฌํจํฉ๋๋ค.
+**ํธ์คํธ ์งํ:**
+๋๋ถ๋ถ์ ๋ฆฌ๋
์ค ์๋ฒ์์ CPU, ๋ฉ๋ชจ๋ฆฌ, ๋์คํฌ, ๋คํธ์ํฌ, ์จ๋, ๊ฐ๋ ์๊ฐ, ํ๋ก์ธ์ค, ํฌํธ, ๋ก๊ทธ์ธ, ์์คํ
์ ๋ณด๋ฅผ ๊ธฐ๋ก ๊ทธ๋ํ์ ํจ๊ป ๋ณผ ์ ์์ต๋๋ค. ๊ด๋ฆฌ ์นด๋๋ก ์๋น์ค์ cron ์์
, ํจํค์ง, ์ฌ์ฉ์, ๋ฐฉํ๋ฒฝ ๊ท์น, WireGuard, Tailscale, SSL ์ธ์ฆ์, ๋ก๊ทธ, ์ํ ํ์ธ์ Termix ์์์ ์ฒ๋ฆฌํ ์ ์์ต๋๋ค.
-**์ฌ์ฉ์ ์ธ์ฆ:**
-๊ด๋ฆฌ์ ์ ์ด(๋ค๋ฅธ ์ฌ์ฉ์ ์ ๋ณด ํธ์ง ๊ฐ๋ฅ)์ OIDC/LDAP/SSO(์ก์ธ์ค ์ ์ด ํฌํจ), 2FA(TOTP), ํจ์คํค(WebAuthn) ์ง์์ ํตํ ์์ ํ ์ฌ์ฉ์ ๊ด๋ฆฌ. ๋ชจ๋ ํ๋ซํผ์์ ํ์ฑ ์ฌ์ฉ์ ์ธ์
์ ๋ณด๊ณ ๊ถํ์ ์ทจ์ ๊ฐ๋ฅ. OIDC/๋ก์ปฌ ๊ณ์ ์ฐ๋. ๋ชจ๋ ์ฌ์ฉ์ ์์
์ ๊ฐ์ฌ ๋ก๊ทธ ์กฐํ.
+**์๋ํ:**
+๋จผ์ ์กฐ๊ฑด์ ๊ณ ๋ฅด๊ณ , ๋ฌด์จ ์ผ์ด ์ผ์ด๋ ์ง ์ ํ๋ฉด ๋ฉ๋๋ค. ์กฐ๊ฑด์๋ ์งํ๊ฐ ๊ธฐ์ค์ ๋์ ๋, ํธ์คํธ๊ฐ ์ฌ๋ผ์ค๊ฑฐ๋ ๋ด๋ ค๊ฐ ๋, ์ํ ํ์ธ ๊ฒฐ๊ณผ๊ฐ ๋ฐ๋ ๋, ์ ํด์ง ์ผ์ , ์ปจํ
์ด๋ ์ด๋ฒคํธ, ๋ค์ด์ค๋ ์นํ
์ด ์์ต๋๋ค. ๊ฐ ๋จ๊ณ์์ ๋ช
๋ น๊ณผ ์ค๋ํซ์ ์คํํ๊ณ , ์ปจํ
์ด๋์ ํฐ๋์ ์กฐ์ํ๊ณ , ํธ์คํธ๋ฅผ ๊นจ์ฐ๊ณ , URL์ ํธ์ถํ๊ณ , ๊ธฐ๋ค๋ฆฌ๊ณ , ์กฐ๊ฑด์ ๋ฐ๋ผ ๊ฐ๋ผ์ง๊ณ , ๋ค๋ฅธ ์๋ํ๋ฅผ ์คํํ๊ณ , ntfy๋ Discord, ์นํ
์ผ๋ก ์๋ฆด ์ ์์ต๋๋ค. ํ
์คํธ ์คํ์ผ๋ก ๋จผ์ ์์ ํ๊ฒ ์ํํด ๋ณผ ์ ์์ต๋๋ค.
-**Tailscale ํตํฉ:**
-Tailscale ๋คํธ์ํฌ์ ๊ธฐ๊ธฐ๋ฅผ ๋์ดํ์ฌ ํธ์คํธ๋ก ๋น ๋ฅด๊ฒ ์ถ๊ฐํ๊ณ , Tailscale SSH๋ฅผ ์ธ์ฆ ๋ฐฉ๋ฒ์ผ๋ก ์ฌ์ฉํ์ฌ ์ฐ๊ฒฐํจ์ผ๋ก์จ ์๊ฒฉ ์ฆ๋ช
์ ์ ์ฅํ์ง ์๊ณ ๋ ๋คํธ์ํฌ ACL์ด ๊ถํ ๋ถ์ฌ๋ฅผ ์ฒ๋ฆฌํ๋๋ก ํฉ๋๋ค.
+**ํ๋ฆฟ:**
+ํธ์คํธ๋ฅผ ์ง์ ๊ณ ๋ฅด๊ฑฐ๋ ํ๊ทธ ๊ท์น์ผ๋ก ํ๋ฆฟ์ ๋ฌถ์ผ๋ฉด ์ ํธ์คํธ๋ ์์์ ๋ค์ด์ต๋๋ค. ๋ชจ๋ ํธ์คํธ์์ ๊ฐ์ ๋ช
๋ น์ ํ ๋ฒ์ ์คํํ๊ณ , ์ ๋ถ์ ํ์ผ์ ๋ณด๋ด๊ณ ๊ฐ์ ธ์ค๊ณ , ํจํค์ง๋ฅผ ์ค์นํ๊ณ , OS์ ์ปค๋, ์ํคํ
์ฒ, ๊ฐ๋ ์๊ฐ ๋ชฉ๋ก์ ๋ชจ์ ์ ์์ต๋๋ค.
-**RBAC/๊ณต์ :**
-์ญํ ์ ์์ฑํ๊ณ ์ฌ์ฉ์/์ญํ ๊ฐ์ ํธ์คํธ๋ฅผ ๊ณต์ ํฉ๋๋ค. ๋ชจ๋ ์ธ์ฆ ์ ํ๊ณผ ๋ชจ๋ ํธ์คํธ ํ๋กํ ์ฝ์ ์ง์ํฉ๋๋ค.
+**AI ์ด์์คํดํธ:**
+์ ํ ๊ธฐ๋ฅ์ด๋ฉฐ ์ง์ ์ผ๊ธฐ ์ ๊น์ง๋ ๊บผ์ ธ ์์ต๋๋ค. OpenAI, Anthropic, Gemini, Ollama ๋๋ OpenAI ํธํ ์๋ํฌ์ธํธ๋ฅผ ์ฐ๊ฒฐํด ๋ด ํ๊ฒฝ์ ๋ํด ๋ฌผ์ด๋ณผ ์ ์์ต๋๋ค. ํธ์คํธ์ ํ๋ฆฟ, ์ค๋ํซ, ์๋ฆผ์ ์ฝ์ ์ ์์ง๋ง ์ง์ ๋ฐ๊พธ์ง ์๊ณ ์น์ธ๋ฐ์ ์ ์์ผ๋ก ๋ด๋์ต๋๋ค. ์๊ฒฉ ์ฆ๋ช
๊ณผ ์ฌ์ฉ์, ์ค์ ์๋ ์ ๋ ์ ๊ทผํ ์ ์์ต๋๋ค. ๊ด๋ฆฌ์๋ ์ธ์คํด์ค ์ ์ฒด์์ ๊บผ ๋ ์ ์๊ณ , ์ด๊ธฐ ์ค์ ์์ ์์ ์จ๊ธธ ์๋ ์์ต๋๋ค.
-**์๋ฆฌ์ผ ์ฐ๊ฒฐ:**
-๋ธ๋ผ์ฐ์ ๋๋ ๋ฐ์คํฌํฑ ์ฑ์์ ์ง์ ์๋ฆฌ์ผ ์ฅ์น(๋ผ์ฐํฐ, ์ค์์น, ๋ง์ดํฌ๋ก์ปจํธ๋กค๋ฌ ๋ฑ)์ ์ฐ๊ฒฐ. ๋ณด๋๋ ์ดํธ, ๋ฐ์ดํฐ ๋นํธ, ์คํฑ ๋นํธ, ํจ๋ฆฌํฐ ๊ตฌ์ฑ. ์ง์ ๋ธ๋ผ์ฐ์ ์์๋ Web Serial API๋ฅผ, Electron ์ฑ์์๋ ๋ค์ดํฐ๋ธ ๋ฐฑ์๋๋ฅผ ์ฌ์ฉํฉ๋๋ค.
+**๋ก๊ทธ์ธ๊ณผ ์ฌ์ฉ์:**
+๋ก์ปฌ ๊ณ์ ๊ณผ ํจ๊ป OIDC, LDAP, GitHub, Google ๋ก๊ทธ์ธ์ ์ง์ํ๊ณ 2๋จ๊ณ ์ธ์ฆ(TOTP), ํจ์คํค(WebAuthn), ์ ๋ขฐํ ์ ์๋ ๊ธฐ๊ธฐ๋ ์ธ ์ ์์ต๋๋ค. ๊ด๋ฆฌ์๋ ์ฌ์ฉ์๋ฅผ ๊ด๋ฆฌํ๊ณ , OIDC ๊ทธ๋ฃน์ ์ญํ ์ ์ฐ๊ฒฐํ๊ณ , ๋ชจ๋ ํ๋ซํผ์ ํ์ฑ ์ธ์
์ ๋ณด๊ณ ํด์งํ ์ ์์ต๋๋ค. ๋ก์ปฌ ๊ณ์ ๊ณผ OIDC ๊ณ์ ์ ์ฐ๊ฒฐํ ์ ์๊ณ , ๋๊ฐ ๋ฌด์์ ํ๋์ง๋ ๊ฐ์ฌ ๋ก๊ทธ์์ ํ์ธํฉ๋๋ค.
+**์ญํ ๊ณผ ๊ณต์ :**
+์ญํ ์ ๋ง๋ค๊ณ ์ฐ๊ฒฐ, ๋ณด๊ธฐ, ํธ์ง, ๊ด๋ฆฌ๋ผ๋ ๋ค ๋จ๊ณ๋ก ํธ์คํธ๋ฅผ ์ฌ์ฉ์๋ ์ญํ ์ ๊ณต์ ํ ์ ์์ต๋๋ค. ๋ชจ๋ ์ธ์ฆ ๋ฐฉ์๊ณผ ๋ชจ๋ ํ๋กํ ์ฝ์์ ๋์ํ๋ฉฐ, ๊ณต์ ํ ํธ์คํธ์ ์ธ ์๊ฒฉ ์ฆ๋ช
์ ๋ฐ๋ก ์ง์ ํ ์๋ ์์ต๋๋ค.
+
+
+
+
+
+
**์๋ฆผ:**
-ํธ์คํธ ๋ฉํธ๋ฆญ(CPU, ๋ฉ๋ชจ๋ฆฌ, ๋์คํฌ ๋ฑ)์ ๋ํ ์๊ณ๊ฐ ๊ธฐ๋ฐ ์๋ฆผ ๊ท์น์ ์ค์ ํ๊ณ ํธ๋ฆฌ๊ฑฐ๋ ๋ ntfy ๋๋ ์นํ
์ ํตํด ์๋ฆผ ์์ . ๊ธฐ๋ก ๋ก๊ทธ์์ ๋ฐ์ ์ค์ธ ์๋ฆผ๊ณผ ํด๊ฒฐ๋ ์๋ฆผ ํ์ธ.
+CPU์ ๋ฉ๋ชจ๋ฆฌ, ๋์คํฌ ๊ฐ์ ํธ์คํธ ์งํ์ ๊ท์น์ ๊ฑธ์ด ๋๊ณ ์กฐ๊ฑด์ด ๊ฑธ๋ฆฌ๋ฉด ntfy๋ Discord, ์นํ
์ผ๋ก ์๋ฆผ์ ๋ฐ์ต๋๋ค. ๋ฐ์ ์ค์ธ ์๋ฆผ๊ณผ ํด์ ๋ ์๋ฆผ์ ๊ธฐ๋ก์์ ๋ณด๊ณ , ์ ๊ฒฝ ์ฐ์ง ์์ ๊ฒ์ ์ง์ ๋ ์ ์์ต๋๋ค.
-
-
**ํํ์ด์ง:**
-๋๋๊ทธ ์ค ๋๋กญ ์์ ฏ ๊ทธ๋ฆฌ๋๋ฅผ ๊ฐ์ถ ์์ ๋ง์ถคํ ํํ์ด์ง. ํธ์คํธ ์ํ, ์๋น์ค ๋งํฌ, ์๊ณ, ๋ฉ๋ชจ, RSS ํผ๋, ๋ ์จ, Docker ์ปจํ
์ด๋, ํธ์คํธ ๋ฉํธ๋ฆญ ์ฐจํธ, ์๋ฒ ๋๋ ํฐ๋ฏธ๋, iframe ๋ฑ์ ์์ ฏ ์ถ๊ฐ ๊ฐ๋ฅ.
-
-
-
-
-**๋ฐ์ดํฐ๋ฒ ์ด์ค ์ํธํ:**
-๋ฐฑ์๋๊ฐ ์ํธํ๋ SQLite ๋ฐ์ดํฐ๋ฒ ์ด์ค ํ์ผ๋ก ์ ์ฅ๋จ. ์์ธํ ๋ด์ฉ์ [๋ฌธ์](https://docs.termix.site/security)๋ฅผ ์ฐธ์กฐํ์ธ์.
+์ง์ ๊พธ๋ฏธ๋ ๋์ด๋ค ๋๊ธฐ ์์ ฏ ํ๋ฉด์
๋๋ค. ํธ์คํธ ์ํ, ํ, ์๋น์ค ๋งํฌ, ๋ถ๋งํฌ, ๊ฒ์, ์๊ณ, ๋ฌ๋ ฅ, ์นด์ดํธ๋ค์ด, ๋ฉ๋ชจ, RSS, ๋ ์จ, ์ด๋ฏธ์ง, iframe, Docker, ํฐ๋, ์งํ ์ฐจํธ, ์ฌ์ฉ์ API, ์ฌ์ง์ด ์ด์ ์๋ ํฐ๋ฏธ๋๊น์ง ์์ ฏ์ผ๋ก ๋์ ์ ์์ต๋๋ค.
-**๋คํธ์ํฌ ๊ทธ๋ํ:**
-๋์๋ณด๋๋ฅผ ์ฌ์ฉ์ ์ ์ํ์ฌ SSH ์ฐ๊ฒฐ ๊ธฐ๋ฐ์ ํ๋ฉ ๋คํธ์ํฌ๋ฅผ ์ํ ํ์์ ํจ๊ป ์๊ฐํ.
+**์ค๋ํซ๊ณผ ๋๊ตฌ:**
+์์ฃผ ์ฐ๋ ๋ช
๋ น์ ์ ์ฅํด ๋๊ณ ํ ๋ฒ์ ์คํํ ์ ์์ผ๋ฉฐ, ํธ์คํธ ๊ฐ์ด๋ ์ง์ ๋ฃ๋ ๊ฐ์ ๋ณ์๋ก ์ธ ์ ์์ต๋๋ค. ์ด๋ ค ์๋ ๋ชจ๋ ํฐ๋ฏธ๋์์ ๊ฐ์ ๋ช
๋ น์ ํ๊บผ๋ฒ์ ์คํํ ์ ์๊ณ , ๋ช
๋ น ๊ธฐ๋ก๋ ์๋ ์์ฑ์ผ๋ก ์ฐพ์ ์ ์์ต๋๋ค.
-**SSH ๋๊ตฌ:**
-ํ ๋ฒ์ ํด๋ฆญ์ผ๋ก ์คํ ๊ฐ๋ฅํ ์ฌ์ฌ์ฉ ๊ฐ๋ฅ ๋ช
๋ น์ด ์ค๋ํซ ์์ฑ. ์ฌ๋ฌ ์ด๋ฆฐ ํฐ๋ฏธ๋์์ ๋์์ ํ๋์ ๋ช
๋ น์ด ์คํ.
+**์ธ์
๊ณต์ :**
+ํฐ๋ฏธ๋๊ณผ RDP, VNC, Telnet ์ธ์
์ ์ค์๊ฐ์ผ๋ก ๊ณต์ ํฉ๋๋ค. ๊ณ์ ์์ด ๋ค์ด์ฌ ์ ์๋ ๋งํฌ๋ฅผ ๋ณด๋ด๊ฑฐ๋ ํน์ Termix ์ฌ์ฉ์์ ๊ณต์ ํ ์ ์๊ณ , ๋ณด๊ธฐ๋ง ํ ์ง ์กฐ์๊น์ง ํ ์ง ๊ณ ๋ฅผ ์ ์์ต๋๋ค. ๊ณต์ ๋ ์์์ ๋ง๋ฃ๋๊ฒ ํ๊ฑฐ๋ ์ธ์ ๋ ์ทจ์ํ ์ ์๊ณ , ์ ์ฒด ๋๋ ํธ์คํธ๋ณ๋ก ๊บผ ๋ ์ ์์ต๋๋ค.
-**์ง์ ํญ:**
-์ฌ์ฉ์ ํ๋กํ์์ ํ์ฑํ๋ ๊ฒฝ์ฐ SSH ์ธ์
๋ฐ ํญ์ด ๊ธฐ๊ธฐ/์๋ก ๊ณ ์นจ ๊ฐ์ ์ด๋ฆฐ ์ํ ์ ์ง.
+**์ธ์
๋
นํ์ ๋ก๊ทธ:**
+ํฐ๋ฏธ๋๊ณผ RDP, VNC ์ธ์
์ ๋
นํํด ๋์๋ค๊ฐ ๋์ค์ ๋ค์ ๋ณผ ์ ์์ต๋๋ค. ์ธ์
์ ํ
์คํธ ๋ก๊ทธ๋ฅผ ๋ด๋ ค๋ฐ์ ์ ์๊ณ , ์ฐ๊ฒฐ ๋ก๊ทธ๋ฅผ ๋ณด๋ฉด ์ฐ๊ฒฐํ๋ ๋์ ๋ฌด์จ ์ผ์ด ์์๋์ง ๊ทธ๋๋ก ์ ์ ์์ต๋๋ค.
-**๋ค๊ตญ์ด ์ง์:**
-์ฝ 30๊ฐ ์ธ์ด ๋ด์ฅ ์ง์([Crowdin](https://docs.termix.site/translations)์ผ๋ก ๊ด๋ฆฌ).
+**์๋ฆฌ์ผ ์ฐ๊ฒฐ:**
+๋ผ์ฐํฐ์ ์ค์์น, ๋ง์ดํฌ๋ก์ปจํธ๋กค๋ฌ ๊ฐ์ ์๋ฆฌ์ผ ์ฅ์น์ ๋ธ๋ผ์ฐ์ ๋ ๋ฐ์คํฌํฑ ์ฑ์์ ์ ์ํ ์ ์์ต๋๋ค. ๋ณด๋๋ ์ดํธ์ ๋ฐ์ดํฐ ๋นํธ, ์คํฑ ๋นํธ, ํจ๋ฆฌํฐ๋ฅผ ์ค์ ํ ์ ์์ต๋๋ค. ์ง์๋๋ ๋ธ๋ผ์ฐ์ ์์๋ Web Serial API๋ฅผ, ๋ฐ์คํฌํฑ ์ฑ์์๋ ๋ค์ดํฐ๋ธ ๋ฐฑ์๋๋ฅผ ์๋๋ค.
+
+
+
+
+
+
+**Tailscale:**
+tailnet์์ ๊ธฐ๊ธฐ๋ฅผ ๊ฐ์ ธ์ ๋ช ๋ฒ์ ํด๋ฆญ์ผ๋ก ํธ์คํธ๋ก ์ถ๊ฐํ๊ณ , Tailscale SSH๋ก ์ ์ํ๋ฉด ์ ๊ทผ ๊ถํ์ tailnet ACL์ด ์ฒ๋ฆฌํ๋ฏ๋ก ์๊ฒฉ ์ฆ๋ช
์ ์ ์ฅํ ํ์๊ฐ ์์ต๋๋ค. Headscale๊ณผ ์ฌ์ฉ์ ์ง์ ์๋ํฌ์ธํธ๋ ๋ฉ๋๋ค.
+
+
+
+
+**Proxmox:**
+Proxmox ์ธ์คํด์ค์์ ํธ์คํธ๋ฅผ ๋ฐ๋ก ๊ฐ์ ธ์ค๊ณ , ๋
ธ๋์ ๊ฒ์คํธ์ CPU์ ๋ฉ๋ชจ๋ฆฌ, ์คํ ๋ฆฌ์ง ์ํ๋ฅผ ์ ์ฉ ํญ์์ ๋ณผ ์ ์์ต๋๋ค.
+
+
+
+
+
+
+**์ํฌ์คํ์ด์ค์ ํญ:**
+ํญ๊ณผ ๋ถํ ๋ฐฐ์น๋ฅผ ํต์งธ๋ก ์ ์ฅํด ๋๊ณ ํ ๋ฒ์ ๋ค์ ์ด ์ ์์ต๋๋ค. Termix๋ ๋ง์ง๋ง ์ธ์
๋ ๊ธฐ์ตํ๊ธฐ ๋๋ฌธ์ ์๋ก ๊ณ ์นจ์ ํ๊ฑฐ๋ ๊ธฐ๊ธฐ๋ฅผ ๋ฐ๊ฟ๋ ํญ์ด ๊ทธ๋๋ก ๋์์ต๋๋ค.
+
+
+
+
+**์ค์น ์๋ด:**
+์งง์ ์ค์ ๊ณผ์ ์ด ํ๋ฉด ํ๋ฆฌ์
๊ณผ ํ
๋ง, ์ฐ๊ณ ์ถ์ ๊ธฐ๋ฅ, ์ฒซ ํธ์คํธ๋ฅผ ๊ณ ๋ฅด๋๋ก ์๋ดํฉ๋๋ค. ๊ฐ๋จ ๋ชจ๋๋ ์ฐ์ง ์๋ ๊ฒ์ ์จ๊ฒจ ์ฃผ๊ณ , ์ค์ ์ ์ธ์ ๋ ๋ค์ ํ๊ฑฐ๋ ํ๋ฆฌ์
์ ๋ฐ๊ฟ ์ ์์ต๋๋ค.
+
+
+
+
+
+
+**๋ฐ์คํฌํฑ ๋จ๋
์คํ๊ณผ ๋๊ธฐํ:**
+๋ฐ์คํฌํฑ ์ฑ์ ์์ฒด ๋ฐฑ์๋์ ๋ฐ์ดํฐ๋ฒ ์ด์ค๋ก ์๋ฒ ์์ด ํผ์ ๋์๊ฐ๋๋ค. Termix ์๋ฒ์ ์ฐ๊ฒฐํ๋ฉด ํธ์คํธ์ ์๊ฒฉ ์ฆ๋ช
, ์ค๋ํซ ๋ฑ์ ์๋ฐฉํฅ์ผ๋ก ๋๊ธฐํํ ์ ์๊ณ , ์ฐ๊ฒฐ์ ๋ก์ปฌ์์ ์์ํ ์ง ์๋ฒ๋ฅผ ๊ฑฐ์น ์ง๋ ๊ณ ๋ฅผ ์ ์์ต๋๋ค.
+
+
+
+
+**๋ช
๋ น์ค ๋๊ตฌ:**
+์
ธ๊ณผ ์คํฌ๋ฆฝํธ์์ ์ฐ๋ `termix` CLI์
๋๋ค. ํฐ๋ฏธ๋์ ์ด๊ณ , ํธ์คํธ ํ๋๋ ํ๋ฆฟ ์ ์ฒด์์ ๋ช
๋ น์ ์คํํ๊ณ , SFTP๋ก ํ์ผ์ ์ฎ๊ธฐ๊ณ , ํธ์คํธ์ ์ค๋ํซ, ์๊ฒฉ ์ฆ๋ช
์ ๊ด๋ฆฌํ ์ ์์ต๋๋ค. `npm install -g @termix-cli/cli`๋ก ์ค์นํ๊ฑฐ๋ ๋จ๋
์คํ ํ์ผ์ ๋ฐ์ผ๋ฉด ๋ฉ๋๋ค. [CLI ๋ฌธ์](https://docs.termix.site/cli)๋ฅผ ์ฐธ๊ณ ํ์ธ์.
+
+
+
+
+
+
+**๋ณด์:**
+๋น๋ฐ๋ฒํธ์ ํค๋ฅผ ๋น๋กฏํ ๋น๋ฐ ์ ๋ณด๋ ์ฌ์ฉ์๋ณ๋ก ์ํธํ๋๊ณ , ๋ฐ์ดํฐ๋ฒ ์ด์ค ํ์ผ ์์ฒด๋ ๋์คํฌ์์ ์ํธํํ ์ ์์ต๋๋ค. ์ด๋ป๊ฒ ๋์ํ๋์ง๋ [๋ฌธ์](https://docs.termix.site/security)์์ ๋ณผ ์ ์์ต๋๋ค.
+
+
+
+
+**์ธ์ด:**
+์ฝ 30๊ฐ ์ธ์ด๊ฐ ๊ธฐ๋ณธ์ผ๋ก ๋ค์ด ์์ผ๋ฉฐ [Crowdin](https://docs.termix.site/translations)์ผ๋ก ๊ด๋ฆฌํฉ๋๋ค.
@@ -199,17 +255,20 @@ Tailscale ๋คํธ์ํฌ์ ๊ธฐ๊ธฐ๋ฅผ ๋์ดํ์ฌ ํธ์คํธ๋ก ๋น ๋ฅด๊ฒ ์ถ๊ฐ
๋ ๋ง์ ๊ธฐ๋ฅ
ํ๋ซํผ
-๋ฐฐํฌํ
+๋ฐฐํฌ ํํ
Web ๋ชจ๋ ์ต์ ๋ธ๋ผ์ฐ์ (Chrome, Safari, Firefox) ยท PWA ์ง์
+์ต์ ๋ธ๋ผ์ฐ์ ์ ๋ฐ(Chrome, Safari, Firefox) ยท PWA ์ง์
Windows x64/ia32 ํฌํฐ๋ธ ยท MSI ์ค์น ํ๋ก๊ทธ๋จ ยท Chocolatey
+ํฌํฐ๋ธ ยท MSI ์ค์น ํ์ผ ยท Chocolatey
Linux x64/ia32
@@ -325,10 +410,6 @@ Termix๋ ๊ตฌ๋
์ด๋ ์ ๋ฃ ์๊ธ์ ๊ฐ ์๋ ๋ฌด๋ฃ ์คํ์์ค ํ๋ก์
-
-
-
@@ -340,14 +421,17 @@ Termix๋ ๊ตฌ๋
์ด๋ ์ ๋ฃ ์๊ธ์ ๊ฐ ์๋ ๋ฌด๋ฃ ์คํ์์ค ํ๋ก์
-
+
+
+
YouTube์์ ์
๋ฐ์ดํธ ๊ฐ์ ์์ฒญํ๊ธฐ
+YouTube์์ ์
๋ฐ์ดํธ ์๊ฐ ๋ณด๊ธฐ
-์ผ๋ถ ๋น๋์ค ๋ฐ ์ด๋ฏธ์ง๋ ์ต์ ์ด ์๋๊ฑฐ๋ ๊ธฐ๋ฅ์ ์๋ฒฝํ๊ฒ ๋ณด์ฌ์ฃผ์ง ์์ ์ ์์ต๋๋ค.
+์ผ๋ถ ์์๊ณผ ์ด๋ฏธ์ง๋ ์ค๋๋์๊ฑฐ๋ ๊ธฐ๋ฅ์ ์ ๋๋ก ๋ณด์ฌ ์ฃผ์ง ๋ชปํ ์ ์์ต๋๋ค.
@@ -407,10 +491,10 @@ Termix์ ๋ํ ๋์์ด ํ์ํ๊ฑฐ๋ ๊ธฐ๋ฅ์ ์์ฒญํ๋ ค๋ฉด [Issues](ht
## ๊ณํ๋ ๊ธฐ๋ฅ
-๋ชจ๋ ๊ณํ๋ ๊ธฐ๋ฅ์ [Projects](https://github.com/orgs/Termix-SSH/projects/5)๋ฅผ ์ฐธ์กฐํ์ธ์. ๊ธฐ์ฌ๋ฅผ ์ํ์๋ฉด [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)์ ์ฐธ์กฐํ์ธ์.
+๊ณํ๋ ๊ธฐ๋ฅ์ ๋ชจ๋ [Projects](https://github.com/orgs/Termix-SSH/projects/5)์ ์์ต๋๋ค. ๊ธฐ์ฌํ๊ณ ์ถ๋ค๋ฉด [๊ธฐ์ฌ ์๋ด](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)๋ฅผ ๋ด ์ฃผ์ธ์.
Termix
-Gerenciamento SSH auto-hospedado e acesso a area de trabalho remota
+Gestรฃo de servidores auto-hospedada, do SSH e do desktop remoto ร s automaรงรตes
English ยท
@@ -37,7 +37,7 @@
-**Acesso ao Terminal SSH:**
-Terminal completo com suporte a tela dividida (ate 4 paineis) com um sistema de abas similar ao navegador. Inclui suporte para personalizacao do terminal incluindo temas comuns de terminal, fontes e outros componentes.
+**Terminal SSH:**
+Um terminal completo com abas como as do navegador e tela dividida, atรฉ 6 painรฉis ao mesmo tempo. Escolhe o teu tema, a fonte e as cores. Acima de cada sessรฃo hรก uma barra com CPU, memรณria e disco ao vivo, alรฉm de atalhos para os arquivos, o Docker, os tรบneis e as mรฉtricas daquele host.
-**Acesso a Area de Trabalho Remota:**
-Suporte a RDP, VNC e Telnet pelo navegador com personalizacao completa e tela dividida.
+**Desktop remoto:**
+RDP, VNC e Telnet no navegador, em abas e tela dividida como qualquer outra sessรฃo. Inclui um navegador de arquivos para as unidades RDP e envio arrastando e soltando. No desktop Windows tambรฉm dรก para abrir um host no cliente RDP nativo.
-**Gerenciamento de Tuneis SSH:**
-Crie e gerencie tuneis SSH de servidor para servidor com reconexao automatica, monitoramento de saude e encaminhamento local, remoto ou SOCKS dinamico. As configuracoes de tunel de cliente desktop para servidor sao armazenadas localmente por instalacao de desktop, snapshots de predefinicoes C2S opcionais podem ser salvos no servidor, renomeados, carregados ou excluidos quando voce quiser mover uma configuracao de tunel local entre clientes.
+**Tรบneis SSH:**
+Encaminhamento local, remoto e SOCKS dinรขmico, com reconexรฃo automรกtica e verificaรงรฃo de estado. Os tรบneis de cliente para servidor do aplicativo de desktop ficam naquela mรกquina, e dรก para salvar predefiniรงรตes no servidor para levar uma configuraรงรฃo para outro computador.
-**Gerenciador Remoto de Arquivos:**
-Gerencie arquivos diretamente em servidores remotos com suporte para visualizar e editar codigo, imagens, audio e video. Faca upload, download, renomeie, exclua e mova arquivos facilmente com suporte sudo. Inclui suporte para mover arquivos de servidor para servidor.
+**Gerenciador de arquivos:**
+Navega, edita, envia, baixa, renomeia, move e apaga arquivos por SFTP, com suporte a sudo. Vรช e edita cรณdigo, imagens, รกudio e vรญdeo. Copia arquivos direto de um servidor para outro, com o caminho mais rรกpido escolhido para ti e a integridade das transferรชncias verificada.
-**Gerenciamento de Docker e Podman:**
-Inicie, pare, pause, remova conteineres. Visualize estatisticas de conteineres. Controle conteineres usando o terminal Docker Exec. Suporta Docker e Podman como ambiente de execucao de conteineres. Nao foi feito para substituir Portainer ou Dockge, mas sim para simplesmente gerenciar seus conteineres em vez de cria-los.
+**Docker e Podman:**
+Inicia, para, pausa e remove containers, acompanha as estatรญsticas e abre um shell dentro de um deles. Funciona tanto com Docker quanto com Podman. Nรฃo รฉ para substituir o Portainer ou o Dockge, sรณ para gerenciar os containers que jรก tens.
-**Gerenciador de Hosts SSH:**
-Salve, organize e gerencie suas conexoes SSH com tags e pastas (com personalizacao de pastas e suporte a pastas aninhadas), e salve facilmente informacoes de login reutilizaveis com a capacidade de automatizar a implantacao de chaves SSH.
+**Gerenciador de hosts:**
+Salva e organiza hosts com etiquetas e pastas aninhadas que podes nomear e colorir. Reaproveita credenciais salvas entre hosts, distribui chaves SSH automaticamente, agrupa hosts sob um host pai, edita e exporta em lote, e usa a conexรฃo rรกpida para conexรตes pontuais que nรฃo queres guardar.
-**Metricas do Host:**
-Visualize o uso de CPU, memoria e disco, rede, tempo de atividade, informacoes do sistema, firewall, monitor de portas, visualizador de logs, usuarios/permissoes, certificados e muito mais na maioria dos servidores baseados em Linux. Inclui graficos de historico em serie temporal e alertas baseados em limites com suporte a ntfy e webhook.
+**Mรฉtricas de host:**
+CPU, memรณria, disco, rede, temperatura, tempo ligado, processos, portas, logins e informaรงรตes do sistema na maioria dos servidores Linux, com grรกficos de histรณrico. Os cartรตes de gerenciamento deixam cuidar de serviรงos, tarefas cron, pacotes, usuรกrios, regras de firewall, WireGuard, Tailscale, certificados SSL, logs e verificaรงรตes de saรบde sem sair do Termix.
-**Autenticacao de Usuarios:**
-Gerenciamento seguro de usuarios com controles de administrador (podem editar informacoes de outros usuarios) e suporte para OIDC/LDAP/SSO (com controle de acesso), 2FA (TOTP) e passkey (WebAuthn). Visualize sessoes ativas de usuarios em todas as plataformas e revogue permissoes. Vincule suas contas OIDC/Locais entre si. Visualize o log de auditoria de todas as acoes dos usuarios.
+**Automaรงรตes:**
+Escolhe um gatilho e depois diz o que deve acontecer. Os gatilhos incluem uma mรฉtrica passando de um limite, um host caindo ou voltando, uma verificaรงรฃo de saรบde mudando, um agendamento, um evento de container ou um webhook recebido. Os passos podem rodar comandos e trechos, controlar containers e tรบneis, acordar um host, chamar uma URL, esperar, seguir por uma condiรงรฃo, rodar outra automaรงรฃo e te avisar por ntfy, Discord ou webhook. As execuรงรตes de teste deixam experimentar com seguranรงa primeiro.
-**Integracao com Tailscale:**
-Liste dispositivos da sua rede Tailscale para adicionรก-los rapidamente como hosts, e conecte-se usando Tailscale SSH como metodo de autenticacao, deixando as ACLs da sua rede gerenciar a autorizacao sem armazenar credenciais.
+**Frotas:**
+Junta hosts numa frota escolhendo um a um ou com regras de etiquetas, para que os novos entrem sozinhos. Roda um comando em todos os hosts de uma vez, envia e busca arquivos em todos eles, instala pacotes e reรบne um inventรกrio do sistema, do kernel, da arquitetura e do tempo ligado.
-**RBAC/Compartilhamento:**
-Crie funcoes e compartilhe hosts entre usuarios/funcoes. Suporta todos os tipos de autenticacao e todos os protocolos de host.
+**Assistente de IA:**
+ร opcional e fica desligado atรฉ tu ligares. Conecta OpenAI, Anthropic, Gemini, Ollama ou qualquer endpoint compatรญvel com OpenAI e pergunta sobre a tua instalaรงรฃo. Ele lรช hosts, frotas, trechos e alertas, e propรตe mudanรงas para tu aprovares em vez de fazer sozinho. Nunca consegue mexer em credenciais, usuรกrios ou configuraรงรตes. Os administradores podem deixar desligado para toda a instรขncia, e dรก para escondรช-lo jรก na configuraรงรฃo inicial.
-**Conexoes Seriais:**
-Conecte-se a dispositivos seriais (roteadores, switches, microcontroladores, etc.) diretamente do navegador ou do aplicativo desktop. Configure taxa de baud, bits de dados, bits de parada e paridade. Usa a Web Serial API em navegadores suportados ou um backend nativo no aplicativo Electron.
+**Login e usuรกrios:**
+Contas locais alรฉm de login por OIDC, LDAP, GitHub e Google, com dois fatores (TOTP), chaves de acesso (WebAuthn) e dispositivos confiรกveis. Os administradores podem gerenciar usuรกrios, ligar grupos do OIDC a papรฉis, ver todas as sessรตes ativas em qualquer plataforma e encerrรก-las. Liga a tua conta local com a do OIDC e consulta o registro de auditoria do que cada um fez.
+**Papรฉis e compartilhamento:**
+Cria papรฉis e compartilha hosts com usuรกrios ou papรฉis em quatro nรญveis: conectar, ver, editar e gerenciar. Funciona com todos os tipos de autenticaรงรฃo e todos os protocolos, e dรก para trocar as credenciais usadas num host compartilhado.
+
+
+
+
+
+
**Alertas:**
-Defina regras de alerta baseadas em limites para metricas do host (CPU, memoria, disco, etc.) e receba notificacoes via ntfy ou webhooks quando forem ativadas. Visualize alertas ativos e resolvidos em um historico de registros.
+Define regras em mรฉtricas de host como CPU, memรณria e disco, e recebe aviso por ntfy, Discord ou webhook quando elas disparam. Vรช os alertas ativos e resolvidos num histรณrico e dispensa os que nรฃo te interessam.
+
+
+
+
+**Pรกgina inicial:**
+Uma grade de widgets que tu mesmo montas arrastando e soltando. Tem widget para status de host, ping, links de serviรงos, favoritos, busca, relรณgios, calendรกrios, contagens regressivas, notas, RSS, previsรฃo do tempo, imagens, iframes, Docker, tรบneis, grรกficos de mรฉtricas, APIs prรณprias e atรฉ um terminal ao vivo.
-**Pagina Inicial:**
-Uma pagina inicial totalmente personalizavel com uma grade de widgets de arrastar e soltar. Adicione widgets para status do host, links de servicos, relogios, notas, feeds RSS, clima, conteineres Docker, graficos de metricas do host, terminais incorporados, iframes e mais.
+**Trechos e ferramentas:**
+Salva os comandos que usas sempre e dispara com um clique, com variรกveis para o host e para o que tu digitares. Roda um mesmo comando em todos os terminais abertos e pesquisa o teu histรณrico com preenchimento automรกtico.
-**Criptografia de Banco de Dados:**
-Backend armazenado como arquivos de banco de dados SQLite criptografados. Consulte a [documentacao](https://docs.termix.site/security) para mais informacoes.
+**Compartilhar sessรฃo:**
+Compartilha ao vivo uma sessรฃo de terminal, RDP, VNC ou Telnet. Manda um link que qualquer um entra sem conta, ou compartilha com um usuรกrio especรญfico do Termix, em somente leitura ou com escrita. Os compartilhamentos podem expirar sozinhos ou ser revogados, e dรก para desligar tudo de uma vez ou por host.
-**Grafico de Rede:**
-Personalize seu Dashboard para visualizar seu homelab baseado nas suas conexoes SSH com suporte de status.
+**Gravaรงรฃo e registros de sessรฃo:**
+Grava sessรตes de terminal, RDP e VNC e reproduz depois. Baixa registros de texto de uma sessรฃo e olha o registro de conexรฃo para ver exatamente o que aconteceu durante ela.
-**Ferramentas SSH:**
-Crie trechos de comandos reutilizaveis que sao executados com um unico clique. Execute um comando simultaneamente em multiplos terminais abertos.
+**Conexรตes seriais:**
+Fala com dispositivos seriais como roteadores, switches e microcontroladores pelo navegador ou pelo aplicativo de desktop. Define taxa de transmissรฃo, bits de dados, bits de parada e paridade. Usa a API Web Serial nos navegadores compatรญveis, ou um backend nativo no aplicativo de desktop.
-**Abas Persistentes:**
-Sessoes SSH e abas permanecem abertas entre dispositivos/atualizacoes se habilitado no perfil do usuario.
+**Tailscale:**
+Traz dispositivos da tua tailnet para adicionar como hosts em poucos cliques, e conecta com Tailscale SSH para que as ACLs da tailnet cuidem do acesso sem guardar credenciais. Headscale e endpoints personalizados tambรฉm funcionam.
+
+
+
+
+**Proxmox:**
+Importa hosts direto de uma instรขncia Proxmox e acompanha as estatรญsticas de nรณs e convidados, incluindo CPU, memรณria e armazenamento, numa aba prรณpria.
+
+
+
+
+
+
+**รreas de trabalho e abas:**
+Salva um conjunto de abas com a divisรฃo da tela e reabre tudo com um clique. O Termix tambรฉm lembra da tua รบltima sessรฃo, entรฃo as abas voltam depois de recarregar e em outros dispositivos.
+
+
+
+
+**Configuraรงรฃo guiada:**
+Uma configuraรงรฃo curta te leva por escolher uma predefiniรงรฃo de interface, o tema, as funcionalidades que queres e o teu primeiro host. O modo simples esconde o que nรฃo usas, e dรก para refazer a configuraรงรฃo ou trocar de predefiniรงรฃo quando quiseres.
+
+
+
+
+
+
+**Desktop independente e sincronizaรงรฃo:**
+O aplicativo de desktop roda sozinho, com backend e banco de dados locais, sem servidor. Tambรฉm dรก para ligar num servidor Termix e sincronizar nos dois sentidos hosts, credenciais, trechos e mais, e escolher se as conexรตes saem da tua mรกquina ou passam pelo servidor.
+
+
+
+
+**Linha de comando:**
+Um CLI `termix` para o teu shell e os teus scripts. Abre terminais, roda um comando num host ou numa frota inteira, move arquivos por SFTP e gerencia hosts, trechos e credenciais. Instala com `npm install -g @termix-cli/cli` ou pega um binรกrio independente. Vรช a [documentaรงรฃo do CLI](https://docs.termix.site/cli).
+
+
+
+
+
+
+**Seguranรงa:**
+Senhas, chaves e outros segredos sรฃo criptografados por usuรกrio, e os prรณprios arquivos do banco de dados podem ser criptografados em disco. Vรช a [documentaรงรฃo](https://docs.termix.site/security) para entender como funciona.
**Idiomas:**
-Suporte integrado para aproximadamente 30 idiomas (gerenciado pelo [Crowdin](https://docs.termix.site/translations)).
+Cerca de 30 idiomas incluรญdos, gerenciados pelo [Crowdin](https://docs.termix.site/translations).
@@ -199,40 +255,43 @@ Suporte integrado para aproximadamente 30 idiomas (gerenciado pelo [Crowdin](htt
Mais funcionalidades
Plataforma
-Distribuicao
+Distribuiรงรฃo
Web Qualquer navegador moderno (Chrome, Safari, Firefox) ยท Suporte PWA
+Qualquer navegador moderno (Chrome, Safari, Firefox) ยท Suporte a PWA
Windows x64/ia32 Portatil ยท Instalador MSI ยท Chocolatey
+Portรกtil ยท Instalador MSI ยท Chocolatey
Linux x64/ia32 Portatil ยท AUR ยท AppImage ยท Deb ยท Flatpak
+Portรกtil ยท AUR ยท AppImage ยท Deb ยท Flatpak
macOS x64/ia32, v12.0+
@@ -325,10 +410,6 @@ Interessado em um espaco pago para apoiar o desenvolvimento? Envie um email para
-
-
-
@@ -340,18 +421,21 @@ Interessado em um espaco pago para apoiar o desenvolvimento? Envie um email para
-
+
+
+
@@ -359,7 +443,7 @@ Se voce precisa de ajuda ou deseja solicitar uma funcionalidade para o Termix, v
[](https://www.youtube.com/@TermixSSH/videos)
-Assista resumos de atualizacoes no YouTube
+Vรช as apresentaรงรตes das atualizaรงรตes no YouTube
-Alguns videos e imagens podem estar desatualizados ou podem nao mostrar perfeitamente as funcionalidades.
+Alguns vรญdeos e imagens podem estar desatualizados ou nรฃo mostrar as funcionalidades perfeitamente.
Termix
-ะกะฐะผะพััะพััะตะปัะฝะพ ัะฐะทะผะตัะฐะตะผะพะต ัะฟัะฐะฒะปะตะฝะธะต SSH ะธ ะดะพัััะฟ ะบ ัะดะฐะปัะฝะฝะพะผั ัะฐะฑะพัะตะผั ััะพะปั
+ะฃะฟัะฐะฒะปะตะฝะธะต ัะตัะฒะตัะฐะผะธ ะฝะฐ ัะฒะพัะผ ั
ะพััะธะฝะณะต, ะพั SSH ะธ ัะดะฐะปัะฝะฝะพะณะพ ัะฐะฑะพัะตะณะพ ััะพะปะฐ ะดะพ ะฐะฒัะพะผะฐัะธะทะฐัะธะน
English ยท
@@ -37,7 +37,7 @@
ะะพััะธะณะฝััะพ 1 ัะตะฝััะฑัั 2025 ะณะพะดะฐ
+ ะะพะปััะตะฝะพ 1 ัะตะฝััะฑัั 2025 ะณะพะดะฐ
@@ -58,7 +58,7 @@ Termix โ ะฑะตัะฟะปะฐัะฝัะน ะฟัะพะตะบั ั ะพัะบััััะผ ะธัั
ะพะดะฝั
## ะะฑะทะพั
-Termix - ััะพ ะฟะปะฐััะพัะผะฐ ะดะปั ัะฟัะฐะฒะปะตะฝะธั ัะตัะฒะตัะฐะผะธ ั ะพัะบััััะผ ะธัั
ะพะดะฝัะผ ะบะพะดะพะผ, ะฝะฐะฒัะตะณะดะฐ ะฑะตัะฟะปะฐัะฝะฐั ะธ ัะฐะทะผะตัะฐะตะผะฐั ะฝะฐ ัะพะฑััะฒะตะฝะฝะพะผ ัะตัะฒะตัะต. ะะฝะฐ ะฟัะตะดะพััะฐะฒะปัะตั ะผัะปััะธะฟะปะฐััะพัะผะตะฝะฝะพะต ัะตัะตะฝะธะต ะดะปั ัะฟัะฐะฒะปะตะฝะธั ะฒะฐัะธะผะธ ัะตัะฒะตัะฐะผะธ ะธ ะธะฝััะฐััััะบัััะพะน ัะตัะตะท ะตะดะธะฝัะน ะธะฝััะธัะธะฒะฝะพ ะฟะพะฝััะฝัะน ะธะฝัะตััะตะนั. Termix ะฟัะตะดะปะฐะณะฐะตั ะดะพัััะฟ ะบ SSH-ัะตัะผะธะฝะฐะปั, ัะฟัะฐะฒะปะตะฝะธะต ัะดะฐะปะตะฝะฝัะผ ัะฐะฑะพัะธะผ ััะพะปะพะผ (RDP, VNC, Telnet), ะฒะพะทะผะพะถะฝะพััะธ SSH-ััะฝะฝะตะปะธัะพะฒะฐะฝะธั, ัะดะฐะปะตะฝะฝะพะต ัะฟัะฐะฒะปะตะฝะธะต ัะฐะนะปะฐะผะธ SSH ะธ ะผะฝะพะถะตััะฒะพ ะดััะณะธั
ะธะฝััััะผะตะฝัะพะฒ. Termix - ััะพ ะธะดะตะฐะปัะฝะฐั ะฑะตัะฟะปะฐัะฝะฐั ะฐะปััะตัะฝะฐัะธะฒะฐ Termius ั ะฒะพะทะผะพะถะฝะพัััั ัะฐะทะผะตัะตะฝะธั ะฝะฐ ัะพะฑััะฒะตะฝะฝะพะผ ัะตัะฒะตัะต, ะดะพัััะฟะฝะฐั ะดะปั ะฒัะตั
ะฟะปะฐััะพัะผ.
+Termix ััะพ ะฑะตัะฟะปะฐัะฝะฐั ะฟะปะฐััะพัะผะฐ ั ะพัะบััััะผ ะธัั
ะพะดะฝัะผ ะบะพะดะพะผ ะดะปั ัะฟัะฐะฒะปะตะฝะธั ัะตัะฒะตัะฐะผะธ ะฝะฐ ัะฒะพัะผ ั
ะพััะธะฝะณะต. ะะฝะฐ ัะพะฑะธัะฐะตั ะฒ ะพะดะฝะพะผ ะผะตััะต SSH-ัะตัะผะธะฝะฐะปั, ัะดะฐะปัะฝะฝัะต ัะฐะฑะพัะธะต ััะพะปั (RDP, VNC, Telnet), ะฟะตัะตะดะฐัั ัะฐะนะปะพะฒ, ััะฝะฝะตะปะธ, Docker, ะผะตััะธะบะธ ะธ ะฐะฒัะพะผะฐัะธะทะฐัะธะธ, ะฒ ะฑัะฐัะทะตัะต, ะฝะฐ ะบะพะผะฟัััะตัะต ะธ ะฝะฐ ัะตะปะตัะพะฝะต. ะญัะพ self-hosted ะทะฐะผะตะฝะฐ Termius, ะบะพัะพัะฐั ะพััะฐัััั ะฑะตัะฟะปะฐัะฝะพะน ะฝะฐะฒัะตะณะดะฐ.
-**ะะพัััะฟ ะบ SSH-ัะตัะผะธะฝะฐะปั:**
-ะะพะปะฝะพััะฝะบัะธะพะฝะฐะปัะฝัะน ัะตัะผะธะฝะฐะป ั ะฟะพะดะดะตัะถะบะพะน ัะฐะทะดะตะปะตะฝะธั ัะบัะฐะฝะฐ (ะดะพ 4 ะฟะฐะฝะตะปะตะน) ะธ ัะธััะตะผะพะน ะฒะบะปะฐะดะพะบ, ะบะฐะบ ะฒ ะฑัะฐัะทะตัะต. ะะบะปััะฐะตั ะฟะพะดะดะตัะถะบั ะฝะฐัััะพะนะบะธ ัะตัะผะธะฝะฐะปะฐ, ะฒะบะปััะฐั ะฟะพะฟัะปััะฝัะต ัะตะผั, ััะธััั ะธ ะดััะณะธะต ะบะพะผะฟะพะฝะตะฝัั.
+**SSH-ัะตัะผะธะฝะฐะป:**
+ะะพะปะฝะพัะตะฝะฝัะน ัะตัะผะธะฝะฐะป ั ะฒะบะปะฐะดะบะฐะผะธ ะบะฐะบ ะฒ ะฑัะฐัะทะตัะต ะธ ัะฐะทะดะตะปะตะฝะธะตะผ ัะบัะฐะฝะฐ, ะดะพ 6 ะฟะฐะฝะตะปะตะน ะพะดะฝะพะฒัะตะผะตะฝะฝะพ. ะขะตะผั, ััะธัั ะธ ัะฒะตัะฐ ะฒัะฑะธัะฐะตัะต ะฒั. ะะฐะด ะบะฐะถะดะพะน ัะตััะธะตะน ะตััั ะฟะฐะฝะตะปั ั ัะตะบััะตะน ะทะฐะณััะทะบะพะน ะฟัะพัะตััะพัะฐ, ะฟะฐะผััะธ ะธ ะดะธัะบะฐ, ะฐ ัะฐะบะถะต ะฑัััััะต ัััะปะบะธ ะฝะฐ ัะฐะนะปั, Docker, ััะฝะฝะตะปะธ ะธ ะผะตััะธะบะธ ััะพะณะพ ั
ะพััะฐ.
-**ะะพัััะฟ ะบ ัะดะฐะปัะฝะฝะพะผั ัะฐะฑะพัะตะผั ััะพะปั:**
-ะะพะดะดะตัะถะบะฐ RDP, VNC ะธ Telnet ัะตัะตะท ะฑัะฐัะทะตั ั ะฟะพะปะฝะพะน ะฝะฐัััะพะนะบะพะน ะธ ัะฐะทะดะตะปะตะฝะธะตะผ ัะบัะฐะฝะฐ.
+**ะฃะดะฐะปัะฝะฝัะน ัะฐะฑะพัะธะน ััะพะป:**
+RDP, VNC ะธ Telnet ะฟััะผะพ ะฒ ะฑัะฐัะทะตัะต, ะฒะพ ะฒะบะปะฐะดะบะฐั
ะธ ั ัะฐะทะดะตะปะตะฝะธะตะผ ัะบัะฐะฝะฐ, ะบะฐะบ ะธ ะปัะฑะฐั ะดััะณะฐั ัะตััะธั. ะััั ะฟัะพัะผะพัั ัะฐะนะปะพะฒ ะฝะฐ ะดะธัะบะฐั
RDP ะธ ะทะฐะณััะทะบะฐ ะฟะตัะตัะฐัะบะธะฒะฐะฝะธะตะผ. ะ ะฒะตััะธะธ ะดะปั Windows ั
ะพัั ะผะพะถะฝะพ ะพัะบัััั ะธ ะฒ ะพะฑััะฝะพะผ ะบะปะธะตะฝัะต RDP.
-**ะฃะฟัะฐะฒะปะตะฝะธะต SSH-ััะฝะฝะตะปัะผะธ:**
-ะกะพะทะดะฐะฝะธะต ะธ ัะฟัะฐะฒะปะตะฝะธะต ะผะตะถัะตัะฒะตัะฝัะผะธ SSH-ััะฝะฝะตะปัะผะธ ั ะฐะฒัะพะผะฐัะธัะตัะบะธะผ ะฟะตัะตะฟะพะดะบะปััะตะฝะธะตะผ, ะผะพะฝะธัะพัะธะฝะณะพะผ ัะพััะพัะฝะธั ะธ ะปะพะบะฐะปัะฝะพะน, ัะดะฐะปัะฝะฝะพะน ะธะปะธ ะดะธะฝะฐะผะธัะตัะบะพะน SOCKS-ะฟะตัะตะฐะดัะตัะฐัะธะตะน. ะะฐัััะพะนะบะธ ััะฝะฝะตะปะตะน ยซะดะตัะบัะพะฟะฝัะน ะบะปะธะตะฝั - ัะตัะฒะตัยป ั
ัะฐะฝัััั ะปะพะบะฐะปัะฝะพ ะดะปั ะบะฐะถะดะพะน ัััะฐะฝะพะฒะบะธ; ะพะฟัะธะพะฝะฐะปัะฝัะต ัะฝะธะผะบะธ C2S-ะฟัะตัะตัะพะฒ ะผะพะถะฝะพ ัะพั
ัะฐะฝััั ะฝะฐ ัะตัะฒะตัะต, ะฟะตัะตะธะผะตะฝะพะฒัะฒะฐัั, ะทะฐะณััะถะฐัั ะธะปะธ ัะดะฐะปััั, ะบะพะณะดะฐ ะฒั ั
ะพัะธัะต ะฟะตัะตะฝะตััะธ ะปะพะบะฐะปัะฝัั ะบะพะฝัะธะณััะฐัะธั ััะฝะฝะตะปั ะผะตะถะดั ะบะปะธะตะฝัะฐะผะธ.
+**SSH-ััะฝะฝะตะปะธ:**
+ะะพะบะฐะปัะฝะฐั, ัะดะฐะปัะฝะฝะฐั ะธ ะดะธะฝะฐะผะธัะตัะบะฐั ะฟะตัะตะฐะดัะตัะฐัะธั SOCKS ั ะฐะฒัะพะผะฐัะธัะตัะบะธะผ ะฟะตัะตะฟะพะดะบะปััะตะฝะธะตะผ ะธ ะฟัะพะฒะตัะบะพะน ัะพััะพัะฝะธั. ะขัะฝะฝะตะปะธ ะพั ะบะปะธะตะฝัะฐ ะบ ัะตัะฒะตัั ะฒ ะฝะฐััะพะปัะฝะพะผ ะฟัะธะปะพะถะตะฝะธะธ ั
ัะฐะฝัััั ะฝะฐ ััะพะผ ะบะพะผะฟัััะตัะต, ะฐ ะฝะฐะฑะพัั ะฝะฐัััะพะตะบ ะผะพะถะฝะพ ัะพั
ัะฐะฝะธัั ะฝะฐ ัะตัะฒะตัะต, ััะพะฑั ะฟะตัะตะฝะตััะธ ะบะพะฝัะธะณััะฐัะธั ะฝะฐ ะดััะณัั ะผะฐัะธะฝั.
-**ะฃะดะฐะปัะฝะฝัะน ัะฐะนะปะพะฒัะน ะผะตะฝะตะดะถะตั:**
-ะฃะฟัะฐะฒะปะตะฝะธะต ัะฐะนะปะฐะผะธ ะฝะตะฟะพััะตะดััะฒะตะฝะฝะพ ะฝะฐ ัะดะฐะปัะฝะฝัั
ัะตัะฒะตัะฐั
ั ะฟะพะดะดะตัะถะบะพะน ะฟัะพัะผะพััะฐ ะธ ัะตะดะฐะบัะธัะพะฒะฐะฝะธั ะบะพะดะฐ, ะธะทะพะฑัะฐะถะตะฝะธะน, ะฐัะดะธะพ ะธ ะฒะธะดะตะพ. ะะฐะณััะทะบะฐ, ัะบะฐัะธะฒะฐะฝะธะต, ะฟะตัะตะธะผะตะฝะพะฒะฐะฝะธะต, ัะดะฐะปะตะฝะธะต ะธ ะฟะตัะตะผะตัะตะฝะธะต ัะฐะนะปะพะฒ ั ะฟะพะดะดะตัะถะบะพะน sudo. ะะบะปััะฐะตั ะฟะพะดะดะตัะถะบั ะฟะตัะตะผะตัะตะฝะธั ัะฐะนะปะพะฒ ั ัะตัะฒะตัะฐ ะฝะฐ ัะตัะฒะตั.
+**ะคะฐะนะปะพะฒัะน ะผะตะฝะตะดะถะตั:**
+ะัะพัะผะฐััะธะฒะฐะนัะต, ัะตะดะฐะบัะธััะนัะต, ะทะฐะณััะถะฐะนัะต, ัะบะฐัะธะฒะฐะนัะต, ะฟะตัะตะธะผะตะฝะพะฒัะฒะฐะนัะต, ะฟะตัะตะผะตัะฐะนัะต ะธ ัะดะฐะปัะนัะต ัะฐะนะปั ะฟะพ SFTP, ะฒ ัะพะผ ัะธัะปะต ัะตัะตะท sudo. ะกะผะพััะธัะต ะธ ะฟัะฐะฒััะต ะบะพะด, ะธะทะพะฑัะฐะถะตะฝะธั, ะฐัะดะธะพ ะธ ะฒะธะดะตะพ. ะะพะฟะธััะนัะต ัะฐะนะปั ะฝะฐะฟััะผัั ั ะพะดะฝะพะณะพ ัะตัะฒะตัะฐ ะฝะฐ ะดััะณะพะน: ัะฐะผัะน ะฑัััััะน ะผะฐััััั ะฟะพะดะฑะธัะฐะตััั ัะฐะผ, ะฐ ัะตะปะพััะฝะพััั ะฟะตัะตะดะฐัะธ ะฟัะพะฒะตััะตััั.
-**ะฃะฟัะฐะฒะปะตะฝะธะต Docker ะธ Podman:**
-ะะฐะฟััะบ, ะพััะฐะฝะพะฒะบะฐ, ะฟัะธะพััะฐะฝะพะฒะบะฐ, ัะดะฐะปะตะฝะธะต ะบะพะฝัะตะนะฝะตัะพะฒ. ะัะพัะผะพัั ััะฐัะธััะธะบะธ ะบะพะฝัะตะนะฝะตัะพะฒ. ะฃะฟัะฐะฒะปะตะฝะธะต ะบะพะฝัะตะนะฝะตัะพะผ ัะตัะตะท ัะตัะผะธะฝะฐะป docker exec. ะะพะดะดะตัะถะธะฒะฐะตั ะบะฐะบ Docker, ัะฐะบ ะธ Podman ะฒ ะบะฐัะตััะฒะต ััะตะดั ะฒัะฟะพะปะฝะตะฝะธั ะบะพะฝัะตะนะฝะตัะพะฒ. ะะต ะฟัะตะดะฝะฐะทะฝะฐัะตะฝ ะดะปั ะทะฐะผะตะฝั Portainer ะธะปะธ Dockge, ะฐ ัะบะพัะตะต ะดะปั ะฟัะพััะพะณะพ ัะฟัะฐะฒะปะตะฝะธั ะบะพะฝัะตะนะฝะตัะฐะผะธ ะฟะพ ััะฐะฒะฝะตะฝะธั ั ะธั
ัะพะทะดะฐะฝะธะตะผ.
+**Docker ะธ Podman:**
+ะะฐะฟััะบะฐะนัะต, ะพััะฐะฝะฐะฒะปะธะฒะฐะนัะต, ััะฐะฒััะต ะฝะฐ ะฟะฐัะทั ะธ ัะดะฐะปัะนัะต ะบะพะฝัะตะนะฝะตัั, ัะผะพััะธัะต ะธั
ะฝะฐะณััะทะบั ะธ ะพัะบััะฒะฐะนัะต ะพะฑะพะปะพัะบั ะฒะฝัััะธ. ะ ะฐะฑะพัะฐะตั ะธ ั Docker, ะธ ั Podman. ะญัะพ ะฝะต ะทะฐะผะตะฝะฐ Portainer ะธะปะธ Dockge, ะฐ ัะฟะพัะพะฑ ัะฟัะฐะฒะปััั ัะตะผะธ ะบะพะฝัะตะนะฝะตัะฐะผะธ, ััะพ ั ะฒะฐั ัะถะต ะตััั.
-**ะะตะฝะตะดะถะตั SSH-ั
ะพััะพะฒ:**
-ะกะพั
ัะฐะฝะตะฝะธะต, ะพัะณะฐะฝะธะทะฐัะธั ะธ ัะฟัะฐะฒะปะตะฝะธะต SSH-ะฟะพะดะบะปััะตะฝะธัะผะธ ั ะฟะพะผะพััั ัะตะณะพะฒ ะธ ะฟะฐะฟะพะบ (ั ะฝะฐัััะพะนะบะพะน ะฟะฐะฟะพะบ ะธ ะฟะพะดะดะตัะถะบะพะน ะฒะปะพะถะตะฝะฝัั
ะฟะฐะฟะพะบ), ั ะฒะพะทะผะพะถะฝะพัััั ัะพั
ัะฐะฝะตะฝะธั ะดะฐะฝะฝัั
ะดะปั ะฟะพะฒัะพัะฝะพะณะพ ะฒั
ะพะดะฐ ะธ ะฐะฒัะพะผะฐัะธะทะฐัะธะธ ัะฐะทะฒััััะฒะฐะฝะธั SSH-ะบะปััะตะน.
+**ะะตะฝะตะดะถะตั ั
ะพััะพะฒ:**
+ะฅัะฐะฝะธัะต ะธ ัะฟะพััะดะพัะธะฒะฐะนัะต ั
ะพััั ั ะฟะพะผะพััั ะผะตัะพะบ ะธ ะฒะปะพะถะตะฝะฝัั
ะฟะฐะฟะพะบ, ะบะพัะพััะผ ะผะพะถะฝะพ ะทะฐะดะฐัั ะธะผั ะธ ัะฒะตั. ะัะฟะพะปัะทัะนัะต ัะพั
ัะฐะฝัะฝะฝัะต ััััะฝัะต ะดะฐะฝะฝัะต ะฝะฐ ะฝะตัะบะพะปัะบะธั
ั
ะพััะฐั
, ัะฐะทะฒะพัะฐัะธะฒะฐะนัะต SSH-ะบะปััะธ ะฐะฒัะพะผะฐัะธัะตัะบะธ, ะณััะฟะฟะธััะนัะต ั
ะพััั ะฟะพะด ัะพะดะธัะตะปััะบะธะผ, ัะตะดะฐะบัะธััะนัะต ะธ ะฒัะณััะถะฐะนัะต ะฟะฐะบะตัะฝะพ, ะฐ ะดะปั ัะฐะทะพะฒัั
ะฟะพะดะบะปััะตะฝะธะน, ะบะพัะพััะต ะฝะต ั
ะพัะตััั ัะพั
ัะฐะฝััั, ะตััั ะฑััััะพะต ะฟะพะดะบะปััะตะฝะธะต.
-**ะะตััะธะบะธ ั
ะพััะฐ:**
-ะัะพัะผะพัั ะธัะฟะพะปัะทะพะฒะฐะฝะธั CPU, ะฟะฐะผััะธ ะธ ะดะธัะบะฐ, ัะตัะธ, ะฒัะตะผะตะฝะธ ัะฐะฑะพัั, ะธะฝัะพัะผะฐัะธะธ ะพ ัะธััะตะผะต, ัะฐะนัะฒะพะปะฐ, ะผะพะฝะธัะพัะฐ ะฟะพััะพะฒ, ะฟัะพัะผะพัััะธะบะฐ ะปะพะณะพะฒ, ะฟะพะปัะทะพะฒะฐัะตะปะตะน/ะฟัะฐะฒ ะดะพัััะฟะฐ, ัะตััะธัะธะบะฐัะพะฒ ะธ ะผะฝะพะณะพะณะพ ะดััะณะพะณะพ ะฝะฐ ะฑะพะปััะธะฝััะฒะต ัะตัะฒะตัะพะฒ ะฝะฐ ะฑะฐะทะต Linux. ะะบะปััะฐะตั ะณัะฐัะธะบะธ ะธััะพัะธะธ ะฒัะตะผะตะฝะฝัั
ััะดะพะฒ ะธ ะพะฟะพะฒะตัะตะฝะธั ะฝะฐ ะพัะฝะพะฒะต ะฟะพัะพะณะพะฒัั
ะทะฝะฐัะตะฝะธะน ั ะฟะพะดะดะตัะถะบะพะน ntfy ะธ ะฒะตะฑั
ัะบะพะฒ.
+**ะะตััะธะบะธ ั
ะพััะพะฒ:**
+ะัะพัะตััะพั, ะฟะฐะผััั, ะดะธัะบ, ัะตัั, ัะตะผะฟะตัะฐัััะฐ, ะฒัะตะผั ัะฐะฑะพัั, ะฟัะพัะตััั, ะฟะพััั, ะฒั
ะพะดั ะฒ ัะธััะตะผั ะธ ัะฒะตะดะตะฝะธั ะพ ัะธััะตะผะต ะฝะฐ ะฑะพะปััะธะฝััะฒะต ัะตัะฒะตัะพะฒ Linux, ั ะณัะฐัะธะบะฐะผะธ ะทะฐ ะฟัะพัะปัะต ะฟะตัะธะพะดั. ะะฐััะพัะบะธ ัะฟัะฐะฒะปะตะฝะธั ะฟะพะทะฒะพะปััั ัะฐะฑะพัะฐัั ัะพ ัะปัะถะฑะฐะผะธ, ะทะฐะดะฐัะฐะผะธ cron, ะฟะฐะบะตัะฐะผะธ, ะฟะพะปัะทะพะฒะฐัะตะปัะผะธ, ะฟัะฐะฒะธะปะฐะผะธ ะฑัะฐะฝะดะผะฐัััะฐ, WireGuard, Tailscale, ัะตััะธัะธะบะฐัะฐะผะธ SSL, ะถััะฝะฐะปะฐะผะธ ะธ ะฟัะพะฒะตัะบะฐะผะธ ัะพััะพัะฝะธั, ะฝะต ะฒัั
ะพะดั ะธะท Termix.
-**ะััะตะฝัะธัะธะบะฐัะธั ะฟะพะปัะทะพะฒะฐัะตะปะตะน:**
-ะะตะทะพะฟะฐัะฝะพะต ัะฟัะฐะฒะปะตะฝะธะต ะฟะพะปัะทะพะฒะฐัะตะปัะผะธ ั ะฐะดะผะธะฝะธัััะฐัะธะฒะฝัะผ ะบะพะฝััะพะปะตะผ (ะผะพะถะตั ัะตะดะฐะบัะธัะพะฒะฐัั ะธะฝัะพัะผะฐัะธั ะดััะณะธั
ะฟะพะปัะทะพะฒะฐัะตะปะตะน) ะธ ะฟะพะดะดะตัะถะบะพะน OIDC/LDAP/SSO (ั ะบะพะฝััะพะปะตะผ ะดะพัััะฟะฐ), 2FA (TOTP) ะธ ะฟะพะดะดะตัะถะบะพะน ะบะปััะตะน ะดะพัััะฟะฐ (WebAuthn). ะัะพัะผะพัั ะฐะบัะธะฒะฝัั
ัะตััะธะน ะฟะพะปัะทะพะฒะฐัะตะปะตะน ะฝะฐ ะฒัะตั
ะฟะปะฐััะพัะผะฐั
ะธ ะพัะทัะฒ ะฟัะฐะฒ ะดะพัััะฟะฐ. ะกะฒัะทัะฒะฐะฝะธะต ะฐะบะบะฐัะฝัะพะฒ OIDC/ะปะพะบะฐะปัะฝัั
ะฐะบะบะฐัะฝัะพะฒ. ะัะพัะผะพัั ะถััะฝะฐะปะฐ ะฐัะดะธัะฐ ะดะตะนััะฒะธะน ะฒัะตั
ะฟะพะปัะทะพะฒะฐัะตะปะตะน.
+**ะะฒัะพะผะฐัะธะทะฐัะธะธ:**
+ะัะฑะตัะธัะต ัะพะฑััะธะต, ะฐ ะทะฐัะตะผ ะพะฟะธัะธัะต, ััะพ ะดะพะปะถะฝะพ ะฟัะพะธะทะพะนัะธ. ะกะพะฑััะธะตะผ ะผะพะถะตั ะฑััั ะฟัะตะฒััะตะฝะธะต ะฟะพัะพะณะฐ ะผะตััะธะบะพะน, ั
ะพัั, ะบะพัะพััะน ัะฟะฐะป ะธะปะธ ะฒะตัะฝัะปัั, ะธะทะผะตะฝะตะฝะธะต ะฟัะพะฒะตัะบะธ ัะพััะพัะฝะธั, ัะฐัะฟะธัะฐะฝะธะต, ัะพะฑััะธะต ะบะพะฝัะตะนะฝะตัะฐ ะธะปะธ ะฒั
ะพะดััะธะน webhook. ะจะฐะณะธ ัะผะตัั ะฒัะฟะพะปะฝััั ะบะพะผะฐะฝะดั ะธ ัะฝะธะฟะฟะตัั, ัะฟัะฐะฒะปััั ะบะพะฝัะตะนะฝะตัะฐะผะธ ะธ ััะฝะฝะตะปัะผะธ, ะฑัะดะธัั ั
ะพัั, ะพะฑัะฐัะฐัััั ะฟะพ ะฐะดัะตัั, ะถะดะฐัั, ะฒะตัะฒะธัััั ะฟะพ ััะปะพะฒะธั, ะทะฐะฟััะบะฐัั ะดััะณัั ะฐะฒัะพะผะฐัะธะทะฐัะธั ะธ ะฟัะธััะปะฐัั ัะฒะตะดะพะผะปะตะฝะธั ัะตัะตะท ntfy, Discord ะธะปะธ webhook. ะขะตััะพะฒัะน ะทะฐะฟััะบ ะฟะพะทะฒะพะปัะตั ะฒัั ะฑะตะทะพะฟะฐัะฝะพ ะฟัะพะฒะตัะธัั.
-**ะะฝัะตะณัะฐัะธั ั Tailscale:**
-ะกะฟะธัะพะบ ััััะพะนััะฒ ะฒะฐัะตะน ัะตัะธ Tailscale ะดะปั ะฑััััะพะณะพ ะดะพะฑะฐะฒะปะตะฝะธั ะธั
ะฒ ะบะฐัะตััะฒะต ั
ะพััะพะฒ ะธ ะฟะพะดะบะปััะตะฝะธะต ัะตัะตะท Tailscale SSH ะฒ ะบะฐัะตััะฒะต ะผะตัะพะดะฐ ะฐััะตะฝัะธัะธะบะฐัะธะธ, ะฟะพะทะฒะพะปัั ACL ะฒะฐัะตะน ัะตัะธ ัะฟัะฐะฒะปััั ะฐะฒัะพัะธะทะฐัะธะตะน ะฑะตะท ั
ัะฐะฝะตะฝะธั ััััะฝัั
ะดะฐะฝะฝัั
.
+**ะคะปะพัั:**
+ะะฑัะตะดะธะฝัะนัะต ั
ะพััั ะฒะพ ัะปะพั ะฒัััะฝัั ะธะปะธ ะฟะพ ะฟัะฐะฒะธะปะฐะผ ะผะตัะพะบ, ััะพะฑั ะฝะพะฒัะต ั
ะพััั ะฟะพะฟะฐะดะฐะปะธ ััะดะฐ ัะฐะผะธ. ะัะฟะพะปะฝัะนัะต ะพะดะฝั ะบะพะผะฐะฝะดั ััะฐะทั ะฝะฐ ะฒัะตั
ั
ะพััะฐั
, ะพัะฟัะฐะฒะปัะนัะต ะธ ะทะฐะฑะธัะฐะนัะต ัะฐะนะปั ัะพ ะฒัะตั
, ัััะฐะฝะฐะฒะปะธะฒะฐะนัะต ะฟะฐะบะตัั ะธ ัะพะฑะธัะฐะนัะต ัะฒะพะดะบั ะฟะพ ัะธััะตะผะต, ัะดัั, ะฐัั
ะธัะตะบัััะต ะธ ะฒัะตะผะตะฝะธ ัะฐะฑะพัั.
-**RBAC/ะะฑัะธะน ะดะพัััะฟ:**
-ะกะพะทะดะฐะฝะธะต ัะพะปะตะน ะธ ะฟัะตะดะพััะฐะฒะปะตะฝะธะต ะพะฑัะตะณะพ ะดะพัััะฟะฐ ะบ ั
ะพััะฐะผ ะดะปั ะฟะพะปัะทะพะฒะฐัะตะปะตะน/ัะพะปะตะน. ะะพะดะดะตัะถะธะฒะฐะตั ะฒัะต ัะธะฟั ะฐััะตะฝัะธัะธะบะฐัะธะธ ะธ ะฒัะต ะฟัะพัะพะบะพะปั ั
ะพััะพะฒ.
+**ะะ-ะฟะพะผะพัะฝะธะบ:**
+ะะตะพะฑัะทะฐัะตะปัะฝะฐั ะฒะพะทะผะพะถะฝะพััั, ะฒัะบะปััะตะฝะฝะฐั ะดะพ ัะตั
ะฟะพั, ะฟะพะบะฐ ะฒั ัะฐะผะธ ะตั ะฝะต ะฒะบะปััะธัะต. ะะพะดะบะปััะธัะต OpenAI, Anthropic, Gemini, Ollama ะธะปะธ ะปัะฑะพะน ัะพะฒะผะตััะธะผัะน ั OpenAI ะฐะดัะตั ะธ ัะฟัะฐัะธะฒะฐะนัะต ะพ ัะฒะพะตะน ัะธััะตะผะต. ะะฝ ัะธัะฐะตั ั
ะพััั, ัะปะพัั, ัะฝะธะฟะฟะตัั ะธ ะพะฟะพะฒะตัะตะฝะธั ะธ ะฟัะตะดะปะฐะณะฐะตั ะธะทะผะตะฝะตะฝะธั ะฝะฐ ะฒะฐัะต ััะฒะตัะถะดะตะฝะธะต, ะฐ ะฝะต ะฒะฝะพัะธั ะธั
ัะฐะผ. ะะพ ััััะฝัั
ะดะฐะฝะฝัั
, ะฟะพะปัะทะพะฒะฐัะตะปะตะน ะธ ะฝะฐัััะพะตะบ ะพะฝ ะฝะต ะดะพะฑะตััััั ะฝะธะบะพะณะดะฐ. ะะดะผะธะฝะธัััะฐัะพัั ะผะพะณัั ะพััะฐะฒะธัั ะตะณะพ ะฒัะบะปััะตะฝะฝัะผ ะดะปั ะฒัะตะน ัััะฐะฝะพะฒะบะธ, ะฐ ะฒั ะผะพะถะตัะต ัะบัััั ะตะณะพ ะตัั ะฟัะธ ะฟะตัะฒะธัะฝะพะน ะฝะฐัััะพะนะบะต.
-**ะะพัะปะตะดะพะฒะฐัะตะปัะฝัะต ะฟะพะดะบะปััะตะฝะธั:**
-ะะพะดะบะปััะตะฝะธะต ะบ ะฟะพัะปะตะดะพะฒะฐัะตะปัะฝัะผ ััััะพะนััะฒะฐะผ (ะผะฐัััััะธะทะฐัะพัั, ะบะพะผะผััะฐัะพัั, ะผะธะบัะพะบะพะฝััะพะปะปะตัั ะธ ั. ะด.) ะฝะฐะฟััะผัั ะธะท ะฑัะฐัะทะตัะฐ ะธะปะธ ะฟัะธะปะพะถะตะฝะธั ะดะปั ัะฐะฑะพัะตะณะพ ััะพะปะฐ. ะะฐัััะพะนะบะฐ ัะบะพัะพััะธ ะฟะตัะตะดะฐัะธ ะดะฐะฝะฝัั
, ะฑะธัะพะฒ ะดะฐะฝะฝัั
, ััะพะฟ-ะฑะธัะพะฒ ะธ ัััะฝะพััะธ. ะัะฟะพะปัะทัะตั Web Serial API ะฒ ะฟะพะดะดะตัะถะธะฒะฐะตะผัั
ะฑัะฐัะทะตัะฐั
ะธะปะธ ะฝะฐัะธะฒะฝัะน ะฑัะบะตะฝะด ะฒ ะฟัะธะปะพะถะตะฝะธะธ Electron.
+**ะั
ะพะด ะธ ะฟะพะปัะทะพะฒะฐัะตะปะธ:**
+ะะพะบะฐะปัะฝัะต ััััะฝัะต ะทะฐะฟะธัะธ, ะฐ ัะฐะบะถะต ะฒั
ะพะด ัะตัะตะท OIDC, LDAP, GitHub ะธ Google, ั ะดะฒัั
ัะฐะบัะพัะฝะพะน ะฟัะพะฒะตัะบะพะน (TOTP), ะบะปััะฐะผะธ ะดะพัััะฟะฐ (WebAuthn) ะธ ะดะพะฒะตัะตะฝะฝัะผะธ ััััะพะนััะฒะฐะผะธ. ะะดะผะธะฝะธัััะฐัะพัั ะผะพะณัั ัะฟัะฐะฒะปััั ะฟะพะปัะทะพะฒะฐัะตะปัะผะธ, ัะพะฟะพััะฐะฒะปััั ะณััะฟะฟั OIDC ั ัะพะปัะผะธ, ะฒะธะดะตัั ะฒัะต ะฐะบัะธะฒะฝัะต ัะตััะธะธ ะฝะฐ ะฒัะตั
ะฟะปะฐััะพัะผะฐั
ะธ ะทะฐะฒะตััะฐัั ะธั
. ะกะฒัะถะธัะต ะปะพะบะฐะปัะฝัั ััััะฝัั ะทะฐะฟะธัั ั OIDC ะธ ัะผะพััะธัะต ะถััะฝะฐะป ะฐัะดะธัะฐ ะดะตะนััะฒะธะน ะบะฐะถะดะพะณะพ.
+**ะ ะพะปะธ ะธ ะพะฑัะธะน ะดะพัััะฟ:**
+ะกะพะทะดะฐะฒะฐะนัะต ัะพะปะธ ะธ ะดะตะปะธัะตัั ั
ะพััะฐะผะธ ั ะฟะพะปัะทะพะฒะฐัะตะปัะผะธ ะธะปะธ ัะพะปัะผะธ ะฝะฐ ัะตััััั
ััะพะฒะฝัั
: ะฟะพะดะบะปััะตะฝะธะต, ะฟัะพัะผะพัั, ะธะทะผะตะฝะตะฝะธะต ะธ ัะฟัะฐะฒะปะตะฝะธะต. ะ ะฐะฑะพัะฐะตั ัะพ ะฒัะตะผะธ ัะฟะพัะพะฑะฐะผะธ ะฐััะตะฝัะธัะธะบะฐัะธะธ ะธ ะฒัะตะผะธ ะฟัะพัะพะบะพะปะฐะผะธ, ะฐ ััััะฝัะต ะดะฐะฝะฝัะต ะดะปั ะพะฑัะตะณะพ ั
ะพััะฐ ะผะพะถะฝะพ ะฟะตัะตะพะฟัะตะดะตะปะธัั.
+
+
+
+
+
+
**ะะฟะพะฒะตัะตะฝะธั:**
-ะะฐัััะพะนัะต ะฟัะฐะฒะธะปะฐ ะพะฟะพะฒะตัะตะฝะธะน ะฝะฐ ะพัะฝะพะฒะต ะฟะพัะพะณะพะฒัั
ะทะฝะฐัะตะฝะธะน ะดะปั ะผะตััะธะบ ั
ะพััะฐ (CPU, ะฟะฐะผััั, ะดะธัะบ ะธ ั. ะด.) ะธ ะฟะพะปััะฐะนัะต ัะฒะตะดะพะผะปะตะฝะธั ัะตัะตะท ntfy ะธะปะธ ะฒะตะฑั
ัะบะธ ะฟัะธ ะธั
ััะฐะฑะฐััะฒะฐะฝะธะธ. ะัะพัะผะฐััะธะฒะฐะนัะต ะฐะบัะธะฒะฝัะต ะธ ัะฐะทัะตััะฝะฝัะต ะพะฟะพะฒะตัะตะฝะธั ะฒ ะถััะฝะฐะปะต ะธััะพัะธะธ.
+ะะฐะดะฐะนัะต ะฟัะฐะฒะธะปะฐ ะฟะพ ะผะตััะธะบะฐะผ ั
ะพััะพะฒ, ะฝะฐะฟัะธะผะตั ะฟัะพัะตััะพัั, ะฟะฐะผััะธ ะธ ะดะธัะบั, ะธ ะฟะพะปััะฐะนัะต ัะฒะตะดะพะผะปะตะฝะธั ัะตัะตะท ntfy, Discord ะธะปะธ webhook, ะบะพะณะดะฐ ะพะฝะธ ััะฐะฑะฐััะฒะฐัั. ะกะผะพััะธัะต ะฐะบัะธะฒะฝัะต ะธ ัะถะต ัะฝัััะต ะพะฟะพะฒะตัะตะฝะธั ะฒ ะถััะฝะฐะปะต ะธ ัะฑะธัะฐะนัะต ัะต, ััะพ ะฒะฐะผ ะฝะต ะฝัะถะฝั.
-
-
**ะะพะผะฐัะฝัั ัััะฐะฝะธัะฐ:**
-ะะพะปะฝะพัััั ะฝะฐัััะฐะธะฒะฐะตะผะฐั ะดะพะผะฐัะฝัั ัััะฐะฝะธัะฐ ั ัะตัะบะพะน ะฒะธะดะถะตัะพะฒ ั ะฟะตัะตัะฐัะบะธะฒะฐะฝะธะตะผ. ะะพะฑะฐะฒะปัะนัะต ะฒะธะดะถะตัั ะดะปั ััะฐัััะฐ ั
ะพััะฐ, ัััะปะพะบ ะฝะฐ ัะตัะฒะธัั, ัะฐัะพะฒ, ะทะฐะผะตัะพะบ, RSS-ะปะตะฝั, ะฟะพะณะพะดั, ะบะพะฝัะตะนะฝะตัะพะฒ Docker, ะณัะฐัะธะบะพะฒ ะผะตััะธะบ ั
ะพััะฐ, ะฒัััะพะตะฝะฝัั
ัะตัะผะธะฝะฐะปะพะฒ, iframe ะธ ะผะฝะพะณะพะณะพ ะดััะณะพะณะพ.
-
-
-
-
-**ะจะธััะพะฒะฐะฝะธะต ะฑะฐะทั ะดะฐะฝะฝัั
:**
-ะัะบะตะฝะด ั
ัะฐะฝะธััั ะฒ ะฒะธะดะต ะทะฐัะธััะพะฒะฐะฝะฝัั
ัะฐะนะปะพะฒ ะฑะฐะทั ะดะฐะฝะฝัั
SQLite. ะะพะดัะพะฑะฝะตะต ะฒ [ะดะพะบัะผะตะฝัะฐัะธะธ](https://docs.termix.site/security).
+ะกะตัะบะฐ ะฒะธะดะถะตัะพะฒ, ะบะพัะพััั ะฒั ัะพะฑะธัะฐะตัะต ัะฐะผะธ ะฟะตัะตัะฐัะบะธะฒะฐะฝะธะตะผ. ะััั ะฒะธะดะถะตัั ะดะปั ัะพััะพัะฝะธั ั
ะพััะพะฒ, ะฟะธะฝะณะพะฒ, ัััะปะพะบ ะฝะฐ ัะตัะฒะธัั, ะทะฐะบะปะฐะดะพะบ, ะฟะพะธัะบะฐ, ัะฐัะพะฒ, ะบะฐะปะตะฝะดะฐัะตะน, ะพะฑัะฐัะฝะพะณะพ ะพัััััะฐ, ะทะฐะผะตัะพะบ, RSS, ะฟะพะณะพะดั, ะธะทะพะฑัะฐะถะตะฝะธะน, ะฒัััะพะตะฝะฝัั
ัััะฐะฝะธั, Docker, ััะฝะฝะตะปะตะน, ะณัะฐัะธะบะพะฒ ะผะตััะธะบ, ัะฒะพะธั
API ะธ ะดะฐะถะต ะถะธะฒะพะณะพ ัะตัะผะธะฝะฐะปะฐ.
-**ะกะตัะตะฒะพะน ะณัะฐั:**
-ะะฐัััะพะนัะต ะฟะฐะฝะตะปั ัะฟัะฐะฒะปะตะฝะธั ะดะปั ะฒะธะทัะฐะปะธะทะฐัะธะธ ะฒะฐัะตะน ะดะพะผะฐัะฝะตะน ะปะฐะฑะพัะฐัะพัะธะธ ะฝะฐ ะพัะฝะพะฒะต SSH-ะฟะพะดะบะปััะตะฝะธะน ั ะฟะพะดะดะตัะถะบะพะน ััะฐัััะพะฒ.
+**ะกะฝะธะฟะฟะตัั ะธ ะธะฝััััะผะตะฝัั:**
+ะกะพั
ัะฐะฝัะนัะต ะบะพะผะฐะฝะดั, ะบะพัะพััะต ัะฐััะพ ะฝะฐะฑะธัะฐะตัะต, ะธ ะทะฐะฟััะบะฐะนัะต ะธั
ะพะดะฝะธะผ ะฝะฐะถะฐัะธะตะผ, ั ะฟะตัะตะผะตะฝะฝัะผะธ ะดะปั ั
ะพััะฐ ะธ ะดะปั ัะพะฑััะฒะตะฝะฝะพะณะพ ะฒะฒะพะดะฐ. ะัะฟะพะปะฝัะนัะต ะพะดะฝั ะบะพะผะฐะฝะดั ััะฐะทั ะฒะพ ะฒัะตั
ะพัะบััััั
ัะตัะผะธะฝะฐะปะฐั
ะธ ะธัะธัะต ะฟะพ ะธััะพัะธะธ ะบะพะผะฐะฝะด ั ะฐะฒัะพะดะพะฟะพะปะฝะตะฝะธะตะผ.
-**ะะฝััััะผะตะฝัั SSH:**
-ะกะพะทะดะฐะฝะธะต ะฟะตัะตะธัะฟะพะปัะทัะตะผัั
ััะฐะณะผะตะฝัะพะฒ ะบะพะผะฐะฝะด, ะฒัะฟะพะปะฝัะตะผัั
ะพะดะฝะธะผ ะฝะฐะถะฐัะธะตะผ. ะะฐะฟััะบ ะพะดะฝะพะน ะบะพะผะฐะฝะดั ะพะดะฝะพะฒัะตะผะตะฝะฝะพ ะฒ ะฝะตัะบะพะปัะบะธั
ะพัะบััััั
ัะตัะผะธะฝะฐะปะฐั
.
+**ะะฑัะธะน ะดะพัััะฟ ะบ ัะตััะธะธ:**
+ะะตะปะธัะตัั ะถะธะฒะพะน ัะตััะธะตะน ัะตัะผะธะฝะฐะปะฐ, RDP, VNC ะธะปะธ Telnet. ะัะฟัะฐะฒััะต ัััะปะบั, ะฟะพ ะบะพัะพัะพะน ะผะพะถะฝะพ ะฟะพะดะบะปััะธัััั ะฑะตะท ััััะฝะพะน ะทะฐะฟะธัะธ, ะธะปะธ ะฟะพะดะตะปะธัะตัั ั ะบะพะฝะบัะตัะฝัะผ ะฟะพะปัะทะพะฒะฐัะตะปะตะผ Termix, ัะพะปัะบะพ ะดะปั ะฟัะพัะผะพััะฐ ะธะปะธ ั ะฟัะฐะฒะพะผ ะฒะฒะพะดะฐ. ะะพัััะฟ ะผะพะถะตั ะธััะตะบะฐัั ัะฐะผ ะธะปะธ ะพัะทัะฒะฐัััั ะฒ ะปัะฑะพะน ะผะพะผะตะฝั, ะธ ะตะณะพ ะผะพะถะฝะพ ะพัะบะปััะธัั ะฟะพะปะฝะพัััั ะธะปะธ ะดะปั ะพัะดะตะปัะฝะพะณะพ ั
ะพััะฐ.
-**ะะพััะพัะฝะฝัะต ะฒะบะปะฐะดะบะธ:**
-SSH-ัะตััะธะธ ะธ ะฒะบะปะฐะดะบะธ ะพััะฐัััั ะพัะบััััะผะธ ะฝะฐ ะฒัะตั
ััััะพะนััะฒะฐั
/ะฟัะธ ะพะฑะฝะพะฒะปะตะฝะธะธ ัััะฐะฝะธัั, ะตัะปะธ ะฒะบะปััะตะฝะพ ะฒ ะฟัะพัะธะปะต ะฟะพะปัะทะพะฒะฐัะตะปั.
+**ะะฐะฟะธัั ัะตััะธะน ะธ ะถััะฝะฐะปั:**
+ะะฐะฟะธััะฒะฐะนัะต ัะตััะธะธ ัะตัะผะธะฝะฐะปะฐ, RDP ะธ VNC ะธ ะฟัะพัะผะฐััะธะฒะฐะนัะต ะธั
ะฟะพะทะถะต. ะกะบะฐัะธะฒะฐะนัะต ัะตะบััะพะฒัะต ะถััะฝะฐะปั ัะตััะธะธ ะธ ะทะฐะณะปัะดัะฒะฐะนัะต ะฒ ะถััะฝะฐะป ะฟะพะดะบะปััะตะฝะธั, ััะพะฑั ัะฒะธะดะตัั, ััะพ ะธะผะตะฝะฝะพ ะฟัะพะธัั
ะพะดะธะปะพ ะฒะพ ะฒัะตะผั ัะพะตะดะธะฝะตะฝะธั.
+
+
+
+
+**ะะพัะปะตะดะพะฒะฐัะตะปัะฝัะต ะฟะพะดะบะปััะตะฝะธั:**
+ะะฑัะฐะนัะตัั ั ะฟะพัะปะตะดะพะฒะฐัะตะปัะฝัะผะธ ััััะพะนััะฒะฐะผะธ ะฒัะพะดะต ะผะฐัััััะธะทะฐัะพัะพะฒ, ะบะพะผะผััะฐัะพัะพะฒ ะธ ะผะธะบัะพะบะพะฝััะพะปะปะตัะพะฒ ะธะท ะฑัะฐัะทะตัะฐ ะธะปะธ ะฝะฐััะพะปัะฝะพะณะพ ะฟัะธะปะพะถะตะฝะธั. ะะฐัััะฐะธะฒะฐะนัะต ัะบะพัะพััั, ะฑะธัั ะดะฐะฝะฝัั
, ััะพะฟะพะฒัะต ะฑะธัั ะธ ัััะฝะพััั. ะ ะฟะพะดั
ะพะดััะธั
ะฑัะฐัะทะตัะฐั
ะธัะฟะพะปัะทัะตััั Web Serial API, ะฐ ะฒ ะฝะฐััะพะปัะฝะพะผ ะฟัะธะปะพะถะตะฝะธะธ ัะพะฑััะฒะตะฝะฝัะน ะฑัะบะตะฝะด.
+
+
+
+
+
+
+**Tailscale:**
+ะะพะดััะณะธะฒะฐะนัะต ััััะพะนััะฒะฐ ะธะท ัะฒะพะตะน tailnet, ััะพะฑั ะดะพะฑะฐะฒะธัั ะธั
ะบะฐะบ ั
ะพััั ะฒ ะฟะฐัั ะฝะฐะถะฐัะธะน, ะธ ะฟะพะดะบะปััะฐะนัะตัั ัะตัะตะท Tailscale SSH: ะดะพัััะฟะพะผ ะทะฐะนะผัััั ะฟัะฐะฒะธะปะฐ tailnet, ะฐ ััััะฝัะต ะดะฐะฝะฝัะต ั
ัะฐะฝะธัั ะฝะต ะฟัะธะดัััั. Headscale ะธ ัะฒะพะธ ะฐะดัะตัะฐ ัะพะถะต ัะฐะฑะพัะฐัั.
+
+
+
+
+**Proxmox:**
+ะะผะฟะพััะธััะนัะต ั
ะพััั ะฟััะผะพ ะธะท ัััะฐะฝะพะฒะบะธ Proxmox ะธ ัะปะตะดะธัะต ะทะฐ ะฟะพะบะฐะทะฐัะตะปัะผะธ ัะทะปะพะฒ ะธ ะณะพััะตะฒัั
ะผะฐัะธะฝ, ะฒะบะปััะฐั ะฟัะพัะตััะพั, ะฟะฐะผััั ะธ ั
ัะฐะฝะธะปะธัะต, ะฝะฐ ะพัะดะตะปัะฝะพะน ะฒะบะปะฐะดะบะต.
+
+
+
+
+
+
+**ะ ะฐะฑะพัะธะต ะฟัะพัััะฐะฝััะฒะฐ ะธ ะฒะบะปะฐะดะบะธ:**
+ะกะพั
ัะฐะฝะธัะต ะฝะฐะฑะพั ะฒะบะปะฐะดะพะบ ะฒะผะตััะต ั ัะฐะทะดะตะปะตะฝะธะตะผ ัะบัะฐะฝะฐ ะธ ะพัะบัะพะนัะต ะฒัั ััะพ ะพะดะฝะธะผ ะฝะฐะถะฐัะธะตะผ. Termix ะฟะพะผะฝะธั ะธ ะฟะพัะปะตะดะฝัั ัะตััะธั, ะฟะพััะพะผั ะฒะบะปะฐะดะบะธ ะฒะพะทะฒัะฐัะฐัััั ะฟะพัะปะต ะพะฑะฝะพะฒะปะตะฝะธั ัััะฐะฝะธัั ะธ ะฝะฐ ะดััะณะธั
ััััะพะนััะฒะฐั
.
+
+
+
+
+**ะะพัะฐะณะพะฒะฐั ะฝะฐัััะพะนะบะฐ:**
+ะะพัะพัะบะฐั ะฝะฐัััะพะนะบะฐ ะฟะพะผะพะถะตั ะฒัะฑัะฐัั ัะฐะฑะปะพะฝ ะธะฝัะตััะตะนัะฐ, ัะตะผั, ะฝัะถะฝัะต ะฒะพะทะผะพะถะฝะพััะธ ะธ ะฟะตัะฒัะน ั
ะพัั. ะัะพััะพะน ัะตะถะธะผ ัะบััะฒะฐะตั ัะพ, ัะตะผ ะฒั ะฝะต ะฟะพะปัะทัะตัะตัั, ะฐ ะฝะฐัััะพะนะบั ะผะพะถะฝะพ ะฟัะพะนัะธ ะทะฐะฝะพะฒะพ ะธะปะธ ัะผะตะฝะธัั ัะฐะฑะปะพะฝ ะฒ ะปัะฑะพะน ะผะพะผะตะฝั.
+
+
+
+
+
+
+**ะะฒัะพะฝะพะผะฝัะน ะบะปะธะตะฝั ะธ ัะธะฝั
ัะพะฝะธะทะฐัะธั:**
+ะะฐััะพะปัะฝะพะต ะฟัะธะปะพะถะตะฝะธะต ัะฐะฑะพัะฐะตั ัะฐะผะพ ะฟะพ ัะตะฑะต, ัะพ ัะฒะพะธะผ ะฑัะบะตะฝะดะพะผ ะธ ะฑะฐะทะพะน ะดะฐะฝะฝัั
, ะฑะตะท ัะตัะฒะตัะฐ. ะะณะพ ะผะพะถะฝะพ ะฟะพะดะบะปััะธัั ะบ ัะตัะฒะตัั Termix, ััะพะฑั ะฒ ะพะฑะต ััะพัะพะฝั ัะธะฝั
ัะพะฝะธะทะธัะพะฒะฐัั ั
ะพััั, ััััะฝัะต ะดะฐะฝะฝัะต, ัะฝะธะฟะฟะตัั ะธ ะพััะฐะปัะฝะพะต, ะธ ะฒัะฑัะฐัั, ะพัะบัะดะฐ ะธะดัั ะฟะพะดะบะปััะตะฝะธั: ั ะฒะฐัะตะณะพ ะบะพะผะฟัััะตัะฐ ะธะปะธ ัะตัะตะท ัะตัะฒะตั.
+
+
+
+
+**ะะพะผะฐะฝะดะฝะฐั ัััะพะบะฐ:**
+CLI `termix` ะดะปั ะฒะฐัะตะน ะพะฑะพะปะพัะบะธ ะธ ะฒะฐัะธั
ัะบัะธะฟัะพะฒ. ะัะบััะฒะฐะนัะต ัะตัะผะธะฝะฐะปั, ะฒัะฟะพะปะฝัะนัะต ะบะพะผะฐะฝะดั ะฝะฐ ะพะดะฝะพะผ ั
ะพััะต ะธะปะธ ะฝะฐ ัะตะปะพะผ ัะปะพัะต, ะฟะตัะตะผะตัะฐะนัะต ัะฐะนะปั ะฟะพ SFTP ะธ ัะฟัะฐะฒะปัะนัะต ั
ะพััะฐะผะธ, ัะฝะธะฟะฟะตัะฐะผะธ ะธ ััััะฝัะผะธ ะดะฐะฝะฝัะผะธ. ะฃััะฐะฝะพะฒะธัะต ัะตัะตะท `npm install -g @termix-cli/cli` ะธะปะธ ะฒะพะทัะผะธัะต ะพัะดะตะปัะฝัะน ะธัะฟะพะปะฝัะตะผัะน ัะฐะนะป. ะกะผะพััะธัะต [ะดะพะบัะผะตะฝัะฐัะธั CLI](https://docs.termix.site/cli).
+
+
+
+
+
+
+**ะะตะทะพะฟะฐัะฝะพััั:**
+ะะฐัะพะปะธ, ะบะปััะธ ะธ ะดััะณะธะต ัะตะบัะตัั ัะธััััััั ะดะปั ะบะฐะถะดะพะณะพ ะฟะพะปัะทะพะฒะฐัะตะปั, ะฐ ัะฐะผะธ ัะฐะนะปั ะฑะฐะทั ะดะฐะฝะฝัั
ะผะพะถะฝะพ ะทะฐัะธััะพะฒะฐัั ะฝะฐ ะดะธัะบะต. ะะฐะบ ััะพ ััััะพะตะฝะพ, ะพะฟะธัะฐะฝะพ ะฒ [ะดะพะบัะผะตะฝัะฐัะธะธ](https://docs.termix.site/security).
**ะฏะทัะบะธ:**
-ะัััะพะตะฝะฝะฐั ะฟะพะดะดะตัะถะบะฐ ะพะบะพะปะพ 30 ัะทัะบะพะฒ (ัะฟัะฐะฒะปัะตััั ัะตัะตะท [Crowdin](https://docs.termix.site/translations)).
+ะะบะพะปะพ 30 ะฒัััะพะตะฝะฝัั
ัะทัะบะพะฒ, ะบะพัะพััะต ะฒะตะดัััั ัะตัะตะท [Crowdin](https://docs.termix.site/translations).
@@ -196,20 +252,23 @@ SSH-ัะตััะธะธ ะธ ะฒะบะปะฐะดะบะธ ะพััะฐัััั ะพัะบััััะผะธ ะฝะฐ ะฒั
-ะะพะปััะต ะฒะพะทะผะพะถะฝะพััะตะน ะััะณะธะต ะฒะพะทะผะพะถะฝะพััะธ
@@ -220,7 +279,7 @@ SSH-ัะตััะธะธ ะธ ะฒะบะปะฐะดะบะธ ะพััะฐัััั ะพัะบััััะผะธ ะฝะฐ ะฒั
ะะปะฐััะพัะผะฐ
-ะะธัััะธะฑััะธะฒ
+ะกะฟะพัะพะฑ ัััะฐะฝะพะฒะบะธ
Web
@@ -325,10 +410,6 @@ Termix ะฑะตัะฟะปะฐัะตะฝ ะธ ะธะผะตะตั ะพัะบััััะน ะธัั
ะพะดะฝัะน ะบะพะด
-
-
-
@@ -340,14 +421,17 @@ Termix ะฑะตัะฟะปะฐัะตะฝ ะธ ะธะผะตะตั ะพัะบััััะน ะธัั
ะพะดะฝัะน ะบะพะด
-
+
+
+
-ะะตะบะพัะพััะต ะฒะธะดะตะพ ะธ ะธะทะพะฑัะฐะถะตะฝะธั ะผะพะณัั ะฑััั ัััะฐัะตะฒัะธะผะธ ะธะปะธ ะฝะต ะฟะพะปะฝะพัััั ะพััะฐะถะฐัั ััะฝะบัะธะพะฝะฐะปัะฝะพััั.
+ะะตะบะพัะพััะต ะฒะธะดะตะพ ะธ ะธะทะพะฑัะฐะถะตะฝะธั ะผะพะณัั ัััะฐัะตัั ะธะปะธ ะฝะต ะฟะพะปะฝะพัััั ะฟะพะบะฐะทัะฒะฐัั ะฒะพะทะผะพะถะฝะพััะธ.
@@ -407,10 +491,10 @@ Termix ะฑะตัะฟะปะฐัะตะฝ ะธ ะธะผะตะตั ะพัะบััััะน ะธัั
ะพะดะฝัะน ะบะพะด
## ะะฐะฟะปะฐะฝะธัะพะฒะฐะฝะฝัะต ััะฝะบัะธะธ
-ะกะผะพััะธัะต [ะัะพะตะบัั](https://github.com/orgs/Termix-SSH/projects/5) ะดะปั ะฟัะพัะผะพััะฐ ะฒัะตั
ะทะฐะฟะปะฐะฝะธัะพะฒะฐะฝะฝัั
ััะฝะบัะธะน. ะัะปะธ ะฒั ั
ะพัะธัะต ะฒะฝะตััะธ ะฒะบะปะฐะด, ัะผะพััะธัะต [ะฃัะฐััะธะต ะฒ ัะฐะทัะฐะฑะพัะบะต](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+ะัะต ะทะฐะฟะปะฐะฝะธัะพะฒะฐะฝะฝัะต ััะฝะบัะธะธ ัะพะฑัะฐะฝั ะฒ [Projects](https://github.com/orgs/Termix-SSH/projects/5). ะัะปะธ ั
ะพัะธัะต ะฟะพััะฐััะฒะพะฒะฐัั, ะฟะพัะผะพััะธัะต [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
Termix
-Kendi sunucunuzda barindirilan SSH yonetimi ve uzak masaustu erisimi
+Kendi sunucunuzda รงalฤฑลan sunucu yรถnetimi, SSH ve uzak masaรผstรผnden otomasyonlara kadar
English ยท
@@ -37,7 +37,7 @@
1 Eylรผl 2025'te kazanildi
+ 1 Eylรผl 2025 tarihinde kazanฤฑldฤฑ
-**SSH Terminal Erisimi:**
-Tarayici benzeri sekme sistemiyle bolunmus ekran destegine sahip (4 panele kadar) tam ozellikli terminal. Yaygin terminal temalari, yazi tipleri ve diger bilesenleri iceren terminal ozellestirme destegi.
+**SSH terminali:**
+Tarayฤฑcฤฑ gibi sekmeleri ve bรถlรผnmรผล ekranฤฑ olan tam donanฤฑmlฤฑ bir terminal, aynฤฑ anda 6 panele kadar. Temanฤฑzฤฑ, yazฤฑ tipinizi ve renklerinizi seรงin. Her oturumun รผstรผnde anlฤฑk CPU, bellek ve disk bilgisi gรถsteren bir araรง รงubuฤu ile o sunucunun dosyalarฤฑna, Docker'ฤฑna, tรผnellerine ve รถlรงรผmlerine giden kฤฑsayollar bulunur.
-**Uzak Masaustu Erisimi:**
-Tam ozellestirme ve bolunmus ekran ile tarayici uzerinden RDP, VNC ve Telnet destegi.
+**Uzak masaรผstรผ:**
+Tarayฤฑcฤฑda RDP, VNC ve Telnet; diฤer oturumlar gibi sekmelerde ve bรถlรผnmรผล ekranda. RDP sรผrรผcรผleri iรงin dosya tarayฤฑcฤฑsฤฑ ve sรผrรผkle bฤฑrak yรผkleme iรงerir. Windows masaรผstรผnde bir sunucuyu yerel RDP istemcisinde de aรงabilirsiniz.
-**SSH Tunel Yonetimi:**
-Otomatik yeniden baglanti, saglik izleme ve yerel, uzak veya dinamik SOCKS yonlendirme ile sunucular arasi SSH tunelleri olusturun ve yonetin. Masaustu istemci-sunucu tunel ayarlari her masaustu kurulumu icin yerel olarak depolanir; istege bagli C2S hazir ayar anlik goruntuleri, yerel bir tunel yapilandirmasini istemciler arasinda tasimak istediginizde sunucuya kaydedilebilir, yeniden adlandirilabilir, yuklenebilir veya silinebilir.
+**SSH tรผnelleri:**
+Yerel, uzak ve dinamik SOCKS yรถnlendirmesi; otomatik yeniden baฤlanma ve durum kontrolleriyle. Masaรผstรผ uygulamasฤฑndaki istemciden sunucuya tรผneller o makinede saklanฤฑr, ayarlarฤฑ sunucuya kaydederek bir kurulumu baลka bir makineye taลฤฑyabilirsiniz.
-**Uzak Dosya Yoneticisi:**
-Uzak sunuculardaki dosyalari dogrudan yonetin; kod, goruntu, ses ve video goruntuleme ve duzenleme destegi ile. Sudo destegi ile dosyalari sorunsuzca yukleyin, indirin, yeniden adlandirin, silin ve tasiyin. Dosyalari sunucudan sunucuya tasima destegini de icerir.
+**Dosya yรถneticisi:**
+SFTP รผzerinden dosyalara gรถz atฤฑn, dรผzenleyin, yรผkleyin, indirin, yeniden adlandฤฑrฤฑn, taลฤฑyฤฑn ve silin; sudo da kullanฤฑlabilir. Kod, gรถrsel, ses ve videoyu gรถrรผntรผleyip dรผzenleyin. Dosyalarฤฑ doฤrudan bir sunucudan diฤerine kopyalayฤฑn; en hฤฑzlฤฑ yol sizin iรงin seรงilir ve aktarฤฑmlarฤฑn bรผtรผnlรผฤรผ doฤrulanฤฑr.
-**Docker ve Podman Yonetimi:**
-Konteynerleri baslatฤฑn, durdurun, duraklatฤฑn, kaldirin. Konteyner istatistiklerini goruntuleyin. Docker exec terminali kullanarak konteyneri kontrol edin. Docker ve Podman'i konteyner calisma ortami olarak destekler. Portainer veya Dockge'nin yerini almak icin degil, konteynerlerinizi olusturmak yerine basitce yonetmek icin tasarlanmistir.
+**Docker ve Podman:**
+Kapsayฤฑcฤฑlarฤฑ baลlatฤฑn, durdurun, duraklatฤฑn ve silin, durumlarฤฑnฤฑ izleyin ve iรงlerinde bir kabuk aรงฤฑn. Hem Docker hem Podman ile รงalฤฑลฤฑr. Portainer ya da Dockge'nin yerini almak iรงin deฤil, hรขlihazฤฑrdaki kapsayฤฑcฤฑlarฤฑnฤฑzฤฑ yรถnetmek iรงin tasarlandฤฑ.
-**SSH Ana Bilgisayar Yoneticisi:**
-SSH baglantilarinizi etiketler ve klasorlerle (klasor ozellestirme ve ic ice klasor destegi ile) kaydedin, duzenleyin ve yonetin; yeniden kullanilabilir giris bilgilerini kolayca kaydedin ve SSH anahtarlarinin dagitimini otomatiklestirin.
+**Sunucu yรถneticisi:**
+Sunucularฤฑnฤฑzฤฑ etiketlerle ve isim ve renk verebileceฤiniz iรง iรงe klasรถrlerle dรผzenleyin. Kayฤฑtlฤฑ kimlik bilgilerini birden รงok sunucuda kullanฤฑn, SSH anahtarlarฤฑnฤฑ otomatik daฤฤฑtฤฑn, sunucularฤฑ bir รผst sunucunun altฤฑnda toplayฤฑn, toplu dรผzenleyip dฤฑลa aktarฤฑn ve kaydetmek istemediฤiniz tek seferlik baฤlantฤฑlar iรงin hฤฑzlฤฑ baฤlantฤฑyฤฑ kullanฤฑn.
-**Ana Bilgisayar Metrikleri:**
-Cogu Linux tabanli sunucularda calisan CPU, bellek, disk kullanimi, ag, calisma suresi, sistem bilgisi, guvenlik duvari, port izleme, gunluk goruntuleyici, kullanicilar/izinler, sertifikalar ve daha fazlasini goruntuleyin. Zaman serisi gecmis grafiklerini ve ntfy ile webhook destekli esik tabanli uyarilari icerir.
+**Sunucu รถlรงรผmleri:**
+รoฤu Linux sunucusunda CPU, bellek, disk, aฤ, sฤฑcaklฤฑk, รงalฤฑลma sรผresi, sรผreรงler, portlar, oturum aรงmalar ve sistem bilgisi; geรงmiล grafikleriyle birlikte. Yรถnetim kartlarฤฑ sayesinde servisleri, cron gรถrevlerini, paketleri, kullanฤฑcฤฑlarฤฑ, gรผvenlik duvarฤฑ kurallarฤฑnฤฑ, WireGuard'ฤฑ, Tailscale'i, SSL sertifikalarฤฑnฤฑ, gรผnlรผkleri ve saฤlฤฑk kontrollerini Termix'ten รงฤฑkmadan yรถnetirsiniz.
-**Kullanici Kimlik Dogrulama:**
-Yonetici kontrolleri (diger kullanicilarin bilgilerini duzenleyebilir), OIDC/LDAP/SSO (erisim kontrollu), 2FA (TOTP) ve passkey (WebAuthn) destegi ile guvenli kullanici yonetimi. Tum platformlardaki aktif kullanici oturumlarini goruntuleyin ve izinleri iptal edin. OIDC/Yerel hesaplarinizi birbirine baglayin. Tum kullanicilarin islemlerinin denetim gunlugunu goruntuleyin.
+**Otomasyonlar:**
+Bir tetikleyici seรงin, sonra ne olacaฤฤฑnฤฑ sรถyleyin. Tetikleyiciler arasฤฑnda bir รถlรงรผmรผn eลiฤi aลmasฤฑ, bir sunucunun dรผลmesi veya geri gelmesi, saฤlฤฑk kontrolรผnรผn deฤiลmesi, bir zamanlama, bir kapsayฤฑcฤฑ olayฤฑ ya da gelen bir webhook var. Adฤฑmlar komut ve parรงacฤฑk รงalฤฑลtฤฑrabilir, kapsayฤฑcฤฑ ve tรผnelleri yรถnetebilir, bir makineyi uyandฤฑrabilir, bir adrese istek atabilir, bekleyebilir, koลula gรถre dallanabilir, baลka bir otomasyonu รงalฤฑลtฤฑrabilir ve ntfy, Discord ya da webhook ile size haber verebilir. Deneme รงalฤฑลtฤฑrmalarฤฑ ile รถnce gรผvenle test edersiniz.
-**Tailscale Entegrasyonu:**
-Tailscale aginizdaki cihazlari listeleyerek hizlica ana bilgisayar olarak ekleyin ve kimlik dogrulama yontemi olarak Tailscale SSH kullanarak baglanin; bu sayede ag ACL'leriniz kimlik bilgileri depolamadan yetkilendirmeyi yonetir.
+**Filolar:**
+Sunucularฤฑ tek tek seรงerek ya da etiket kurallarฤฑyla bir filoda toplayฤฑn; yeni sunucular kendiliฤinden katฤฑlsฤฑn. Tek bir komutu tรผm sunucularda aynฤฑ anda รงalฤฑลtฤฑrฤฑn, hepsine dosya gรถnderip hepsinden dosya alฤฑn, paket kurun ve iลletim sistemi, รงekirdek, mimari ve รงalฤฑลma sรผresi dรถkรผmรผnรผ toplayฤฑn.
-**RBAC/Paylasim:**
-Roller olusturun ve ana bilgisayarlari kullanicilar/roller arasinda paylasin. Tum kimlik dogrulama turlerini ve tum ana bilgisayar protokollerini destekler.
+**Yapay zekรข asistanฤฑ:**
+ฤฐsteฤe baฤlฤฑdฤฑr ve siz aรงana kadar kapalฤฑdฤฑr. OpenAI, Anthropic, Gemini, Ollama ya da OpenAI uyumlu herhangi bir uรง noktayฤฑ baฤlayฤฑn ve kurulumunuz hakkฤฑnda sorular sorun. Sunucularฤฑ, filolarฤฑ, parรงacฤฑklarฤฑ ve uyarฤฑlarฤฑ okuyabilir; deฤiลiklikleri kendisi yapmak yerine onayฤฑnฤฑza sunar. Kimlik bilgilerine, kullanฤฑcฤฑlara ve ayarlara asla eriลemez. Yรถneticiler tรผm kurulum iรงin kapalฤฑ bฤฑrakabilir, siz de kurulum sฤฑrasฤฑnda gizleyebilirsiniz.
-**Seri Baglantilar:**
-Seri cihazlara (router, switch, mikrodenetleyici vb.) dogrudan tarayici veya masaustu uygulamasindan baglanin. Baud hizi, veri bitleri, durdurma bitleri ve parite yapilandirin. Desteklenen tarayicilarda Web Serial API, Electron uygulamasinda yerel arka ucu kullanir.
+**Giriล ve kullanฤฑcฤฑlar:**
+Yerel hesaplarฤฑn yanฤฑnda OIDC, LDAP, GitHub ve Google ile giriล; iki adฤฑmlฤฑ doฤrulama (TOTP), geรงiล anahtarlarฤฑ (WebAuthn) ve gรผvenilir cihazlar. Yรถneticiler kullanฤฑcฤฑlarฤฑ yรถnetebilir, OIDC gruplarฤฑnฤฑ rollerle eลleลtirebilir, tรผm platformlardaki etkin oturumlarฤฑ gรถrรผp sonlandฤฑrabilir. Yerel ve OIDC hesaplarฤฑnฤฑzฤฑ birbirine baฤlayฤฑn ve herkesin ne yaptฤฑฤฤฑnฤฑ denetim gรผnlรผฤรผnden okuyun.
-**Uyarilar:**
-Ana bilgisayar metrikleri (CPU, bellek, disk vb.) icin esik tabanli uyari kurallari belirleyin ve tetiklendiklerinde ntfy veya webhook araciligiyla bildirim alin. Gecmis gunlugunde tetiklenen ve cozulen uyarilari goruntuleyin.
+**Roller ve paylaลฤฑm:**
+Roller oluลturun ve sunucularฤฑ kullanฤฑcฤฑlar veya rollerle dรถrt dรผzeyde paylaลฤฑn: baฤlanma, gรถrรผntรผleme, dรผzenleme ve yรถnetme. Tรผm kimlik doฤrulama tรผrleri ve tรผm protokollerle รงalฤฑลฤฑr, paylaลฤฑlan bir sunucuda kullanฤฑlan kimlik bilgilerini deฤiลtirebilirsiniz.
-**Ana Sayfa:**
-Surukleme ve birakma widget izgarasina sahip tamamen ozellestirilebilir bir ana sayfa. Ana bilgisayar durumu, hizmet baglantilari, saatler, notlar, RSS besleme, hava durumu, Docker konteynerleri, ana bilgisayar metrik grafikleri, gomulu terminaller, iframe ve daha fazlasi icin widget ekleyin.
+**Uyarฤฑlar:**
+CPU, bellek ve disk gibi sunucu รถlรงรผmlerine kurallar koyun ve tetiklendiklerinde ntfy, Discord veya webhook ile haberdar olun. Devam eden ve รงรถzรผlen uyarฤฑlarฤฑ geรงmiลte gรถrรผn, ilgilenmediklerinizi kapatฤฑn.
-**Veritabani Sifreleme:**
-Arka uc, sifrelenmis SQLite veritabani dosyalari olarak depolanir. Daha fazla bilgi icin [belgelere](https://docs.termix.site/security) bakin.
+**Ana sayfa:**
+Kendi kurduฤunuz, sรผrรผkle bฤฑrak รงalฤฑลan bir bileลen ฤฑzgarasฤฑ. Sunucu durumu, ping, servis baฤlantฤฑlarฤฑ, yer imleri, arama, saatler, takvimler, geri sayฤฑmlar, notlar, RSS, hava durumu, gรถrseller, gรถmรผlรผ sayfalar, Docker, tรผneller, รถlรงรผm grafikleri, kendi API'leriniz ve hatta canlฤฑ bir terminal iรงin bileลenler var.
-**Ag Grafigi:**
-Kontrol panelinizi, SSH baglantilariniza dayali olarak ev laboratuvarinizi durum destegi ile gorselletirmek icin ozellestirin.
+**Parรงacฤฑklar ve araรงlar:**
+Sฤฑk kullandฤฑฤฤฑnฤฑz komutlarฤฑ kaydedin ve tek tฤฑkla รงalฤฑลtฤฑrฤฑn; sunucu iรงin ve kendi girdileriniz iรงin deฤiลkenler kullanabilirsiniz. Aynฤฑ komutu aรงฤฑk olan tรผm terminallerde รงalฤฑลtฤฑrฤฑn, komut geรงmiลinizde tamamlamayla arama yapฤฑn.
-**SSH Araclari:**
-Tek tiklamayla calistirilan yeniden kullanilabilir komut parcaciklari olusturun. Birden fazla acik terminalde ayni anda tek bir komut calistirin.
+**Oturum paylaลฤฑmฤฑ:**
+Canlฤฑ bir terminal, RDP, VNC veya Telnet oturumunu paylaลฤฑn. Hesap gerekmeden katฤฑlฤฑnabilen bir baฤlantฤฑ gรถnderin ya da belirli bir Termix kullanฤฑcฤฑsฤฑyla, salt okunur veya yazma yetkili olarak paylaลฤฑn. Paylaลฤฑmlar kendiliฤinden sona erebilir veya istediฤiniz an iptal edilebilir; tรผmรผyle ya da sunucu bazฤฑnda kapatฤฑlabilir.
-**Kalici Sekmeler:**
-Kullanici profilinde etkinlestirilmisse SSH oturumlari ve sekmeler cihazlar/yenilemeler arasinda acik kalir.
+**Oturum kaydฤฑ ve gรผnlรผkler:**
+Terminal, RDP ve VNC oturumlarฤฑnฤฑ kaydedin ve sonra izleyin. Bir oturumun dรผz metin gรผnlรผฤรผnรผ indirin, baฤlantฤฑ gรผnlรผฤรผne bakarak baฤlantฤฑ sฤฑrasฤฑnda tam olarak ne olduฤunu gรถrรผn.
+
+
+
+
+**Seri baฤlantฤฑlar:**
+Yรถnlendirici, anahtar ve mikrodenetleyici gibi seri cihazlarla tarayฤฑcฤฑdan veya masaรผstรผ uygulamasฤฑndan konuลun. Baud hฤฑzฤฑnฤฑ, veri bitlerini, dur bitlerini ve pariteyi ayarlayฤฑn. Destekleyen tarayฤฑcฤฑlarda Web Serial API'yi, masaรผstรผ uygulamasฤฑnda yerel bir arka ucu kullanฤฑr.
+
+
+
+
+
+
+**Tailscale:**
+Tailnet'inizdeki cihazlarฤฑ รงekip birkaรง tฤฑkla sunucu olarak ekleyin ve Tailscale SSH ile baฤlanฤฑn; eriลimi tailnet kurallarฤฑnฤฑz yรถnetsin, kimlik bilgisi saklamanฤฑz gerekmesin. Headscale ve รถzel uรง noktalar da รงalฤฑลฤฑr.
+
+
+
+
+**Proxmox:**
+Sunucularฤฑ doฤrudan bir Proxmox kurulumundan iรงe aktarฤฑn; dรผฤรผm ve misafir makinelerin CPU, bellek ve depolama dahil durumlarฤฑnฤฑ kendi sekmesinde izleyin.
+
+
+
+
+
+
+**รalฤฑลma alanlarฤฑ ve sekmeler:**
+Bir sekme grubunu bรถlรผnmรผล dรผzeniyle birlikte kaydedin ve hepsini tek tฤฑkla yeniden aรงฤฑn. Termix son oturumunuzu da hatฤฑrlar, bรถylece sayfayฤฑ yenileseniz de baลka cihaza geรงseniz de sekmeleriniz geri gelir.
+
+
+
+
+**Rehberli kurulum:**
+Kฤฑsa bir kurulum, arayรผz รถn ayarฤฑnฤฑ, temanฤฑzฤฑ, istediฤiniz รถzellikleri ve ilk sunucunuzu seรงmenizde size yol gรถsterir. Basit kip kullanmadฤฑฤฤฑnฤฑz ลeyleri gizler; kurulumu istediฤiniz zaman yeniden รงalฤฑลtฤฑrabilir veya รถn ayarฤฑ deฤiลtirebilirsiniz.
+
+
+
+
+
+
+**Baฤฤฑmsฤฑz masaรผstรผ ve eลitleme:**
+Masaรผstรผ uygulamasฤฑ kendi arka ucu ve veritabanฤฑyla tek baลฤฑna, sunucusuz รงalฤฑลฤฑr. ฤฐsterseniz bir Termix sunucusuna baฤlayฤฑp sunucularฤฑ, kimlik bilgilerini, parรงacฤฑklarฤฑ ve fazlasฤฑnฤฑ iki yรถnlรผ eลitleyebilir, baฤlantฤฑlarฤฑn kendi makinenizden mi yoksa sunucu รผzerinden mi kurulacaฤฤฑnฤฑ seรงebilirsiniz.
+
+
+
+
+**Komut satฤฑrฤฑ:**
+Kabuฤunuz ve betikleriniz iรงin bir `termix` CLI'ฤฑ. Terminal aรงฤฑn, tek bir sunucuda veya tรผm filoda komut รงalฤฑลtฤฑrฤฑn, SFTP ile dosya taลฤฑyฤฑn ve sunucularฤฑ, parรงacฤฑklarฤฑ ve kimlik bilgilerini yรถnetin. `npm install -g @termix-cli/cli` ile kurun ya da baฤฤฑmsฤฑz bir รงalฤฑลtฤฑrฤฑlabilir dosya edinin. [CLI belgelerine](https://docs.termix.site/cli) bakฤฑn.
+
+
+
+
+
+
+**Gรผvenlik:**
+Parolalar, anahtarlar ve diฤer gizli bilgiler kullanฤฑcฤฑ bazฤฑnda ลifrelenir, veritabanฤฑ dosyalarฤฑnฤฑn kendisi de diskte ลifrelenebilir. Nasฤฑl รงalฤฑลtฤฑฤฤฑ iรงin [belgelere](https://docs.termix.site/security) bakฤฑn.
**Diller:**
-Yaklasik 30 dil icin yerlesik destek ([Crowdin](https://docs.termix.site/translations) tarafindan yonetilir).
+Yaklaลฤฑk 30 dil yerleลik olarak gelir, [Crowdin](https://docs.termix.site/translations) รผzerinden yรถnetilir.
@@ -196,43 +252,46 @@ Yaklasik 30 dil icin yerlesik destek ([Crowdin](https://docs.termix.site/transla
-Daha fazla ozellik Daha fazla รถzellik
Platform
-Dagitim
+Daฤฤฑtฤฑm
Web Herhangi bir modern tarayici (Chrome, Safari, Firefox) ยท PWA destegi
+Gรผncel her tarayฤฑcฤฑ (Chrome, Safari, Firefox) ยท PWA desteฤi
Windows x64/ia32 Tasฤฑnabilir ยท MSI Yukleyici ยท Chocolatey
+Taลฤฑnabilir ยท MSI kurulumu ยท Chocolatey
Linux x64/ia32 Tasฤฑnabilir ยท AUR ยท AppImage ยท Deb ยท Flatpak
+Taลฤฑnabilir ยท AUR ยท AppImage ยท Deb ยท Flatpak
macOS x64/ia32, v12.0+
@@ -325,10 +410,6 @@ Gelistirmeyi desteklemek icin ucretli bir yerlesim ile ilgileniyor musunuz? [mai
-
-
-
@@ -340,18 +421,21 @@ Gelistirmeyi desteklemek icin ucretli bir yerlesim ile ilgileniyor musunuz? [mai
-
+
+
+
@@ -359,7 +443,7 @@ Termix ile ilgili yardima ihtiyaciniz varsa veya bir ozellik talep etmek istiyor
[](https://www.youtube.com/@TermixSSH/videos)
-YouTube'da guncelleme ozetlerini izleyin
+Gรผncelleme tanฤฑtฤฑmlarฤฑnฤฑ YouTube'da izleyin
-Bazi videolar ve gorseller guncel olmayabilir veya ozellikleri tam olarak yansitmayabilir.
+Bazฤฑ videolar ve gรถrseller gรผncelliฤini yitirmiล ya da รถzellikleri tam olarak gรถstermiyor olabilir.
Termix
-Quan ly SSH tu luu tru va truy cap may tinh tu xa
+Quแบฃn lรฝ mรกy chแปง tแปฑ lฦฐu trแปฏ, tแปซ SSH vร mรกy tรญnh tแปซ xa cho ฤแบฟn tแปฑ ฤแปng hoรก
English ยท
@@ -37,7 +37,7 @@
Dat duoc vao ngay 1 thang 9 nam 2025
+ ฤแบกt ฤฦฐแปฃc vร o ngร y 1 thรกng 9 nฤm 2025
-**Truy Cap Terminal SSH:**
-Terminal day du tinh nang voi ho tro chia man hinh (len den 4 bang) voi he thong tab kieu trinh duyet. Bao gom ho tro tuy chinh terminal bao gom cac chu de terminal pho bien, phong chu va cac thanh phan khac.
+**Terminal SSH:**
+Mแปt terminal ฤแบงy ฤแปง vแปi cรกc thแบป giแปng trรฌnh duyแปt vร chia ฤรดi mร n hรฌnh, tแปi ฤa 6 khung cรนng lรบc. Bแบกn tแปฑ chแปn giao diแปn, phรดng chแปฏ vร mร u sแบฏc. Phรญa trรชn mแปi phiรชn cรณ mแปt thanh cรดng cแปฅ hiแปn CPU, bแป nhแป vร แป ฤฤฉa theo thแปi gian thแปฑc, kรจm lแปi tแบฏt tแปi tแปp, Docker, tunnel vร sแป liแปu cแปงa mรกy chแปง ฤรณ.
-**Truy Cap Man Hinh Tu Xa:**
-Ho tro RDP, VNC va Telnet qua trinh duyet voi day du tuy chinh va chia man hinh.
+**Mรกy tรญnh tแปซ xa:**
+RDP, VNC vร Telnet ngay trong trรฌnh duyแปt, dรนng thแบป vร chia ฤรดi mร n hรฌnh nhฦฐ mแปi phiรชn khรกc. Cรณ trรฌnh duyแปt tแปp cho แป ฤฤฉa RDP vร tแบฃi lรชn bแบฑng cรกch kรฉo thแบฃ. Trรชn mรกy tรญnh Windows, bแบกn cรฒn cรณ thแป mแป mรกy chแปง bแบฑng แปฉng dแปฅng RDP cแปงa hแป ฤiแปu hร nh.
-**Quan Ly Duong Ham SSH:**
-Tao va quan ly duong ham SSH giua cac may chu voi tu dong ket noi lai, giam sat suc khoe va chuyen tiep cuc bo, tu xa hoac SOCKS dong. Cai dat duong ham tu may khach desktop den may chu duoc luu tru cuc bo cho moi ban cai dat desktop; cac snapshot C2S preset tuy chon co the duoc luu tren may chu, doi ten, tai hoac xoa khi ban muon di chuyen mot cau hinh duong ham cuc bo giua cac may khach.
+**Tunnel SSH:**
+Chuyแปn tiแบฟp cแปฅc bแป, tแปซ xa vร SOCKS ฤแปng, cรณ tแปฑ kแบฟt nแปi lแบกi vร kiแปm tra tรฌnh trแบกng. Tunnel tแปซ mรกy khรกch tแปi mรกy chแปง trong แปฉng dแปฅng mรกy tรญnh ฤฦฐแปฃc lฦฐu ngay trรชn mรกy ฤรณ, vร bแบกn cรณ thแป lฦฐu cแบฅu hรฌnh sแบตn lรชn mรกy chแปง ฤแป mang sang mรกy khรกc.
-**Trinh Quan Ly Tep Tu Xa:**
-Quan ly tep truc tiep tren may chu tu xa voi ho tro xem va chinh sua ma, hinh anh, am thanh va video. Tai len, tai xuong, doi ten, xoa va di chuyen tep lien mach voi ho tro sudo. Bao gom ho tro di chuyen tep tu may chu nay sang may chu khac.
+**Trรฌnh quแบฃn lรฝ tแปp:**
+Duyแปt, sแปญa, tแบฃi lรชn, tแบฃi xuแปng, ฤแปi tรชn, di chuyแปn vร xoรก tแปp qua SFTP, cรณ hแป trแปฃ sudo. Xem vร sแปญa mรฃ nguแปn, hรฌnh แบฃnh, รขm thanh vร video. Sao chรฉp tแปp thแบณng tแปซ mรกy chแปง nร y sang mรกy chแปง khรกc, hแป thแปng tแปฑ chแปn ฤฦฐแปng nhanh nhแบฅt vร kiแปm tra tรญnh toร n vแบนn khi truyแปn.
-**Quan Ly Docker va Podman:**
-Khoi dong, dung, tam dung, xoa container. Xem thong ke container. Dieu khien container bang terminal docker exec. Ho tro ca Docker va Podman lam moi truong chay container. Khong duoc tao ra de thay the Portainer hay Dockge ma don gian la de quan ly container cua ban thay vi tao moi chung.
+**Docker vร Podman:**
+Khแปi ฤแปng, dแปซng, tแบกm dแปซng vร xoรก container, xem thรดng sแป cแปงa chรบng vร mแป mแปt shell bรชn trong. Chแบกy ฤฦฐแปฃc vแปi cแบฃ Docker lแบซn Podman. Nรณ khรดng nhแบฑm thay thแบฟ Portainer hay Dockge, chแป ฤแป quแบฃn lรฝ nhแปฏng container bแบกn ฤรฃ cรณ.
-**Trinh Quan Ly May Chu SSH:**
-Luu, sap xep va quan ly cac ket noi SSH cua ban voi the va thu muc (ho tro tuy chinh thu muc va thu muc long nhau), de dang luu thong tin dang nhap co the tai su dung dong thoi co the tu dong hoa viec trien khai khoa SSH.
+**Quแบฃn lรฝ mรกy chแปง:**
+Lฦฐu vร sแบฏp xแบฟp mรกy chแปง bแบฑng thแบป vร thฦฐ mแปฅc lแปng nhau mร bแบกn cรณ thแป ฤแบทt tรชn vร tรด mร u. Dรนng lแบกi thรดng tin ฤฤng nhแบญp ฤรฃ lฦฐu cho nhiแปu mรกy chแปง, tแปฑ ฤแปng triแปn khai khoรก SSH, gom mรกy chแปง dฦฐแปi mแปt mรกy chแปง cha, sแปญa vร xuแบฅt hร ng loแบกt, vร dรนng kแบฟt nแปi nhanh cho nhแปฏng lแบงn kแบฟt nแปi mแปt lแบงn mร bแบกn khรดng muแปn lฦฐu.
-**Chi So May Chu:**
-Xem muc su dung CPU, bo nho, o dia, mang, thoi gian hoat dong, thong tin he thong, tuong lua, giam sat cong, trinh xem nhat ky, nguoi dung/quyen, chung chi va nhieu hon nua tren hau het cac may chu chay Linux. Bao gom bieu do lich su theo chuoi thoi gian va canh bao dua tren nguong voi ho tro ntfy va webhook.
+**Sแป liแปu mรกy chแปง:**
+CPU, bแป nhแป, แป ฤฤฉa, mแบกng, nhiแปt ฤแป, thแปi gian hoแบกt ฤแปng, tiแบฟn trรฌnh, cแปng, lฦฐแปฃt ฤฤng nhแบญp vร thรดng tin hแป thแปng trรชn hแบงu hแบฟt mรกy chแปง Linux, kรจm biแปu ฤแป lแปch sแปญ. Cรกc thแบป quแบฃn lรฝ cho phรฉp bแบกn xแปญ lรฝ dแปch vแปฅ, tรกc vแปฅ cron, gรณi phแบงn mแปm, ngฦฐแปi dรนng, luแบญt tฦฐแปng lแปญa, WireGuard, Tailscale, chแปฉng chแป SSL, nhแบญt kรฝ vร kiแปm tra tรฌnh trแบกng mร khรดng cแบงn rแปi Termix.
-**Xac Thuc Nguoi Dung:**
-Quan ly nguoi dung an toan voi quyen quan tri (co the chinh sua thong tin cua nguoi dung khac) va ho tro OIDC/LDAP/SSO (co kiem soat truy cap), 2FA (TOTP) va passkey (WebAuthn). Xem phien hoat dong cua nguoi dung tren tat ca cac nen tang va thu hoi quyen. Lien ket tai khoan OIDC/Noi bo cua ban voi nhau. Xem nhat ky kiem toan cac hanh dong cua tat ca nguoi dung.
+**Tแปฑ ฤแปng hoรก:**
+Chแปn mแปt ฤiแปu kiแปn kรญch hoแบกt, rแปi nรณi bแบกn muแปn ฤiแปu gรฌ xแบฃy ra. ฤiแปu kiแปn gแปm mแปt sแป liแปu vฦฐแปฃt ngฦฐแปกng, mแปt mรกy chแปง sแบญp hoแบทc sแปng lแบกi, kiแปm tra tรฌnh trแบกng thay ฤแปi, mแปt lแปch ฤแปnh sแบตn, mแปt sแปฑ kiแปn container, hoแบทc mแปt webhook gแปญi ฤแบฟn. Cรกc bฦฐแปc cรณ thแป chแบกy lแปnh vร ฤoแบกn lแปnh, ฤiแปu khiแปn container vร tunnel, ฤรกnh thแปฉc mรกy chแปง, gแปi mแปt ฤแปa chแป, chแป, rแบฝ nhรกnh theo ฤiแปu kiแปn, chแบกy mแปt tแปฑ ฤแปng hoรก khรกc, vร bรกo cho bแบกn qua ntfy, Discord hoแบทc webhook. Chแบกy thแปญ giรบp bแบกn kiแปm tra an toร n trฦฐแปc.
-**Tich Hop Tailscale:**
-Liet ke cac thiet bi trong mang Tailscale de nhanh chong them vao lam may chu, va ket noi bang Tailscale SSH lam phuong thuc xac thuc, de cac ACL mang xu ly uy quyen ma khong can luu tru thong tin xac thuc.
+**Nhรณm mรกy chแปง:**
+Gom mรกy chแปง vร o mแปt nhรณm bแบฑng cรกch tแปฑ chแปn hoแบทc theo luแบญt thแบป, ฤแป mรกy chแปง mแปi tแปฑ vร o nhรณm. Chแบกy mแปt lแปnh trรชn mแปi mรกy chแปง cรนng lรบc, ฤแบฉy vร lแบฅy tแปp trรชn tแบฅt cแบฃ, cร i gรณi phแบงn mแปm, vร thu thแบญp danh sรกch hแป ฤiแปu hร nh, nhรขn, kiแบฟn trรบc vร thแปi gian hoแบกt ฤแปng.
-**RBAC/Chia Se:**
-Tao vai tro va chia se may chu giua nguoi dung/vai tro. Ho tro tat ca cac loai xac thuc va tat ca cac giao thuc may chu.
+**Trแปฃ lรฝ AI:**
+Lร tuแปณ chแปn, vร tแบฏt cho ฤแบฟn khi bแบกn tแปฑ bแบญt. Kแบฟt nแปi OpenAI, Anthropic, Gemini, Ollama hoแบทc bแบฅt kแปณ endpoint tฦฐฦกng thรญch OpenAI nร o rแปi hแปi vแป hแป thแปng cแปงa bแบกn. Nรณ ฤแปc ฤฦฐแปฃc mรกy chแปง, nhรณm mรกy chแปง, ฤoแบกn lแปnh vร cแบฃnh bรกo, vร ฤแป xuแบฅt thay ฤแปi ฤแป bแบกn duyแปt chแปฉ khรดng tแปฑ lร m. Nรณ khรดng bao giแป chแบกm ฤฦฐแปฃc vร o thรดng tin ฤฤng nhแบญp, ngฦฐแปi dรนng hay thiแบฟt lแบญp. Quแบฃn trแป viรชn cรณ thแป tแบฏt hแบณn cho cแบฃ hแป thแปng, cรฒn bแบกn cรณ thแป แบฉn nรณ ngay khi cร i ฤแบทt ban ฤแบงu.
-**Ket Noi Noi Tiep:**
-Ket noi voi cac thiet bi noi tiep (router, switch, vi dieu khien, v.v.) truc tiep tu trinh duyet hoac ung dung may tinh. Cau hinh toc do baud, bit du lieu, bit dung va chan le. Su dung Web Serial API tren trinh duyet duoc ho tro hoac backend ban dia trong ung dung Electron.
+**ฤฤng nhแบญp vร ngฦฐแปi dรนng:**
+Tร i khoแบฃn cแปฅc bแป cรนng vแปi ฤฤng nhแบญp qua OIDC, LDAP, GitHub vร Google, kรจm xรกc thแปฑc hai bฦฐแปc (TOTP), passkey (WebAuthn) vร thiแบฟt bแป tin cแบญy. Quแบฃn trแป viรชn cรณ thแป quแบฃn lรฝ ngฦฐแปi dรนng, รกnh xแบก nhรณm OIDC sang vai trรฒ, xem mแปi phiรชn ฤang hoแบกt ฤแปng trรชn mแปi nแปn tแบฃng vร thu hแปi chรบng. Bแบกn cรณ thแป liรชn kแบฟt tร i khoแบฃn cแปฅc bแป vแปi tร i khoแบฃn OIDC, vร xem nhแบญt kรฝ kiแปm toรกn vแป nhแปฏng gรฌ mแปi ngฦฐแปi ฤรฃ lร m.
-**Canh Bao:**
-Dat cac quy tac canh bao dua tren nguong cho chi so may chu (CPU, bo nho, o dia, v.v.) va nhan thong bao qua ntfy hoac webhook khi chung kich hoat. Xem canh bao dang kich hoat va da giai quyet trong nhat ky lich su.
+**Vai trรฒ vร chia sแบป:**
+Tแบกo vai trรฒ vร chia sแบป mรกy chแปง vแปi ngฦฐแปi dรนng hoแบทc vai trรฒ theo bแปn mแปฉc: kแบฟt nแปi, xem, sแปญa vร quแบฃn lรฝ. Hoแบกt ฤแปng vแปi mแปi kiแปu xรกc thแปฑc vร mแปi giao thแปฉc, vร bแบกn cรณ thแป thay thรดng tin ฤฤng nhแบญp dรนng cho mแปt mรกy chแปง ฤฦฐแปฃc chia sแบป.
-**Trang Chu:**
-Trang chu co the tuy chinh hoan toan voi luoi widget keo va tha. Them widget cho trang thai may chu, lien ket dich vu, dong ho, ghi chu, feed RSS, thoi tiet, container Docker, bieu do chi so may chu, terminal nhung, iframe va nhieu hon nua.
+**Cแบฃnh bรกo:**
+ฤแบทt luแบญt cho cรกc sแป liแปu mรกy chแปง nhฦฐ CPU, bแป nhแป vร แป ฤฤฉa, rแปi nhแบญn thรดng bรกo qua ntfy, Discord hoแบทc webhook khi chรบng kรญch hoแบกt. Xem cแบฃnh bรกo ฤang bแบญt vร ฤรฃ hแบฟt trong nhแบญt kรฝ, vร bแป qua nhแปฏng cรกi bแบกn khรดng quan tรขm.
-**Ma Hoa Co So Du Lieu:**
-Backend duoc luu tru duoi dang tep co so du lieu SQLite duoc ma hoa. Xem [tai lieu](https://docs.termix.site/security) de biet them.
+**Trang chแปง:**
+Mแปt lฦฐแปi tiแปn รญch kรฉo thแบฃ do bแบกn tแปฑ dแปฑng. Cรณ tiแปn รญch cho tรฌnh trแบกng mรกy chแปง, ping, liรชn kแบฟt dแปch vแปฅ, dแบฅu trang, tรฌm kiแบฟm, ฤแปng hแป, lแปch, ฤแบฟm ngฦฐแปฃc, ghi chรบ, RSS, thแปi tiแบฟt, hรฌnh แบฃnh, iframe, Docker, tunnel, biแปu ฤแป sแป liแปu, API riรชng, vร cแบฃ mแปt terminal ฤang chแบกy.
-**Bieu Do Mang:**
-Tuy chinh Bang Dieu Khien de truc quan hoa homelab cua ban dua tren cac ket noi SSH voi ho tro trang thai.
+**ฤoแบกn lแปnh vร cรดng cแปฅ:**
+Lฦฐu nhแปฏng lแปnh bแบกn hay dรนng vร chแบกy chแป vแปi mแปt cรบ nhแบฅp, cรณ biแบฟn cho mรกy chแปง vร cho phแบงn bแบกn tแปฑ nhแบญp. Chแบกy mแปt lแปnh trรชn tแบฅt cแบฃ terminal ฤang mแป, vร tรฌm trong lแปch sแปญ lแปnh vแปi gแปฃi รฝ tแปฑ ฤแปng.
-**Cong Cu SSH:**
-Tao doan lenh co the tai su dung, thuc thi chi voi mot cu nhap chuot. Chay mot lenh dong thoi tren nhieu terminal dang mo.
+**Chia sแบป phiรชn:**
+Chia sแบป trแปฑc tiแบฟp mแปt phiรชn terminal, RDP, VNC hoแบทc Telnet. Gแปญi mแปt liรชn kแบฟt mร ai cลฉng vร o ฤฦฐแปฃc khรดng cแบงn tร i khoแบฃn, hoแบทc chia sแบป vแปi mแปt ngฦฐแปi dรนng Termix cแปฅ thแป, แป chแบฟ ฤแป chแป xem hoแบทc cho phรฉp thao tรกc. Chia sแบป cรณ thแป tแปฑ hแบฟt hแบกn hoแบทc bแป thu hแปi bแบฅt cแปฉ lรบc nร o, vร cรณ thแป tแบฏt toร n bแป hoแบทc theo tแปซng mรกy chแปง.
-**Tab Lien Tuc:**
-Cac phien SSH va tab van mo tren cac thiet bi/lan lam moi neu duoc bat trong ho so nguoi dung.
+**Ghi phiรชn vร nhแบญt kรฝ:**
+Ghi lแบกi phiรชn terminal, RDP vร VNC rแปi xem lแบกi sau. Tแบฃi nhแบญt kรฝ dแบกng vฤn bแบฃn cแปงa mแปt phiรชn, vร xem nhแบญt kรฝ kแบฟt nแปi ฤแป biแบฟt chรญnh xรกc chuyแปn gรฌ ฤรฃ xแบฃy ra trong lรบc kแบฟt nแปi.
-**Ngon Ngu:**
-Ho tro tich hop khoang 30 ngon ngu (duoc quan ly boi [Crowdin](https://docs.termix.site/translations)).
+**Kแบฟt nแปi serial:**
+Lร m viแปc vแปi thiแบฟt bแป serial nhฦฐ router, switch vร vi ฤiแปu khiแปn tแปซ trรฌnh duyแปt hoแบทc แปฉng dแปฅng mรกy tรญnh. ฤแบทt tแปc ฤแป baud, bit dแปฏ liแปu, bit dแปซng vร bit chแบตn lแบป. Dรนng Web Serial API trรชn cรกc trรฌnh duyแปt hแป trแปฃ, hoแบทc backend gแปc trong แปฉng dแปฅng mรกy tรญnh.
+
+
+
+
+
+
+**Tailscale:**
+Lแบฅy thiแบฟt bแป tแปซ tailnet cแปงa bแบกn ฤแป thรชm lร m mรกy chแปง chแป vแปi vร i cรบ nhแบฅp, vร kแบฟt nแปi bแบฑng Tailscale SSH ฤแป ACL cแปงa tailnet lo phแบงn quyแปn truy cแบญp, khรดng cแบงn lฦฐu thรดng tin ฤฤng nhแบญp. Headscale vร endpoint tuแปณ chแปnh cลฉng dรนng ฤฦฐแปฃc.
+
+
+
+
+**Proxmox:**
+Nhแบญp mรกy chแปง thแบณng tแปซ mแปt hแป thแปng Proxmox, vร theo dรตi sแป liแปu cแปงa node vร mรกy แบฃo, gแปm CPU, bแป nhแป vร dung lฦฐแปฃng, trong mแปt thแบป riรชng.
+
+
+
+
+
+
+**Khรดng gian lร m viแปc vร thแบป:**
+Lฦฐu mแปt bแป thแบป cรนng cรกch chia mร n hรฌnh rแปi mแป lแบกi toร n bแป chแป vแปi mแปt cรบ nhแบฅp. Termix cลฉng nhแป phiรชn gแบงn nhแบฅt, nรชn cรกc thแบป cแปงa bแบกn quay lแบกi sau khi tแบฃi lแบกi trang vร trรชn thiแบฟt bแป khรกc.
+
+
+
+
+**Cร i ฤแบทt cรณ hฦฐแปng dแบซn:**
+Mแปt phแบงn cร i ฤแบทt ngแบฏn sแบฝ hฦฐแปng bแบกn chแปn kiแปu giao diแปn, chแปง ฤแป, nhแปฏng tรญnh nฤng bแบกn muแปn vร mรกy chแปง ฤแบงu tiรชn. Chแบฟ ฤแป ฤฦกn giแบฃn แบฉn bแปt nhแปฏng gรฌ bแบกn khรดng dรนng, vร bแบกn cรณ thแป chแบกy lแบกi phแบงn cร i ฤแบทt hoแบทc ฤแปi kiแปu bแบฅt cแปฉ lรบc nร o.
+
+
+
+
+
+
+**แปจng dแปฅng mรกy tรญnh ฤแปc lแบญp vร ฤแปng bแป:**
+แปจng dแปฅng mรกy tรญnh chแบกy ฤแปc lแบญp vแปi backend vร cฦก sแป dแปฏ liแปu riรชng, khรดng cแบงn mรกy chแปง. Bแบกn cลฉng cรณ thแป nแปi nรณ vแปi mแปt mรกy chแปง Termix ฤแป ฤแปng bแป hai chiแปu mรกy chแปง, thรดng tin ฤฤng nhแบญp, ฤoแบกn lแปnh vร nhiแปu thแปฉ khรกc, vร chแปn kแบฟt nแปi xuแบฅt phรกt tแปซ mรกy cแปงa bแบกn hay ฤi qua mรกy chแปง.
+
+
+
+
+**Dรฒng lแปnh:**
+Cรดng cแปฅ `termix` cho shell vร cรกc script cแปงa bแบกn. Mแป terminal, chแบกy mแปt lแปnh trรชn mแปt mรกy chแปง hoแบทc cแบฃ mแปt nhรณm, chuyแปn tแปp qua SFTP, vร quแบฃn lรฝ mรกy chแปง, ฤoแบกn lแปnh vร thรดng tin ฤฤng nhแบญp. Cร i bแบฑng `npm install -g @termix-cli/cli` hoแบทc tแบฃi bแบฃn chแบกy ฤแปc lแบญp. Xem [tร i liแปu CLI](https://docs.termix.site/cli).
+
+
+
+
+
+
+**Bแบฃo mแบญt:**
+Mแบญt khแบฉu, khoรก vร cรกc thรดng tin bรญ mแบญt khรกc ฤฦฐแปฃc mรฃ hoรก theo tแปซng ngฦฐแปi dรนng, vร bแบฃn thรขn cรกc tแปp cฦก sแป dแปฏ liแปu cลฉng cรณ thแป mรฃ hoรก trรชn แป ฤฤฉa. Xem [tร i liแปu](https://docs.termix.site/security) ฤแป biแบฟt cรกch hoแบกt ฤแปng.
+
+
+
+
+**Ngรดn ngแปฏ:**
+Cรณ sแบตn khoแบฃng 30 ngรดn ngแปฏ, quแบฃn lรฝ qua [Crowdin](https://docs.termix.site/translations).
@@ -196,43 +252,46 @@ Ho tro tich hop khoang 30 ngon ngu (duoc quan ly boi [Crowdin](https://docs.term
-Them tinh nang Thรชm tรญnh nฤng khรกc
-Nen tang
-Phan phoi
+Nแปn tแบฃng
+Bแบฃn phรขn phแปi
Web Bat ky trinh duyet hien dai nao (Chrome, Safari, Firefox) ยท Ho tro PWA
+Mแปi trรฌnh duyแปt hiแปn ฤแบกi (Chrome, Safari, Firefox) ยท Hแป trแปฃ PWA
Windows x64/ia32 Portable ยท MSI Installer ยท Chocolatey
+Bแบฃn chแบกy ngay ยท Bแป cร i MSI ยท Chocolatey
Linux x64/ia32 Portable ยท AUR ยท AppImage ยท Deb ยท Flatpak
+Bแบฃn chแบกy ngay ยท AUR ยท AppImage ยท Deb ยท Flatpak
macOS x64/ia32, v12.0+
@@ -325,10 +410,6 @@ Ban quan tam den viec dat quang cao tra phi de ho tro phat trien? Gui email toi
-
-
-
@@ -340,18 +421,21 @@ Ban quan tam den viec dat quang cao tra phi de ho tro phat trien? Gui email toi
-
+
+
+
@@ -359,7 +443,7 @@ Neu ban can tro giup hoac muon yeu cau tinh nang voi Termix, hay truy cap trang
[](https://www.youtube.com/@TermixSSH/videos)
-Xem tong quan cap nhat tren YouTube
+Xem giแปi thiแปu cรกc bแบฃn cแบญp nhแบญt trรชn YouTube
-Mot so video va hinh anh co the da loi thoi hoac khong the hien chinh xac hoan toan cac tinh nang.
+Mแปt sแป video vร hรฌnh แบฃnh cรณ thแป ฤรฃ cลฉ hoแบทc chฦฐa thแป hiแปn ฤแบงy ฤแปง tรญnh nฤng.
") ||
- data.includes("")
- ) {
- return {
- success: false,
- error:
- "Server returned HTML instead of JSON. This does not appear to be a Termix server.",
- };
- }
+ const data = await response.text();
+ const looksLikeHtml =
+ data.includes("") ||
+ data.includes("");
+ if (response.ok && !looksLikeHtml) {
try {
const healthData = JSON.parse(data);
if (
@@ -2816,64 +3183,27 @@ ipcMain.handle("test-server-connection", async (event, serverUrl) => {
console.log("Health endpoint did not return valid JSON");
}
}
+
+ // Reachable, but not a recognized Termix health response -- likely a
+ // proxy/SSO login page in front of the real server. Let the user
+ // proceed; the login step next will fail clearly if this really
+ // isn't a Termix server.
+ return {
+ success: true,
+ status: response.status,
+ testedUrl: healthUrl,
+ warning: looksLikeHtml
+ ? "Could not confirm this is a Termix server (the response looked like an HTML page, which can happen behind a login-protected reverse proxy). You can continue, and the next step will fail clearly if this isn't actually a Termix server."
+ : "Server responded, but not with the expected health check format. Continuing anyway.",
+ };
} catch (urlError) {
console.error("Health check failed:", urlError);
+ return {
+ success: false,
+ error:
+ "Server is not responding. Please ensure the server is running and accessible.",
+ };
}
-
- try {
- const versionUrl = `${normalizedServerUrl}/version`;
- const response = await httpFetch(versionUrl, {
- method: "GET",
- timeout: 10000,
- });
-
- if (response.ok) {
- const data = await response.text();
-
- if (
- data.includes("") ||
- data.includes("")
- ) {
- return {
- success: false,
- error:
- "Server returned HTML instead of JSON. This does not appear to be a Termix server.",
- };
- }
-
- try {
- const versionData = JSON.parse(data);
- if (
- versionData &&
- (versionData.status === "up_to_date" ||
- versionData.status === "requires_update" ||
- (versionData.localVersion &&
- versionData.version &&
- versionData.latest_release))
- ) {
- return {
- success: true,
- status: response.status,
- testedUrl: versionUrl,
- warning:
- "Health endpoint not available, but server appears to be running",
- };
- }
- } catch (parseError) {
- console.log("Version endpoint did not return valid JSON");
- }
- }
- } catch (versionError) {
- console.error("Version check failed:", versionError);
- }
-
- return {
- success: false,
- error:
- "Server is not responding or does not appear to be a valid Termix server. Please ensure the server is running and accessible.",
- };
} catch (error) {
return { success: false, error: error.message };
}
@@ -2967,6 +3297,7 @@ app.whenReady().then(async () => {
createTray();
createWindow();
+ remoteSync.initRemoteSync(() => mainWindow);
logToFile("=== Startup complete ===");
});
diff --git a/electron/native-rdp.cjs b/electron/native-rdp.cjs
new file mode 100644
index 0000000..49dd688
--- /dev/null
+++ b/electron/native-rdp.cjs
@@ -0,0 +1,85 @@
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { spawn } = require("child_process");
+
+function singleLine(value, maxLength = 255) {
+ return String(value ?? "")
+ .replace(/[\r\n\0]/g, "")
+ .trim()
+ .slice(0, maxLength);
+}
+
+function validateNativeRdpOptions(options) {
+ const host = singleLine(options?.host);
+ const port = Number(options?.port ?? 3389);
+ if (!host || host.length > 253 || /[\\/]/.test(host)) {
+ throw new Error("Invalid RDP host");
+ }
+ if (!Number.isInteger(port) || port < 1 || port > 65535) {
+ throw new Error("Invalid RDP port");
+ }
+ return {
+ host,
+ port,
+ username: singleLine(options?.username),
+ domain: singleLine(options?.domain),
+ };
+}
+
+function buildRdpFile(options) {
+ const { host, port, username, domain } = validateNativeRdpOptions(options);
+ const address = host.includes(":") ? `[${host}]:${port}` : `${host}:${port}`;
+ const qualifiedUsername = username
+ ? domain
+ ? `${domain}\\${username}`
+ : username
+ : "";
+ return [
+ `full address:s:${address}`,
+ "prompt for credentials:i:1",
+ "administrative session:i:0",
+ ...(qualifiedUsername ? [`username:s:${qualifiedUsername}`] : []),
+ "",
+ ].join("\r\n");
+}
+
+async function launchNativeRdp(options, platform = process.platform) {
+ if (platform !== "win32") {
+ return {
+ success: false,
+ error: "Windows Remote Desktop is only available on Windows",
+ };
+ }
+
+ const rdpContent = buildRdpFile(options);
+ const tempDir = await fs.promises.mkdtemp(
+ path.join(os.tmpdir(), "termix-rdp-"),
+ );
+ const rdpPath = path.join(tempDir, "connection.rdp");
+ await fs.promises.writeFile(rdpPath, rdpContent, {
+ encoding: "utf8",
+ mode: 0o600,
+ });
+
+ return new Promise((resolve) => {
+ const child = spawn("mstsc.exe", [rdpPath], {
+ detached: true,
+ windowsHide: true,
+ stdio: "ignore",
+ });
+ const cleanup = () =>
+ fs.promises.rm(tempDir, { recursive: true, force: true }).catch(() => {});
+ child.once("error", (error) => {
+ cleanup();
+ resolve({ success: false, error: error.message });
+ });
+ child.once("spawn", () => {
+ child.unref();
+ setTimeout(cleanup, 30_000).unref();
+ resolve({ success: true });
+ });
+ });
+}
+
+module.exports = { buildRdpFile, launchNativeRdp, validateNativeRdpOptions };
diff --git a/electron/preload.js b/electron/preload.js
index 6b9cf1c..b045cf6 100644
--- a/electron/preload.js
+++ b/electron/preload.js
@@ -2,6 +2,8 @@ const { contextBridge, ipcRenderer } = require("electron");
contextBridge.exposeInMainWorld("electronAPI", {
getAppVersion: () => ipcRenderer.invoke("get-app-version"),
+ getPlatform: () => ipcRenderer.invoke("get-platform"),
+ openNativeRdp: (options) => ipcRenderer.invoke("open-native-rdp", options),
removeAllListeners: (channel) => ipcRenderer.removeAllListeners(channel),
isElectron: true,
@@ -31,6 +33,18 @@ contextBridge.exposeInMainWorld("electronAPI", {
startC2SAutoStartTunnels: () =>
ipcRenderer.invoke("start-c2s-autostart-tunnels"),
+ onRemoteSyncStatusChanged: (callback) => {
+ const listener = (_event, status) => callback(status);
+ ipcRenderer.on("remote-sync-status-changed", listener);
+ return () =>
+ ipcRenderer.removeListener("remote-sync-status-changed", listener);
+ },
+ onCloseActiveTab: (callback) => {
+ const listener = () => callback();
+ ipcRenderer.on("close-active-tab", listener);
+ return () => ipcRenderer.removeListener("close-active-tab", listener);
+ },
+
clearSessionCookies: () => ipcRenderer.invoke("clear-session-cookies"),
getSessionCookie: (name, targetUrl) =>
ipcRenderer.invoke("get-session-cookie", name, targetUrl),
@@ -66,6 +80,29 @@ contextBridge.exposeInMainWorld("electronAPI", {
ipcRenderer.invoke("start-drag-to-desktop", dragData),
cleanupTempFile: (tempId) => ipcRenderer.invoke("cleanup-temp-file", tempId),
+ startLocalTerminal: (dimensions) =>
+ ipcRenderer.invoke("local-terminal-start", dimensions),
+ writeLocalTerminal: (sessionId, data) =>
+ ipcRenderer.invoke("local-terminal-write", sessionId, data),
+ readyLocalTerminal: (sessionId) =>
+ ipcRenderer.invoke("local-terminal-ready", sessionId),
+ resizeLocalTerminal: (sessionId, cols, rows) =>
+ ipcRenderer.invoke("local-terminal-resize", sessionId, cols, rows),
+ closeLocalTerminal: (sessionId) =>
+ ipcRenderer.invoke("local-terminal-close", sessionId),
+ onLocalTerminalData: (sessionId, callback) => {
+ const channel = `local-terminal:data:${sessionId}`;
+ const listener = (_event, data) => callback(data);
+ ipcRenderer.on(channel, listener);
+ return () => ipcRenderer.removeListener(channel, listener);
+ },
+ onLocalTerminalExit: (sessionId, callback) => {
+ const channel = `local-terminal:exit:${sessionId}`;
+ const listener = (_event, exitCode) => callback(exitCode);
+ ipcRenderer.on(channel, listener);
+ return () => ipcRenderer.removeListener(channel, listener);
+ },
+
invoke: (channel, ...args) => ipcRenderer.invoke(channel, ...args),
});
diff --git a/electron/remote-sync-entities.cjs b/electron/remote-sync-entities.cjs
new file mode 100644
index 0000000..a60ce8c
--- /dev/null
+++ b/electron/remote-sync-entities.cjs
@@ -0,0 +1,15 @@
+const SYNCED_ENTITY_TYPES = Object.freeze([
+ // Ordered by reference dependency: hosts and snippets resolve credential,
+ // vault and folder syncIds, so those have to exist on the other side first.
+ "sshCredentials",
+ "vaultProfiles",
+ "sshFolders",
+ "snippetFolders",
+ "hosts",
+ "snippets",
+ "dashboardServiceLinks",
+ "homepageItems",
+ "userPreferences",
+]);
+
+module.exports = { SYNCED_ENTITY_TYPES };
diff --git a/electron/remote-sync.cjs b/electron/remote-sync.cjs
new file mode 100644
index 0000000..507c512
--- /dev/null
+++ b/electron/remote-sync.cjs
@@ -0,0 +1,581 @@
+// Remote sync engine for the desktop app's optional connection to a
+// self-hosted Termix server. Runs entirely in the Electron main process:
+// - Holds the remote JWT (safeStorage-encrypted on disk, never exposed to
+// the renderer's localStorage) and the local embedded backend's JWT
+// (cached in memory only, handed over by the renderer at local-login
+// time via notify-local-login).
+// - On a timer, pulls + pushes each synced entity type between the
+// embedded backend (always localhost:30001) and the configured remote
+// server, reconciling by syncId with last-write-wins on updatedAt, and
+// propagating tombstones (deletions) in both directions.
+// - Pushes connection/sync status to the renderer via IPC so the Settings
+// UI and a global banner can reflect it without polling.
+
+const { app, safeStorage } = require("electron");
+const fs = require("fs");
+const path = require("path");
+const { SYNCED_ENTITY_TYPES } = require("./remote-sync-entities.cjs");
+
+const SYNC_INTERVAL_MS = 90 * 1000;
+const EMBEDDED_BASE_URL = "http://127.0.0.1:30001";
+
+function dataPath(filename) {
+ return path.join(app.getPath("userData"), filename);
+}
+
+function readJson(filePath, fallback) {
+ try {
+ if (!fs.existsSync(filePath)) return fallback;
+ return JSON.parse(fs.readFileSync(filePath, "utf8"));
+ } catch {
+ return fallback;
+ }
+}
+
+function writeJson(filePath, value) {
+ const userDataPath = app.getPath("userData");
+ if (!fs.existsSync(userDataPath)) {
+ fs.mkdirSync(userDataPath, { recursive: true });
+ }
+ fs.writeFileSync(filePath, JSON.stringify(value, null, 2));
+}
+
+function getDesktopSettingsPath() {
+ return dataPath("desktop-settings.json");
+}
+
+function getRemoteSyncConfigPath() {
+ return dataPath("remote-sync-config.json");
+}
+
+function getRemoteSyncCredentialPath() {
+ return dataPath("remote-sync-credential.json");
+}
+
+function getRemoteSyncStatePath() {
+ return dataPath("remote-sync-state.json");
+}
+
+function getDesktopSettings() {
+ return readJson(getDesktopSettingsPath(), {
+ defaultConnectionOrigin: "local",
+ migrationNoticeAcknowledged: false,
+ });
+}
+
+function saveDesktopSettings(settings) {
+ writeJson(getDesktopSettingsPath(), settings);
+ return { success: true };
+}
+
+function getRemoteSyncConfig() {
+ return readJson(getRemoteSyncConfigPath(), null);
+}
+
+function saveRemoteSyncConfig(config) {
+ writeJson(getRemoteSyncConfigPath(), config);
+ return { success: true };
+}
+
+function clearRemoteSyncConfig() {
+ try {
+ fs.unlinkSync(getRemoteSyncConfigPath());
+ } catch {
+ // already absent
+ }
+ return { success: true };
+}
+
+function getSafeStorageAvailable() {
+ try {
+ return safeStorage.isEncryptionAvailable();
+ } catch {
+ return false;
+ }
+}
+
+function saveRemoteSyncJwt(token) {
+ if (!getSafeStorageAvailable()) {
+ // Carries a stable reason alongside the message: the renderer has a
+ // translated explanation for this one, because "no OS keyring" is a
+ // machine-level problem the user has to go and fix, not something signing
+ // in again can resolve.
+ return {
+ success: false,
+ reason: "encryption_unavailable",
+ error: "Encryption unavailable on this system",
+ };
+ }
+ writeJson(getRemoteSyncCredentialPath(), {
+ encrypted: true,
+ value: safeStorage.encryptString(token).toString("base64"),
+ obtainedAt: new Date().toISOString(),
+ });
+ return { success: true };
+}
+
+function getRemoteSyncJwt() {
+ const record = readJson(getRemoteSyncCredentialPath(), null);
+ if (!record?.encrypted || !getSafeStorageAvailable()) return null;
+ try {
+ return safeStorage.decryptString(Buffer.from(record.value, "base64"));
+ } catch {
+ return null;
+ }
+}
+
+function clearRemoteSyncJwt() {
+ try {
+ fs.unlinkSync(getRemoteSyncCredentialPath());
+ } catch {
+ // already absent
+ }
+ return { success: true };
+}
+
+async function getRemoteSyncUserInfo() {
+ const config = getRemoteSyncConfig();
+ const token = getRemoteSyncJwt();
+ if (!config?.serverUrl || !token || isJwtExpiredOrExpiringSoon(token)) {
+ return null;
+ }
+
+ const baseUrl = config.serverUrl.replace(/\/$/, "");
+ const userResponse = await fetch(`${baseUrl}/users/me`, {
+ headers: { Authorization: `Bearer ${token}`, "X-Electron-App": "true" },
+ });
+ if (!userResponse.ok) return null;
+
+ const user = await userResponse.json();
+ const rolesResponse = await fetch(
+ `${baseUrl}/rbac/users/${encodeURIComponent(user.userId)}/roles`,
+ {
+ headers: { Authorization: `Bearer ${token}`, "X-Electron-App": "true" },
+ },
+ );
+ const roles = rolesResponse.ok
+ ? (await rolesResponse.json()).roles || []
+ : [];
+
+ return {
+ userId: user.userId,
+ username: user.username,
+ is_admin: !!user.is_admin,
+ is_oidc: !!user.is_oidc,
+ is_dual_auth: !!user.is_dual_auth,
+ totp_enabled: !!user.totp_enabled,
+ roles,
+ };
+}
+
+function decodeJwtExpiry(token) {
+ try {
+ const payloadB64 = token.split(".")[1];
+ const payload = JSON.parse(
+ Buffer.from(payloadB64, "base64").toString("utf8"),
+ );
+ return typeof payload.exp === "number" ? payload.exp * 1000 : null;
+ } catch {
+ return null;
+ }
+}
+
+function isJwtExpiredOrExpiringSoon(token, marginMs = 60 * 1000) {
+ const expiresAt = decodeJwtExpiry(token);
+ if (expiresAt === null) return false;
+ return Date.now() + marginMs >= expiresAt;
+}
+
+class RemoteSyncEngine {
+ constructor(getMainWindow) {
+ this.getMainWindow = getMainWindow;
+ this.localJwt = null;
+ this.timer = null;
+ this.syncing = false;
+ this.status = {
+ connected: false,
+ syncing: false,
+ lastSyncedAt: null,
+ lastError: null,
+ needsReauth: false,
+ };
+ }
+
+ setLocalJwt(token) {
+ this.localJwt = token || null;
+ }
+
+ emitStatus() {
+ const win = this.getMainWindow?.();
+ if (!win || win.isDestroyed()) return;
+ win.webContents.send("remote-sync-status-changed", this.status);
+ }
+
+ updateStatus(patch) {
+ this.status = { ...this.status, ...patch };
+ this.emitStatus();
+ }
+
+ start() {
+ const config = getRemoteSyncConfig();
+ this.status.connected = !!config?.serverUrl;
+ if (this.timer) clearInterval(this.timer);
+ this.timer = setInterval(() => this.syncNow(), SYNC_INTERVAL_MS);
+ if (config?.serverUrl) {
+ // Fire an initial sync shortly after startup rather than waiting a
+ // full interval, but don't block app boot on it.
+ setTimeout(() => this.syncNow(), 5000);
+ }
+ }
+
+ stop() {
+ if (this.timer) {
+ clearInterval(this.timer);
+ this.timer = null;
+ }
+ }
+
+ async syncNow() {
+ if (this.syncing) return this.status;
+ const config = getRemoteSyncConfig();
+ if (!config?.serverUrl) {
+ this.updateStatus({ connected: false, syncing: false });
+ return this.status;
+ }
+
+ const remoteJwt = getRemoteSyncJwt();
+ if (!remoteJwt) {
+ this.updateStatus({
+ connected: true,
+ syncing: false,
+ needsReauth: true,
+ lastError: "Not signed in to remote server",
+ });
+ return this.status;
+ }
+ if (isJwtExpiredOrExpiringSoon(remoteJwt)) {
+ this.updateStatus({
+ connected: true,
+ syncing: false,
+ needsReauth: true,
+ lastError: "Remote session expired",
+ });
+ return this.status;
+ }
+ if (!this.localJwt) {
+ // Local login hasn't handed us a token yet -- this is expected for the
+ // first tick or two right after a cold boot (renderer hasn't finished
+ // its own session check yet), but if it never arrives (e.g. a gap in
+ // whichever code path establishes the local session), sync would
+ // otherwise silently no-op forever with no visible error. Surface it
+ // as a normal, non-alarming "not synced yet" status rather than
+ // leaving lastSyncedAt/lastError untouched.
+ this.updateStatus({
+ connected: true,
+ syncing: false,
+ lastError: "Waiting for local session",
+ });
+ return this.status;
+ }
+
+ this.syncing = true;
+ this.updateStatus({ connected: true, syncing: true, lastError: null });
+
+ try {
+ const state = readJson(getRemoteSyncStatePath(), { entities: {} });
+ let sawAuthFailure = false;
+
+ for (const entityType of SYNCED_ENTITY_TYPES) {
+ const entityState = state.entities[entityType] || {
+ lastPulledAt: null,
+ lastPushedAt: null,
+ };
+
+ const result = await this.syncEntity({
+ entityType,
+ remoteBaseUrl: config.serverUrl.replace(/\/$/, ""),
+ remoteJwt,
+ since: entityState.lastPulledAt,
+ });
+
+ if (result.authFailure) {
+ sawAuthFailure = true;
+ break;
+ }
+
+ state.entities[entityType] = {
+ lastPulledAt: result.syncedAt,
+ lastPushedAt: result.syncedAt,
+ };
+ }
+
+ if (sawAuthFailure) {
+ this.updateStatus({
+ syncing: false,
+ needsReauth: true,
+ lastError: "Remote server rejected the session",
+ });
+ return this.status;
+ }
+
+ writeJson(getRemoteSyncStatePath(), state);
+ writeJson(getRemoteSyncConfigPath(), {
+ ...config,
+ lastSyncedAt: new Date().toISOString(),
+ lastSyncStatus: "ok",
+ lastSyncError: null,
+ });
+
+ this.updateStatus({
+ connected: true,
+ syncing: false,
+ needsReauth: false,
+ lastSyncedAt: new Date().toISOString(),
+ lastError: null,
+ });
+ } catch (error) {
+ const message = error instanceof Error ? error.message : String(error);
+ writeJson(getRemoteSyncConfigPath(), {
+ ...config,
+ lastSyncStatus: "error",
+ lastSyncError: message,
+ });
+ this.updateStatus({ syncing: false, lastError: message });
+ } finally {
+ this.syncing = false;
+ }
+
+ return this.status;
+ }
+
+ async fetchJson(url, token, options = {}) {
+ const res = await fetch(url, {
+ ...options,
+ headers: {
+ "Content-Type": "application/json",
+ Authorization: `Bearer ${token}`,
+ ...(options.headers || {}),
+ },
+ });
+ if (res.status === 401 || res.status === 403) {
+ const err = new Error(`Auth failed (${res.status})`);
+ err.authFailure = true;
+ throw err;
+ }
+ if (!res.ok) {
+ throw new Error(`Request failed (${res.status}): ${url}`);
+ }
+
+ const text = await res.text();
+ // A reverse-proxy SSO in front of the remote server (Pangolin, Authelia,
+ // etc.) can intercept even an authenticated, Bearer-token'd request and
+ // serve its own login page instead of forwarding to Termix -- that comes
+ // back as a normal 200 OK, so the status checks above don't catch it.
+ // This is NOT the same as needsReauth/a bad Termix JWT: sync runs as a
+ // plain server-to-server fetch() in this main process, with no browser
+ // cookie jar at all, so re-authenticating through the login iframe (which
+ // only affects the renderer's browser session) can never fix this --
+ // reconnecting would tell the user to do something that doesn't help.
+ // The proxy has to allow this traffic through some other way (an API
+ // bypass rule, a separate hostname/port that isn't proxy-gated, etc.),
+ // so this gets its own distinct, honest error rather than piggybacking
+ // on needsReauth or a raw JSON.parse crash.
+ const looksLikeHtml =
+ text.includes("") ||
+ text.includes("");
+ if (looksLikeHtml) {
+ const err = new Error(
+ "The reverse proxy in front of this server is blocking sync traffic with its own login page. Reconnecting won't fix this. The proxy needs to let Termix's API requests through (e.g. an SSO bypass rule for the sync API, or a non-proxied hostname/port for it).",
+ );
+ err.proxyBlocked = true;
+ throw err;
+ }
+
+ try {
+ return JSON.parse(text);
+ } catch {
+ throw new Error(`Server returned invalid JSON: ${url}`);
+ }
+ }
+
+ async pullSide(baseUrl, token, entityType, since) {
+ const url = `${baseUrl}/sync/${entityType}${since ? `?since=${encodeURIComponent(since)}` : ""}`;
+ const data = await this.fetchJson(url, token);
+ return data.rows || [];
+ }
+
+ /**
+ * Every syncId a side currently holds, ignoring the incremental window.
+ * Used only to decide whether a deletion still has something to delete.
+ */
+ async pullSyncIds(baseUrl, token, entityType) {
+ const rows = await this.pullSide(baseUrl, token, entityType, null);
+ return new Set(rows.filter((row) => row.syncId).map((row) => row.syncId));
+ }
+
+ async pullTombstones(baseUrl, token, entityType, since) {
+ const url = `${baseUrl}/sync/${entityType}/tombstones${since ? `?since=${encodeURIComponent(since)}` : ""}`;
+ const data = await this.fetchJson(url, token);
+ return data.tombstones || [];
+ }
+
+ async pushRow(baseUrl, token, entityType, row) {
+ await this.fetchJson(`${baseUrl}/sync/${entityType}`, token, {
+ method: "POST",
+ body: JSON.stringify({ row }),
+ });
+ }
+
+ async pushTombstone(baseUrl, token, entityType, syncId) {
+ await this.fetchJson(`${baseUrl}/sync/tombstones`, token, {
+ method: "POST",
+ body: JSON.stringify({ entityType, syncId }),
+ });
+ }
+
+ async syncEntity({ entityType, remoteBaseUrl, remoteJwt, since }) {
+ const syncedAt = new Date().toISOString();
+ try {
+ const [localRows, remoteRows, localTombstones, remoteTombstones] =
+ await Promise.all([
+ this.pullSide(EMBEDDED_BASE_URL, this.localJwt, entityType, since),
+ this.pullSide(remoteBaseUrl, remoteJwt, entityType, since),
+ this.pullTombstones(
+ EMBEDDED_BASE_URL,
+ this.localJwt,
+ entityType,
+ since,
+ ),
+ this.pullTombstones(remoteBaseUrl, remoteJwt, entityType, since),
+ ]);
+
+ const tombstonedSyncIds = new Set([
+ ...localTombstones.map((t) => t.syncId),
+ ...remoteTombstones.map((t) => t.syncId),
+ ]);
+
+ const localBySyncId = new Map(
+ localRows.filter((r) => r.syncId).map((r) => [r.syncId, r]),
+ );
+ const remoteBySyncId = new Map(
+ remoteRows.filter((r) => r.syncId).map((r) => [r.syncId, r]),
+ );
+ const allSyncIds = new Set([
+ ...localBySyncId.keys(),
+ ...remoteBySyncId.keys(),
+ ]);
+
+ for (const syncId of allSyncIds) {
+ if (tombstonedSyncIds.has(syncId)) continue;
+
+ const localRow = localBySyncId.get(syncId);
+ const remoteRow = remoteBySyncId.get(syncId);
+
+ if (localRow && !remoteRow) {
+ await this.pushRow(remoteBaseUrl, remoteJwt, entityType, localRow);
+ } else if (remoteRow && !localRow) {
+ await this.pushRow(
+ EMBEDDED_BASE_URL,
+ this.localJwt,
+ entityType,
+ remoteRow,
+ );
+ } else if (localRow && remoteRow) {
+ const localUpdatedAt = new Date(localRow.updatedAt || 0).getTime();
+ const remoteUpdatedAt = new Date(remoteRow.updatedAt || 0).getTime();
+ if (localUpdatedAt > remoteUpdatedAt) {
+ await this.pushRow(remoteBaseUrl, remoteJwt, entityType, localRow);
+ } else if (remoteUpdatedAt > localUpdatedAt) {
+ await this.pushRow(
+ EMBEDDED_BASE_URL,
+ this.localJwt,
+ entityType,
+ remoteRow,
+ );
+ }
+ }
+ }
+
+ // Apply tombstones to whichever side hasn't already deleted the row.
+ //
+ // The presence check cannot use localRows/remoteRows: those are the
+ // incremental window, and a row deleted on one side while untouched on
+ // the other is by definition outside it, so every deletion was dropped.
+ // It also cannot be skipped -- pushing unconditionally makes the
+ // receiving side record a fresh tombstone, which the next pass would push
+ // back, forever. So ask the receiving side what it actually still holds,
+ // and only when there is a deletion to apply.
+ if (localTombstones.length) {
+ const remoteSyncIds = await this.pullSyncIds(
+ remoteBaseUrl,
+ remoteJwt,
+ entityType,
+ );
+ for (const tombstone of localTombstones) {
+ if (remoteSyncIds.has(tombstone.syncId)) {
+ await this.pushTombstone(
+ remoteBaseUrl,
+ remoteJwt,
+ entityType,
+ tombstone.syncId,
+ );
+ }
+ }
+ }
+ if (remoteTombstones.length) {
+ const localSyncIds = await this.pullSyncIds(
+ EMBEDDED_BASE_URL,
+ this.localJwt,
+ entityType,
+ );
+ for (const tombstone of remoteTombstones) {
+ if (localSyncIds.has(tombstone.syncId)) {
+ await this.pushTombstone(
+ EMBEDDED_BASE_URL,
+ this.localJwt,
+ entityType,
+ tombstone.syncId,
+ );
+ }
+ }
+ }
+
+ return { syncedAt };
+ } catch (error) {
+ if (error?.authFailure) {
+ return { syncedAt, authFailure: true };
+ }
+ throw error;
+ }
+ }
+}
+
+let engine = null;
+
+function initRemoteSync(getMainWindow) {
+ engine = new RemoteSyncEngine(getMainWindow);
+ engine.start();
+ return engine;
+}
+
+function getRemoteSyncEngine() {
+ return engine;
+}
+
+module.exports = {
+ initRemoteSync,
+ getRemoteSyncEngine,
+ getDesktopSettings,
+ saveDesktopSettings,
+ getRemoteSyncConfig,
+ saveRemoteSyncConfig,
+ clearRemoteSyncConfig,
+ saveRemoteSyncJwt,
+ getRemoteSyncJwt,
+ clearRemoteSyncJwt,
+ getRemoteSyncUserInfo,
+ isJwtExpiredOrExpiringSoon,
+ decodeJwtExpiry,
+};
diff --git a/eslint.config.mjs b/eslint.config.mjs
index ee87445..7879884 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -46,4 +46,57 @@ export default tseslint.config([
"react-refresh/only-export-components": "warn",
},
},
+ {
+ // MySQL has no RETURNING clause, and drizzle's mysql-core does not expose
+ // the method at all โ a bare .returning() is a TypeError there, not a bad
+ // query, and it only fails on the engine no test in this repo runs against.
+ //
+ // 175 call sites were migrated off it. This is what stops number 176.
+ // Writes that need rows back go through repositories/returning.ts, which
+ // picks one statement or a read-then-write transaction per dialect.
+ files: ["src/backend/database/repositories/**/*.ts"],
+ ignores: [
+ // The two files whose job is to absorb these differences.
+ "src/backend/database/repositories/returning.ts",
+ "src/backend/database/repositories/mutation-result.ts",
+ ],
+ rules: {
+ "no-restricted-syntax": [
+ "error",
+ {
+ selector: "CallExpression[callee.property.name='returning']",
+ message:
+ "MySQL has no RETURNING. Use insertReturning/updateReturning/deleteReturning from ./returning.js, or rowsAffected() if you only need a count. Inside a proven sqlite-only branch, disable this rule with a comment saying so.",
+ },
+ {
+ // `||` concatenates on SQLite and Postgres. On MySQL it is logical OR
+ // unless the server runs with PIPES_AS_CONCAT, so a folder path built
+ // this way silently became 0. Use CONCAT, which all three agree on.
+ selector:
+ "TaggedTemplateExpression[tag.name='sql'] TemplateElement[value.raw=/\\|\\|/]",
+ message:
+ "`||` is logical OR on MySQL, not concatenation. Use CONCAT(...).",
+ },
+ {
+ // Postgres and SQLite spell it ON CONFLICT; MySQL spells it ON
+ // DUPLICATE KEY and names no columns, so drizzle's mysql-core has no
+ // onConflictDoUpdate at all โ another TypeError, not a bad query.
+ selector: "CallExpression[callee.property.name='onConflictDoUpdate']",
+ message:
+ "MySQL has no ON CONFLICT. Use upsert() from ./returning.js.",
+ },
+ {
+ // better-sqlite3 puts these on a write result; node-postgres and
+ // mysql2 do not, so reading them directly yields undefined โ and
+ // Number(undefined) is NaN, which reaches the database as the string
+ // "NaN" and fails an integer column. Three call sites did exactly
+ // this and only broke on Postgres.
+ selector:
+ "MemberExpression[property.name=/^(lastInsertRowid|changes)$/]",
+ message:
+ "lastInsertRowid and changes are better-sqlite3 only. Use insertedId() or rowsAffected() from ./mutation-result.js.",
+ },
+ ],
+ },
+ },
]);
diff --git a/index.html b/index.html
index da71ea3..f3f0c8f 100644
--- a/index.html
+++ b/index.html
@@ -3,7 +3,10 @@
) {
+ return Object.entries(sections)
+ .map(([name, body]) => `\n${body}\n`)
+ .join("\n\n");
+}
+
+describe("toPlainText", () => {
+ it("strips markdown links down to their label", () => {
+ expect(toPlainText("- See [the docs](https://example.com)")).toBe(
+ "- See the docs",
+ );
+ });
+
+ it("strips backticks and bold markers", () => {
+ expect(toPlainText("- Fixed `npm run build` and **crashes**")).toBe(
+ "- Fixed npm run build and crashes",
+ );
+ });
+
+ it("keeps nested bullets indented", () => {
+ expect(toPlainText("- Top\n - Nested")).toBe("- Top\n - Nested");
+ });
+
+ it("normalizes asterisk bullets to dashes", () => {
+ expect(toPlainText("* One\n* Two")).toBe("- One\n- Two");
+ });
+
+ it("collapses runs of blank lines", () => {
+ expect(toPlainText("- One\n\n\n\n- Two")).toBe("- One\n\n- Two");
+ });
+});
+
+describe("truncate", () => {
+ it("leaves text under the limit untouched", () => {
+ expect(truncate("- One\n- Two", 100)).toBe("- One\n- Two");
+ });
+
+ it("drops whole trailing lines rather than splitting one", () => {
+ const result = truncate("- One\n- Two\n- Three", 12);
+ expect(result).toBe("- One\n- Two");
+ });
+
+ it("drops a section header left with no bullets under it", () => {
+ const result = truncate("- One\n\nBug Fixes:\n- Two", 18);
+ expect(result).toBe("- One");
+ });
+});
+
+describe("buildNotes", () => {
+ it("includes the summary, update log, and bug fixes", () => {
+ const notes = buildNotes(
+ notesFile({
+ SUMMARY: "A big release.",
+ UPDATE_LOG: "- Added a thing",
+ BUG_FIXES: "- Fixed a thing",
+ }),
+ );
+
+ expect(notes).toContain("A big release.");
+ expect(notes).toContain("Update Log:");
+ expect(notes).toContain("- Added a thing");
+ expect(notes).toContain("Bug Fixes:");
+ expect(notes).toContain("- Fixed a thing");
+ });
+
+ it("omits optional sections that are absent", () => {
+ const notes = buildNotes(notesFile({ SUMMARY: "Small release." }));
+
+ expect(notes).toBe("Small release.");
+ expect(notes).not.toContain("Update Log:");
+ expect(notes).not.toContain("Bug Fixes:");
+ });
+
+ it("stays within the App Store character limit", () => {
+ const notes = buildNotes(
+ notesFile({
+ SUMMARY: "Big release.",
+ UPDATE_LOG: Array.from(
+ { length: 400 },
+ (_, i) => `- Added feature number ${i}`,
+ ).join("\n"),
+ BUG_FIXES: Array.from(
+ { length: 400 },
+ (_, i) => `- Fixed bug number ${i}`,
+ ).join("\n"),
+ }),
+ );
+
+ expect(notes.length).toBeLessThanOrEqual(MAX_LENGTH);
+ expect(notes.length).toBeGreaterThan(0);
+ });
+
+ it("never ends mid-bullet when truncating", () => {
+ const notes = buildNotes(
+ notesFile({
+ SUMMARY: "Big release.",
+ UPDATE_LOG: Array.from(
+ { length: 400 },
+ (_, i) => `- Added feature number ${i}`,
+ ).join("\n"),
+ }),
+ );
+
+ const lines = notes.split("\n");
+ expect(lines[lines.length - 1]).toMatch(/^- Added feature number \d+$/);
+ });
+
+ it("produces non-empty notes for the real release notes file", () => {
+ const fs = require("fs");
+ const notes = buildNotes(fs.readFileSync("RELEASE_NOTES.md", "utf8"));
+
+ expect(notes.length).toBeGreaterThan(0);
+ expect(notes.length).toBeLessThanOrEqual(MAX_LENGTH);
+ });
+});
diff --git a/scripts/generate-dialect-schema.cjs b/scripts/generate-dialect-schema.cjs
new file mode 100644
index 0000000..171279d
--- /dev/null
+++ b/scripts/generate-dialect-schema.cjs
@@ -0,0 +1,236 @@
+/**
+ * Generates the Postgres and MySQL schema modules from the SQLite one.
+ *
+ * ## These files produce DDL. They are not used at runtime.
+ *
+ * drizzle-kit reads them to emit the migrations in drizzle/postgres and
+ * drizzle/mysql. Nothing imports them to run a query.
+ *
+ * That is not an oversight. The query builder needs two things from a table
+ * object โ the identifiers to interpolate, and the encoders that turn JS values
+ * into driver values โ and the sqlite definitions supply both correctly for
+ * every engine, which is why all 44 repositories import schema.ts directly:
+ *
+ * - text and integer encode as themselves everywhere
+ * - integer({ mode: "boolean" }) writes 1/0, which Postgres and MySQL both
+ * accept for a boolean column, and reads back through `Number(v) === 1`,
+ * which is true for JS `true` as well as for 1
+ * - real is a plain number on all three
+ *
+ * What genuinely differs between the dialects is DDL โ column types, key
+ * lengths, autoincrement syntax โ and DDL is exactly what these files exist to
+ * generate. See scripts/verify-dialects.mjs, which asserts the round-trips
+ * above against real servers rather than trusting this comment.
+ *
+ * The schema is declared once, in sqlite-core, and the other two dialects are
+ * derived. Hand-maintaining three copies of 52 tables would mean a renamed
+ * table has to land in three places consistently or a foreign key silently
+ * points at the wrong one โ and the schema is regular enough that the mapping
+ * is mechanical.
+ *
+ * What varies between dialects is small and closed:
+ * - booleans are integers on sqlite, native elsewhere
+ * - autoincrement keys are `integer primary key autoincrement`, `serial`,
+ * and `int auto_increment`
+ * - MySQL cannot index unbounded TEXT, so any column that is a primary key,
+ * is unique, or participates in a foreign key must be varchar
+ * - MySQL rejects a bare DEFAULT CURRENT_TIMESTAMP on a text column, so it is
+ * written as a parenthesised expression default
+ *
+ * Usage: node scripts/generate-dialect-schema.cjs [--check]
+ * --check verifies the committed files match what would be generated,
+ * for CI to catch a schema edit that forgot to regenerate.
+ */
+
+const fs = require("fs");
+const path = require("path");
+
+const ROOT = path.join(__dirname, "..");
+const SOURCE = path.join(ROOT, "src/backend/database/db/schema.ts");
+const TARGETS = {
+ postgres: path.join(ROOT, "src/backend/database/db/schema.pg.ts"),
+ mysql: path.join(ROOT, "src/backend/database/db/schema.mysql.ts"),
+};
+
+const KEY_LENGTH = 255;
+
+/**
+ * Columns that must be varchar rather than text on MySQL. A column qualifies if
+ * it is a primary key, is unique, or is either end of a foreign key.
+ */
+function collectKeyColumns(source) {
+ const keyed = new Set();
+
+ // `name: text("col")....primaryKey()` / `.unique()` / `.references(...)`
+ const declaration =
+ /(\w+):\s*text\("([a-z0-9_]+)"\)((?:\s*\.\w+\([^)]*\))*)/g;
+ let match;
+ while ((match = declaration.exec(source)) !== null) {
+ const [, prop, column, modifiers] = match;
+ if (/\.(primaryKey|unique|references)\(/.test(modifiers)) {
+ keyed.add(column);
+ }
+ void prop;
+ }
+
+ // Multi-line form: the modifiers land on following lines.
+ const multiline =
+ /(\w+):\s*text\("([a-z0-9_]+)"\)\s*\n(\s*\.\w+\([\s\S]*?\),)/g;
+ while ((match = multiline.exec(source)) !== null) {
+ if (/\.(primaryKey|unique|references)\(/.test(match[3])) {
+ keyed.add(match[2]);
+ }
+ }
+
+ // A referenced column implies the referencing side too; both must match.
+ const reference = /\.references\(\(\)\s*=>\s*\w+\.(\w+)/g;
+ while ((match = reference.exec(source)) !== null) {
+ keyed.add(camelToSnake(match[1]));
+ }
+
+ // Table-level indexes: `(table) => [uniqueIndex("x").on(table.a, table.b)]`,
+ // and the same for the plain `index("x")` used by the performance indexes.
+ // These were invisible here at first, and MySQL rejected the migration with
+ // "BLOB/TEXT column used in key specification without a key length" โ but
+ // only on MySQL 8; MariaDB took it.
+ const tableIndex = /\b(?:unique)?[iI]ndex\("[a-z0-9_]+"\)\.on\(([^)]*)\)/g;
+ while ((match = tableIndex.exec(source)) !== null) {
+ for (const column of match[1].split(",")) {
+ const name = column.trim().replace(/^\w+\./, "");
+ if (name) keyed.add(camelToSnake(name));
+ }
+ }
+
+ return keyed;
+}
+
+function camelToSnake(value) {
+ return value.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
+}
+
+function transform(source, dialect) {
+ const keyed = collectKeyColumns(source);
+ const isPg = dialect === "postgres";
+ let out = source;
+
+ // Autoincrement primary keys, before the plain integer rule below.
+ out = out.replace(
+ /integer\("([a-z0-9_]+)"\)\.primaryKey\(\{\s*autoIncrement:\s*true\s*\}\)/g,
+ (_, col) =>
+ isPg
+ ? `serial("${col}").primaryKey()`
+ : `int("${col}").autoincrement().primaryKey()`,
+ );
+
+ // Integer-backed booleans become native ones. Prettier wraps the longer
+ // declarations across lines, so this has to span newlines too.
+ out = out.replace(
+ /integer\(\s*"([a-z0-9_]+)",\s*\{\s*mode:\s*"boolean",?\s*\},?\s*\)/g,
+ (_, col) => `boolean("${col}")`,
+ );
+
+ // Remaining integers.
+ if (!isPg) {
+ out = out.replace(
+ /\binteger\("([a-z0-9_]+)"\)/g,
+ (_, col) => `int("${col}")`,
+ );
+
+ // Timestamps are stored as text (see sql-timestamp.ts). MySQL only accepts
+ // DEFAULT CURRENT_TIMESTAMP on a DATETIME or TIMESTAMP column โ on a TEXT
+ // one it is ER_INVALID_DEFAULT, "Invalid default value". Since 8.0.13 an
+ // expression default works on any type, and an expression is written
+ // parenthesised. MariaDB accepts the bare form, which is why this only
+ // surfaces against real MySQL.
+ out = out.replace(/sql`CURRENT_TIMESTAMP`/g, "sql`(CURRENT_TIMESTAMP)`");
+ }
+
+ // Floating point.
+ out = out.replace(/\breal\("([a-z0-9_]+)"\)/g, (_, col) =>
+ isPg ? `doublePrecision("${col}")` : `double("${col}")`,
+ );
+
+ // Key-bearing strings must be indexable.
+ out = out.replace(/\btext\("([a-z0-9_]+)"\)/g, (whole, col) =>
+ keyed.has(col) ? `varchar("${col}", { length: ${KEY_LENGTH} })` : whole,
+ );
+
+ // text("x", { length: n }) is sqlite-only sugar; drop the length.
+ out = out.replace(
+ /\btext\("([a-z0-9_]+)",\s*\{\s*length:\s*\d+\s*\}\)/g,
+ (_, col) => `text("${col}")`,
+ );
+
+ out = out.replace(/\bsqliteTable\(/g, isPg ? "pgTable(" : "mysqlTable(");
+
+ // Self-referencing FK callbacks are typed against the source dialect's
+ // "any column" helper so TS can resolve the circular table reference.
+ out = out.replace(
+ /\bAnySQLiteColumn\b/g,
+ isPg ? "AnyPgColumn" : "AnyMySqlColumn",
+ );
+
+ const imports = isPg
+ ? `import {\n pgTable,\n text,\n varchar,\n integer,\n serial,\n boolean,\n doublePrecision,\n index,\n uniqueIndex,\n type AnyPgColumn,\n} from "drizzle-orm/pg-core";`
+ : `import {\n mysqlTable,\n text,\n varchar,\n int,\n boolean,\n double,\n index,\n uniqueIndex,\n type AnyMySqlColumn,\n} from "drizzle-orm/mysql-core";`;
+
+ out = out.replace(
+ /import\s*\{[^}]*\}\s*from\s*"drizzle-orm\/sqlite-core";/,
+ imports,
+ );
+
+ return `${header(dialect)}\n${out}`;
+}
+
+function header(dialect) {
+ return `// GENERATED FILE โ do not edit.
+//
+// Produced from schema.ts by scripts/generate-dialect-schema.cjs.
+// Edit the sqlite schema and re-run \`node scripts/generate-dialect-schema.cjs\`.
+// Target dialect: ${dialect}.
+//
+// DDL source for drizzle-kit. NOT imported to run queries โ repositories use
+// schema.ts on every dialect. See the generator header for why that is correct.
+`;
+}
+
+function main() {
+ const check = process.argv.includes("--check");
+ const source = fs.readFileSync(SOURCE, "utf8");
+ let drift = false;
+
+ for (const [dialect, target] of Object.entries(TARGETS)) {
+ const generated = transform(source, dialect);
+
+ if (check) {
+ const current = fs.existsSync(target)
+ ? fs.readFileSync(target, "utf8")
+ : "";
+ if (current !== generated) {
+ console.error(
+ `[generate-dialect-schema] ${path.relative(ROOT, target)} is out of date`,
+ );
+ drift = true;
+ }
+ continue;
+ }
+
+ fs.writeFileSync(target, generated);
+ console.log(
+ `[generate-dialect-schema] wrote ${path.relative(ROOT, target)}`,
+ );
+ }
+
+ if (drift) {
+ console.error(
+ "[generate-dialect-schema] run `node scripts/generate-dialect-schema.cjs` and commit the result",
+ );
+ process.exit(1);
+ }
+}
+
+module.exports = { transform, collectKeyColumns };
+
+if (require.main === module) {
+ main();
+}
diff --git a/scripts/generate-dialect-schema.test.ts b/scripts/generate-dialect-schema.test.ts
new file mode 100644
index 0000000..dad931f
--- /dev/null
+++ b/scripts/generate-dialect-schema.test.ts
@@ -0,0 +1,140 @@
+import { describe, expect, it } from "vitest";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const { transform, collectKeyColumns } =
+ require("./generate-dialect-schema.cjs") as {
+ transform: (source: string, dialect: "postgres" | "mysql") => string;
+ collectKeyColumns: (source: string) => Set;
+ };
+
+const SOURCE = `import { sqliteTable, text, integer, real } from "drizzle-orm/sqlite-core";
+import { sql } from "drizzle-orm";
+
+export const users = sqliteTable("users", {
+ id: text("id").primaryKey(),
+ username: text("username").notNull(),
+ isAdmin: integer("is_admin", { mode: "boolean" }).notNull().default(false),
+ wrapped: integer("wrapped", {
+ mode: "boolean",
+ })
+ .notNull()
+ .default(true),
+ score: real("score"),
+ ssoProviderId: integer("sso_provider_id"),
+});
+
+export const folders = sqliteTable("folders", {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ syncId: text("sync_id").unique(),
+ cert: text("cert", { length: 8192 }),
+});
+`;
+
+describe("collectKeyColumns", () => {
+ it("finds columns that must be indexable", () => {
+ const keyed = collectKeyColumns(SOURCE);
+
+ // primary key, unique, and both ends of the foreign key
+ expect(keyed.has("id")).toBe(true);
+ expect(keyed.has("sync_id")).toBe(true);
+ expect(keyed.has("user_id")).toBe(true);
+ });
+
+ it("leaves ordinary strings alone", () => {
+ const keyed = collectKeyColumns(SOURCE);
+
+ expect(keyed.has("username")).toBe(false);
+ expect(keyed.has("name")).toBe(false);
+ expect(keyed.has("cert")).toBe(false);
+ });
+});
+
+describe("postgres output", () => {
+ const out = transform(SOURCE, "postgres");
+
+ it("is marked generated", () => {
+ expect(out.startsWith("// GENERATED FILE")).toBe(true);
+ });
+
+ it("uses pg-core", () => {
+ expect(out).toContain('from "drizzle-orm/pg-core"');
+ expect(out).not.toContain("sqlite-core");
+ expect(out).toContain("pgTable(");
+ expect(out).not.toContain("sqliteTable(");
+ });
+
+ it("maps autoincrement keys to serial", () => {
+ expect(out).toContain('serial("id").primaryKey()');
+ expect(out).not.toContain("autoIncrement");
+ });
+
+ it("maps integer-backed booleans, including the wrapped form", () => {
+ expect(out).toContain('boolean("is_admin")');
+ // Prettier splits longer declarations across lines; both must convert.
+ expect(out).toContain('boolean("wrapped")');
+ expect(out).not.toMatch(/mode:\s*"boolean"/);
+ });
+
+ it("keeps plain integers and maps real", () => {
+ expect(out).toContain('integer("sso_provider_id")');
+ expect(out).toContain('doublePrecision("score")');
+ });
+
+ it("makes key columns varchar and leaves the rest text", () => {
+ expect(out).toContain('varchar("id", { length: 255 })');
+ expect(out).toContain('varchar("user_id", { length: 255 })');
+ expect(out).toContain('varchar("sync_id", { length: 255 })');
+ expect(out).toContain('text("username")');
+ expect(out).toContain('text("name")');
+ });
+
+ it("drops the sqlite-only text length", () => {
+ expect(out).toContain('text("cert")');
+ expect(out).not.toContain("length: 8192");
+ });
+});
+
+describe("mysql output", () => {
+ const out = transform(SOURCE, "mysql");
+
+ it("uses mysql-core", () => {
+ expect(out).toContain('from "drizzle-orm/mysql-core"');
+ expect(out).toContain("mysqlTable(");
+ });
+
+ it("maps autoincrement keys to int auto_increment", () => {
+ expect(out).toContain('int("id").autoincrement().primaryKey()');
+ });
+
+ it("renames integer to int", () => {
+ expect(out).toContain('int("sso_provider_id")');
+ expect(out).not.toMatch(/\binteger\(/);
+ });
+
+ it("maps real to double", () => {
+ expect(out).toContain('double("score")');
+ });
+
+ it("makes key columns varchar โ MySQL cannot index unbounded TEXT", () => {
+ expect(out).toContain('varchar("user_id", { length: 255 })');
+ expect(out).toContain('text("name")');
+ });
+});
+
+describe("determinism", () => {
+ it("produces identical output for identical input", () => {
+ expect(transform(SOURCE, "postgres")).toBe(transform(SOURCE, "postgres"));
+ expect(transform(SOURCE, "mysql")).toBe(transform(SOURCE, "mysql"));
+ });
+
+ it("keeps foreign key behaviour verbatim", () => {
+ for (const dialect of ["postgres", "mysql"] as const) {
+ expect(transform(SOURCE, dialect)).toContain('onDelete: "cascade"');
+ }
+ });
+});
diff --git a/scripts/patch-guacamole-common-js.cjs b/scripts/patch-guacamole-common-js.cjs
new file mode 100644
index 0000000..039071d
--- /dev/null
+++ b/scripts/patch-guacamole-common-js.cjs
@@ -0,0 +1,68 @@
+const fs = require("fs");
+const path = require("path");
+
+const packageRoot = path.join(
+ __dirname,
+ "..",
+ "node_modules",
+ "guacamole-common-js",
+);
+
+const bundlePaths = [
+ path.join(packageRoot, "dist", "esm", "guacamole-common.js"),
+ path.join(packageRoot, "dist", "cjs", "guacamole-common.js"),
+];
+
+const oldFlushBlock =
+ " if (window.requestAnimationFrame && document.hasFocus())\n" +
+ " asyncFlush();\n" +
+ " else\n" +
+ " syncFlush();";
+
+const newFlushBlock =
+ " // Electron can throttle or skip requestAnimationFrame() for inactive\n" +
+ " // windows/tabs even while guacd is still sending display frames. Flush\n" +
+ " // synchronously so Guacamole connections do not stall while waiting for\n" +
+ " // a frame callback that may never run.\n" +
+ " syncFlush();";
+
+let patched = false;
+let foundBundle = false;
+
+for (const bundlePath of bundlePaths) {
+ if (!fs.existsSync(bundlePath)) {
+ console.log(
+ `[patch-guacamole-common-js] ${bundlePath} not found, skipping`,
+ );
+ continue;
+ }
+
+ foundBundle = true;
+ let content = fs.readFileSync(bundlePath, "utf8");
+ if (content.includes(newFlushBlock)) continue;
+
+ if (!content.includes(oldFlushBlock)) {
+ console.log(
+ `[patch-guacamole-common-js] Flush target not found in ${bundlePath}, skipping`,
+ );
+ continue;
+ }
+
+ content = content.replace(oldFlushBlock, newFlushBlock);
+ fs.writeFileSync(bundlePath, content);
+ patched = true;
+}
+
+if (!foundBundle) {
+ console.log("[patch-guacamole-common-js] File not found, skipping");
+ process.exit(0);
+}
+
+if (!patched) {
+ console.log("[patch-guacamole-common-js] Already patched");
+ process.exit(0);
+}
+
+console.log(
+ "[patch-guacamole-common-js] Patched display flush to avoid Electron requestAnimationFrame stalls",
+);
diff --git a/scripts/patch-guacamole-lite.cjs b/scripts/patch-guacamole-lite.cjs
index 67cdca6..c3d37bc 100644
--- a/scripts/patch-guacamole-lite.cjs
+++ b/scripts/patch-guacamole-lite.cjs
@@ -17,14 +17,41 @@ const cryptPath = path.join(
"lib",
"Crypt.js",
);
+const clientConnectionPath = path.join(
+ __dirname,
+ "..",
+ "node_modules",
+ "guacamole-lite",
+ "lib",
+ "ClientConnection.js",
+);
-if (!fs.existsSync(guacdClientPath) || !fs.existsSync(cryptPath)) {
+if (
+ !fs.existsSync(guacdClientPath) ||
+ !fs.existsSync(cryptPath) ||
+ !fs.existsSync(clientConnectionPath)
+) {
console.log("[patch-guacamole-lite] File not found, skipping");
process.exit(0);
}
+// Every patch below is required for correctness: protocol negotiation, the
+// guacd 1.6.0 name handshake, dynamic argument answering, UTF-8 tokens and
+// read-only joins. If an upstream release moves an anchor string, silently
+// skipping would ship a Termix that looks fine and then drops VNC/RDP sessions
+// at runtime, so a missing anchor has to stop the install instead.
+function missingAnchor(patch) {
+ console.error(
+ `[patch-guacamole-lite] ${patch} anchor not found in guacamole-lite. ` +
+ "The upstream file has changed and this patch no longer applies โ " +
+ "update scripts/patch-guacamole-lite.cjs to match the new source.",
+ );
+ process.exit(1);
+}
+
let guacdClientContent = fs.readFileSync(guacdClientPath, "utf8");
let cryptContent = fs.readFileSync(cryptPath, "utf8");
+let clientConnectionContent = fs.readFileSync(clientConnectionPath, "utf8");
// Patch 1: protocol version negotiation.
// guacamole-lite originally only accepted 1.0.0/1.1.0. Support the protocol
@@ -56,20 +83,26 @@ const newVersionBlock =
const oldTimezone = "if (protocolVersion === '1_1_0') {";
const newTimezone = "if (protocolVersion !== '1_0_0') {";
-// Patch 3: send the `name` handshake instruction for protocol >= 1.3.0.
-// The Guacamole protocol added the `name` instruction in 1.3.0 (an optional
-// human-readable identifier for the joining user). guacd 1.6.0 began requiring
-// it during the VNC handshake even when negotiating older protocol versions,
-// causing connections to silently drop right after "User joined". See
+// Patch 3: send the `name` handshake instruction for all protocol versions >= 1.1.0.
+// The Guacamole protocol added `name` in 1.3.0, but guacd 1.6.0 began requiring it
+// during the VNC handshake even when negotiating VERSION_1_1_0, causing connections to
+// silently drop right after "User joined". Sending it for all non-1.0.0 sessions is
+// harmless (guacd ignores unknown handshake instructions for older versions). See
// Termix-SSH/Support#567 and #734.
const oldConnect =
" this.sendInstruction(['connect'].concat(connectArgs));";
-const newConnect =
+const oldNameConnect =
" if (protocolVersion === '1_3_0' || protocolVersion === '1_5_0') {\n" +
" this.sendInstruction(['name', this.connectionSettings.name || 'guacamole-lite']);\n" +
" }\n" +
"\n" +
" this.sendInstruction(['connect'].concat(connectArgs));";
+const newConnect =
+ " if (protocolVersion !== '1_0_0') {\n" +
+ " this.sendInstruction(['name', this.connectionSettings.name || 'guacamole-lite']);\n" +
+ " }\n" +
+ "\n" +
+ " this.sendInstruction(['connect'].concat(connectArgs));";
// Patch 4: answer guacd's dynamic argument requests locally.
// macOS Screen Sharing can request VNC username/password through the
@@ -138,40 +171,33 @@ if (!guacdClientContent.includes("} else if (/^1_\\d+_0$/.test(version)) {")) {
newVersionBlock,
);
} else {
- console.log(
- "[patch-guacamole-lite] Version check target not found, skipping",
- );
- process.exit(0);
+ missingAnchor("Version check");
}
patched = true;
}
if (!guacdClientContent.includes(newTimezone)) {
if (!guacdClientContent.includes(oldTimezone)) {
- console.log("[patch-guacamole-lite] Timezone target not found, skipping");
- process.exit(0);
+ missingAnchor("Timezone");
}
guacdClientContent = guacdClientContent.replace(oldTimezone, newTimezone);
patched = true;
}
if (!guacdClientContent.includes(newConnect)) {
- if (!guacdClientContent.includes(oldConnect)) {
- console.log(
- "[patch-guacamole-lite] Connect target not found, skipping name patch",
- );
- process.exit(0);
+ if (guacdClientContent.includes(oldNameConnect)) {
+ guacdClientContent = guacdClientContent.replace(oldNameConnect, newConnect);
+ } else if (guacdClientContent.includes(oldConnect)) {
+ guacdClientContent = guacdClientContent.replace(oldConnect, newConnect);
+ } else {
+ missingAnchor("Connect");
}
- guacdClientContent = guacdClientContent.replace(oldConnect, newConnect);
patched = true;
}
if (!guacdClientContent.includes("this.nextArgumentStreamIndex = 0;")) {
if (!guacdClientContent.includes(oldSendBuffer)) {
- console.log(
- "[patch-guacamole-lite] Argument stream index target not found, skipping",
- );
- process.exit(0);
+ missingAnchor("Argument stream index");
}
guacdClientContent = guacdClientContent.replace(oldSendBuffer, newSendBuffer);
patched = true;
@@ -179,10 +205,7 @@ if (!guacdClientContent.includes("this.nextArgumentStreamIndex = 0;")) {
if (!guacdClientContent.includes("sendRequiredArguments(params) {")) {
if (!guacdClientContent.includes(oldSendInstructionBlock)) {
- console.log(
- "[patch-guacamole-lite] Required argument helper target not found, skipping",
- );
- process.exit(0);
+ missingAnchor("Required argument helper");
}
guacdClientContent = guacdClientContent.replace(
oldSendInstructionBlock,
@@ -195,10 +218,7 @@ if (
!guacdClientContent.includes("opcode === 'required' || opcode === 'require'")
) {
if (!guacdClientContent.includes(oldReadyHandler)) {
- console.log(
- "[patch-guacamole-lite] Required opcode target not found, skipping",
- );
- process.exit(0);
+ missingAnchor("Required opcode");
}
guacdClientContent = guacdClientContent.replace(
oldReadyHandler,
@@ -251,14 +271,93 @@ if (!cryptContent.includes(newDecryptBlock)) {
newDecryptBlock,
);
} else {
- console.log(
- "[patch-guacamole-lite] UTF-8 token decrypt target not found, skipping",
- );
- process.exit(0);
+ missingAnchor("UTF-8 token decrypt");
}
patched = true;
}
+// Patch 7: drop client-to-guacd input instructions from read-only session-share
+// joins. guacd has no native read-only enforcement in the versions this project
+// targets, so Termix must gate here. Denylist (not allowlist) on purpose: an
+// unrecognized opcode is far more likely to be protocol plumbing (sync, blob,
+// clipboard streams) than a new input vector, so failing open is the safer
+// default for a client we already control.
+const oldSendMessageToGuacd =
+ " sendMessageToGuacd(message) {\n" +
+ " this.lastActivity = Date.now();\n" +
+ " this.logger.log(LOGLEVEL.DEBUG, '[ >>> # ] Received from WS: ```' + message + '```');\n" +
+ "\n" +
+ " if (this.guacdClient) {\n" +
+ " this.guacdClient.send(message, true);\n" +
+ " }\n" +
+ " }";
+const newSendMessageToGuacd =
+ " sendMessageToGuacd(message) {\n" +
+ " this.lastActivity = Date.now();\n" +
+ " this.logger.log(LOGLEVEL.DEBUG, '[ >>> # ] Received from WS: ```' + message + '```');\n" +
+ "\n" +
+ " if (this.isReadOnlyJoin() && this.isInputInstruction(message)) {\n" +
+ " return;\n" +
+ " }\n" +
+ "\n" +
+ " if (this.guacdClient) {\n" +
+ " this.guacdClient.send(message, true);\n" +
+ " }\n" +
+ " }\n" +
+ "\n" +
+ " isReadOnlyJoin() {\n" +
+ " const connection = this.connectionSettings && this.connectionSettings.connection;\n" +
+ " return !!(connection && connection.join && connection.readOnly === true);\n" +
+ " }\n" +
+ "\n" +
+ " // Termix-only read-only gate, not part of the vendored library: extracts just\n" +
+ " // the leading opcode from a raw '.,...;' instruction without the\n" +
+ " // overhead of a full stateful parse.\n" +
+ " isInputInstruction(message) {\n" +
+ " const dot = message.indexOf('.');\n" +
+ " if (dot === -1) return false;\n" +
+ " const len = parseInt(message.substring(0, dot), 10);\n" +
+ " if (isNaN(len)) return false;\n" +
+ " const opcode = message.substring(dot + 1, dot + 1 + len);\n" +
+ " return ['mouse', 'key', 'touch', 'size'].includes(opcode);\n" +
+ " }";
+
+if (!clientConnectionContent.includes("isReadOnlyJoin()")) {
+ if (!clientConnectionContent.includes(oldSendMessageToGuacd)) {
+ missingAnchor("sendMessageToGuacd");
+ }
+ clientConnectionContent = clientConnectionContent.replace(
+ oldSendMessageToGuacd,
+ newSendMessageToGuacd,
+ );
+ patched = true;
+}
+
+// Patch 8: mergeConnectionOptions only preserves `join` across the settings
+// merge, dropping Termix's `readOnly` flag before sendMessageToGuacd can see it.
+const oldPreserveJoin =
+ " // For join connections, preserve the join property\n" +
+ " if (this.connectionSettings.connection.join) {\n" +
+ " compiledSettings.join = this.connectionSettings.connection.join;\n" +
+ " }";
+const newPreserveJoin =
+ " // For join connections, preserve the join property\n" +
+ " if (this.connectionSettings.connection.join) {\n" +
+ " compiledSettings.join = this.connectionSettings.connection.join;\n" +
+ " compiledSettings.readOnly = this.connectionSettings.connection.readOnly === true;\n" +
+ " }";
+
+if (!clientConnectionContent.includes("compiledSettings.readOnly")) {
+ if (!clientConnectionContent.includes(oldPreserveJoin)) {
+ missingAnchor("join-preserve");
+ }
+ clientConnectionContent = clientConnectionContent.replace(
+ oldPreserveJoin,
+ newPreserveJoin,
+ );
+ patched = true;
+}
+
if (!patched) {
console.log("[patch-guacamole-lite] Already patched");
process.exit(0);
@@ -266,6 +365,7 @@ if (!patched) {
fs.writeFileSync(guacdClientPath, guacdClientContent);
fs.writeFileSync(cryptPath, cryptContent);
+fs.writeFileSync(clientConnectionPath, clientConnectionContent);
console.log(
- "[patch-guacamole-lite] Patched protocol VERSION_1_3_0/1_5_0 support, name handshake, required arguments, and UTF-8 token decrypt",
+ "[patch-guacamole-lite] Patched protocol VERSION_1_3_0/1_5_0 support, name handshake, required arguments, UTF-8 token decrypt, and read-only join input filtering",
);
diff --git a/scripts/patch-guacamole-lite.test.ts b/scripts/patch-guacamole-lite.test.ts
index d6b8c9e..70e3ad3 100644
--- a/scripts/patch-guacamole-lite.test.ts
+++ b/scripts/patch-guacamole-lite.test.ts
@@ -69,6 +69,31 @@ describe("patch-guacamole-lite", () => {
]);
});
+ it("sends name instruction for VERSION_1_1_0 to fix guacd 1.6.0 VNC drops", () => {
+ const client = createPatchedClient({
+ hostname: "192.0.2.10",
+ port: 5900,
+ password: "secret",
+ width: 1280,
+ height: 720,
+ dpi: 96,
+ });
+
+ client.sendHandshakeReply(["VERSION_1_1_0", "hostname", "port"]);
+
+ expect(client.sendInstruction).toHaveBeenCalledWith(["timezone"]);
+ expect(client.sendInstruction).toHaveBeenCalledWith([
+ "name",
+ "guacamole-lite",
+ ]);
+ expect(client.sendInstruction).toHaveBeenCalledWith([
+ "connect",
+ "VERSION_1_1_0",
+ "192.0.2.10",
+ 5900,
+ ]);
+ });
+
it("answers required credentials through argument value streams", () => {
const client = createPatchedClient({
username: "",
diff --git a/scripts/patch-nan.cjs b/scripts/patch-nan.cjs
index 5fec17f..43aad38 100644
--- a/scripts/patch-nan.cjs
+++ b/scripts/patch-nan.cjs
@@ -39,6 +39,19 @@ const nanHeaderPatched = patchFile(path.join(nanDir, "nan.h"), [
# define __builtin_frame_address(level) _AddressOfReturnAddress()
#endif
+// v8::External::New()/->Value() gained a mandatory ExternalPointerTypeTag
+// argument in V8 15 (Electron 43+). Plain Node (V8 <= 13.x as of Node 24)
+// still uses the old 2-arg signatures, so this must be conditional rather
+// than assumed - a build can target either header set.
+#include
+#if defined(V8_MAJOR_VERSION) && V8_MAJOR_VERSION >= 15
+# define NAN_EXTERNAL_TAG_ARG , static_cast(0)
+# define NAN_EXTERNAL_TAG_PARAM static_cast(0)
+#else
+# define NAN_EXTERNAL_TAG_ARG
+# define NAN_EXTERNAL_TAG_PARAM
+#endif
+
#define NODE_0_10_MODULE_VERSION 11`,
},
]);
@@ -63,23 +76,24 @@ const bindingPatched = patchFile(bindingPath, [
},
]);
-// 2. nan_implementation_12_inl.h: replace v8::External::New() with the 3-arg form.
-// Electron 42 / V8 13+ requires an ExternalPointerTypeTag as the third argument.
+// 2. nan_implementation_12_inl.h: replace v8::External::New() with a form that
+// passes NAN_EXTERNAL_TAG_ARG - a macro (defined in the nan.h patch above)
+// that expands to the ExternalPointerTypeTag argument only when the target
+// V8 headers actually declare it (V8 15+ / Electron 43+).
const implPath = path.join(nanDir, "nan_implementation_12_inl.h");
let implPatched = false;
if (fs.existsSync(implPath)) {
let src = fs.readFileSync(implPath, "utf8");
const before = src;
- const TAG = "static_cast(0)";
- if (!src.includes(TAG)) {
+ if (!src.includes("NAN_EXTERNAL_TAG_ARG")) {
src = src.replace(
- /v8::External::New\(v8::Isolate::GetCurrent\(\),\s*value\)/g,
- `v8::External::New(v8::Isolate::GetCurrent(), value, ${TAG})`,
+ /v8::External::New\(v8::Isolate::GetCurrent\(\),\s*value(?:,\s*static_cast\(0\))?\)/g,
+ `v8::External::New(v8::Isolate::GetCurrent(), value NAN_EXTERNAL_TAG_ARG)`,
);
src = src.replace(
- /v8::External::New\(isolate,\s*reinterpret_cast\(callback\)\)/g,
- `v8::External::New(isolate, reinterpret_cast(callback), ${TAG})`,
+ /v8::External::New\(isolate,\s*reinterpret_cast\(callback\)(?:,\s*static_cast\(0\))?\)/g,
+ `v8::External::New(isolate, reinterpret_cast(callback) NAN_EXTERNAL_TAG_ARG)`,
);
}
@@ -89,20 +103,19 @@ if (fs.existsSync(implPath)) {
}
}
-// 3. nan_callbacks_12_inl.h: replace ->Value() with ->Value(tag) on v8::External.
-// The new API requires an ExternalPointerTypeTag argument.
+// 3. nan_callbacks_12_inl.h: replace ->Value() with ->Value(NAN_EXTERNAL_TAG_PARAM)
+// on v8::External, same conditional-tag reasoning as above.
const callbacksPath = path.join(nanDir, "nan_callbacks_12_inl.h");
let callbacksPatched = false;
if (fs.existsSync(callbacksPath)) {
let src = fs.readFileSync(callbacksPath, "utf8");
const before = src;
- const TAG = "static_cast(0)";
- if (!src.includes(TAG)) {
- // Pattern: .As()->Value()) โ always followed by ))
+ if (!src.includes("NAN_EXTERNAL_TAG_PARAM")) {
+ // Pattern: .As()->Value()) or ->Value())
src = src.replace(
- /\.As\(\)->Value\(\)\)/g,
- `.As()->Value(${TAG}))`,
+ /\.As\(\)->Value\((?:static_cast\(0\))?\)\)/g,
+ `.As()->Value(NAN_EXTERNAL_TAG_PARAM))`,
);
}
diff --git a/scripts/patch-xterm-android-ime.cjs b/scripts/patch-xterm-android-ime.cjs
index e7738b3..4bbff4a 100644
--- a/scripts/patch-xterm-android-ime.cjs
+++ b/scripts/patch-xterm-android-ime.cjs
@@ -14,6 +14,17 @@ const xtermDir = path.join(
// xtermjs/xterm.js#3600 remains unresolved upstream. Android IMEs can restart
// composition on the previous word and replace it with a shorter value (for
// example, Vietnamese "Hoar" -> "Hแปa"). xterm 6.0 otherwise emits nothing.
+//
+// Also fixes _handleAnyTextareaChanges, which iOS Safari/WKWebView drives
+// for ordinary typing (it reports keyCode 229 for all software-keyboard
+// input, not just IME composition). That handler diffs the textarea value
+// via `newValue.replace(oldValue, "")`, a literal substring removal. When
+// keystrokes arrive faster than the function's setTimeout(0) callback runs,
+// several overlapping callbacks each capture a stale oldValue, so the
+// literal-substring search fails to match and the diff silently comes back
+// empty - characters are dropped instead of sent. Swap in the same
+// common-prefix diff used for composition-end above so a stale oldValue
+// still yields the correct delta.
const patches = [
{
file: "xterm.mjs",
@@ -34,6 +45,10 @@ const patches = [
"e.start+=this._dataAlreadySent.length,this._isComposing?i=this._textarea.value.substring(e.start,this._compositionPosition.start):i=this._textarea.value.substring(e.start),i.length>0&&",
"e.start+=this._dataAlreadySent.length;if(this._isComposing)i=this._textarea.value.substring(e.start,this._compositionPosition.start);else{const t=this._textarea.value;if(t.length0&&",
],
+ [
+ '_handleAnyTextareaChanges(){let t=this._textarea.value;setTimeout(()=>{if(!this._isComposing){let e=this._textarea.value,i=e.replace(t,"");this._dataAlreadySent=i,e.length>t.length?this._coreService.triggerDataEvent(i,!0):e.length{if(!this._isComposing){let e=this._textarea.value,r=0;const n=Math.min(e.length,t.length);for(;r0&&this._coreService.triggerDataEvent(i,!0)}},0)}",
+ ],
],
},
{
@@ -55,6 +70,10 @@ const patches = [
"e.start+=this._dataAlreadySent.length,t=this._isComposing?this._textarea.value.substring(e.start,this._compositionPosition.start):this._textarea.value.substring(e.start),t.length>0&&",
"e.start+=this._dataAlreadySent.length;this._isComposing?t=this._textarea.value.substring(e.start,this._compositionPosition.start):(()=>{const s=this._textarea.value;if(s.length0&&",
],
+ [
+ '_handleAnyTextareaChanges(){const e=this._textarea.value;setTimeout((()=>{if(!this._isComposing){const t=this._textarea.value,i=t.replace(e,"");this._dataAlreadySent=i,t.length>e.length?this._coreService.triggerDataEvent(i,!0):t.length{if(!this._isComposing){const t=this._textarea.value;let r=0;const n=Math.min(t.length,e.length);for(;r0&&this._coreService.triggerDataEvent(i,!0)}}),0)}",
+ ],
],
},
];
@@ -66,18 +85,24 @@ for (const { file, replacements } of patches) {
}
let source = fs.readFileSync(filePath, "utf8");
- if (source.includes("_preCompositionValue")) {
- console.log(`[patch-xterm-android-ime] ${file} already patched`);
- continue;
- }
+ let changed = false;
for (const [original, patched] of replacements) {
+ if (source.includes(patched)) {
+ continue;
+ }
if (!source.includes(original)) {
throw new Error(
`[patch-xterm-android-ime] Expected source not found in ${file}`,
);
}
source = source.replace(original, patched);
+ changed = true;
+ }
+
+ if (!changed) {
+ console.log(`[patch-xterm-android-ime] ${file} already patched`);
+ continue;
}
fs.writeFileSync(filePath, source);
diff --git a/scripts/verify-dialects.mjs b/scripts/verify-dialects.mjs
new file mode 100644
index 0000000..308a530
--- /dev/null
+++ b/scripts/verify-dialects.mjs
@@ -0,0 +1,140 @@
+/**
+ * Runs the repository layer against a real Postgres or MySQL server.
+ *
+ * The unit tests only ever see SQLite, so the parts of this codebase that
+ * differ per engine โ the RETURNING replacements, the read-then-write
+ * transactions, the value encoders โ have no coverage there at all. This is
+ * what covers them, and it needs a live server, which is why it is a script
+ * rather than a test.
+ *
+ * Usage:
+ * npm run verify:dialect -- postgres://user:pass@host:5432/db
+ * npm run verify:dialect -- mysql://user:pass@host:3306/db
+ *
+ * Applies the migrations first, through the same runRemoteMigrations() the
+ * application uses at startup โ so a broken migration fails here rather than in
+ * production. Writes real rows: point it at a scratch database.
+ */
+
+import { randomUUID } from "crypto";
+
+const url = process.argv[2];
+if (!url) {
+ console.error("usage: node scripts/verify-dialects.mjs ");
+ process.exit(2);
+}
+
+const scheme = url.split("://", 1)[0].toLowerCase();
+const dialect = scheme.startsWith("postgres")
+ ? "postgres"
+ : scheme === "mysql" || scheme === "mariadb"
+ ? "mysql"
+ : null;
+
+if (!dialect) {
+ console.error(`unsupported URL scheme "${scheme}://"`);
+ process.exit(2);
+}
+
+const { drizzle } = await import(
+ dialect === "postgres" ? "drizzle-orm/node-postgres" : "drizzle-orm/mysql2"
+);
+
+// No schema option on purpose โ see connect.ts.
+const db = drizzle(url);
+const context = { dialect, drizzle: db };
+
+const { runRemoteMigrations } =
+ await import("../src/backend/database/db/migrate.js");
+await runRemoteMigrations(dialect, db);
+
+const { UserRepository } =
+ await import("../src/backend/database/repositories/user-repository.js");
+const { HostRepository } =
+ await import("../src/backend/database/repositories/host-repository.js");
+const { SettingsRepository } =
+ await import("../src/backend/database/repositories/settings-repository.js");
+
+let failures = 0;
+const check = (label, got, want) => {
+ const ok = JSON.stringify(got) === JSON.stringify(want);
+ if (!ok) failures++;
+ console.log(
+ ` ${ok ? "ok " : "FAIL"} ${label}` +
+ (ok
+ ? ""
+ : `\n got ${JSON.stringify(got)}, want ${JSON.stringify(want)}`),
+ );
+};
+
+console.log(`\nverifying ${dialect} at ${url.replace(/:[^:@]*@/, ":***@")}\n`);
+
+const users = new UserRepository(context);
+const userId = `verify-${randomUUID()}`;
+
+// insertReturning: on MySQL this is an insert plus a read inside a transaction.
+const created = await users.create({
+ id: userId,
+ username: "before",
+ passwordHash: "x",
+ isAdmin: true,
+});
+check("insert returns the stored row", created?.username, "before");
+
+// The one non-identity value encoder in the schema. Booleans are integers in
+// the sqlite definitions the repositories import, so this asserts that 1/0
+// survives a round trip through a native boolean column.
+check("boolean true survives the round trip", created?.isAdmin, true);
+
+// updateReturning must report the state AFTER the write. Reading first would
+// return the value the update replaced โ silently, with no error.
+const updated = await users.update(userId, { username: "after" });
+check("update returns the new value", updated?.username, "after");
+
+const hosts = new HostRepository(context);
+const host = await hosts.create({
+ userId,
+ name: "verify",
+ ip: "127.0.0.1",
+ port: 22,
+ username: "root",
+ authType: "password",
+ enableTerminal: true,
+});
+check(
+ "autoincrement id came back",
+ typeof host?.id === "number" && host.id > 0,
+ true,
+);
+check(
+ "database-assigned createdAt came back",
+ typeof host?.createdAt === "string" && host.createdAt.length > 0,
+ true,
+);
+
+// deleteReturning must report the state BEFORE the write. Reading afterwards
+// would find nothing at all.
+const settings = new SettingsRepository(context);
+const prefix = `verify-${randomUUID()}`;
+await settings.set(`${prefix}-a`, "1");
+await settings.set(`${prefix}-b`, "2");
+check(
+ "delete reports the rows it removed",
+ await settings.deleteLike(`${prefix}-%`),
+ 2,
+);
+check(
+ "and they are actually gone",
+ (await settings.listAll()).filter((row) => row.key.startsWith(prefix)).length,
+ 0,
+);
+
+await hosts.deleteForUser(userId, host.id);
+check("host really deleted", await hosts.findById(host.id), null);
+
+console.log(
+ failures === 0
+ ? `\n${dialect}: all checks passed\n`
+ : `\n${dialect}: ${failures} FAILED\n`,
+);
+process.exit(failures === 0 ? 0 : 1);
diff --git a/src/backend/ai/context.ts b/src/backend/ai/context.ts
new file mode 100644
index 0000000..ce8fc40
--- /dev/null
+++ b/src/backend/ai/context.ts
@@ -0,0 +1,55 @@
+/**
+ * The system prompt.
+ *
+ * Deliberately small: the assistant starts with almost no context and must call
+ * a read tool to learn anything. That keeps token cost predictable, makes every
+ * data access visible in the transcript, and means nothing is sent to a
+ * third-party provider that the user did not implicitly ask for.
+ */
+export function buildSystemPrompt(options: {
+ hostCount: number;
+ activeTab?: string | null;
+ allowReadOnlyCommands: boolean;
+}): string {
+ const lines: string[] = [
+ "You are the assistant built into Termix, a self-hosted server management app.",
+ "You help the user manage their servers, snippets, automations, fleets and alerts.",
+ "",
+ "How you work:",
+ "- You start with no knowledge of this user's setup. Call a read tool to find out anything you need.",
+ "- You cannot change anything directly. To make a change, call a propose_* tool; the user sees a card and approves or rejects it.",
+ "- You have no access to passwords, SSH keys, API keys or any other credential, and you never ask the user to paste one into the chat.",
+ "",
+ "Scope:",
+ "- Do exactly what was asked, and nothing beyond it. A question is a request for an answer, not for changes.",
+ "- Questions like 'what is running on this server', 'check this host' or 'why is this slow' are answered with information. Read, then report. Do not propose anything.",
+ "- Only propose a change when the user asked for one, in words like 'add', 'create', 'set up', 'fix' or 'change'.",
+ "- Do not propose follow-up work you thought of yourself: no monitoring, no alert rules, no scripts, no snippets, no cleanup, unless that is what was requested.",
+ "- If you think something is worth doing, say so in one sentence and stop. Let the user ask.",
+ "- One request means one proposal at most. Do not bundle extras alongside it.",
+ "",
+ "How to answer:",
+ "- Lead with the answer. Keep responses short and concrete.",
+ "- When you propose something, say in one line what it does and why.",
+ "- If a request is ambiguous in a way that changes what you would propose, ask before proposing.",
+ "- Never claim you have done something. You propose; the user applies.",
+ ];
+
+ if (options.allowReadOnlyCommands) {
+ lines.push(
+ "- The user has allowed you to run read-only diagnostic commands directly. Anything that changes state still has to be proposed.",
+ );
+ }
+
+ lines.push(
+ "",
+ "Current context:",
+ `- The user has ${options.hostCount} host${options.hostCount === 1 ? "" : "s"} configured.`,
+ );
+
+ if (options.activeTab) {
+ lines.push(`- They are currently looking at: ${options.activeTab}.`);
+ }
+
+ return lines.join("\n");
+}
diff --git a/src/backend/ai/egress.ts b/src/backend/ai/egress.ts
new file mode 100644
index 0000000..700b11c
--- /dev/null
+++ b/src/backend/ai/egress.ts
@@ -0,0 +1,113 @@
+import { isIP } from "net";
+import { isBlockedAddress } from "../utils/safe-outbound-fetch.js";
+import { createCurrentSettingsRepository } from "../database/repositories/factory.js";
+
+/**
+ * Where the assistant is allowed to send requests.
+ *
+ * Cloud providers are reached through the SSRF-guarded path, which refuses to
+ * resolve to a private address. That guard is exactly what a self-hosted Ollama
+ * on localhost trips over, so private destinations are permitted only when an
+ * admin has named the host. Without that split, any logged-in user could point
+ * a "provider" at an internal service and use the backend as an authenticated
+ * probe of the server's own network.
+ */
+
+export const AI_PRIVATE_ALLOWLIST_KEY = "ai_private_endpoint_allowlist";
+
+/** Hosts a self-hoster almost certainly wants, and which reach only this machine. */
+export const DEFAULT_PRIVATE_ALLOWLIST = [
+ "localhost",
+ "127.0.0.1",
+ "::1",
+ "host.docker.internal",
+];
+
+export function parseAllowlist(raw: string | null): string[] {
+ if (!raw) return [...DEFAULT_PRIVATE_ALLOWLIST];
+ try {
+ const parsed = JSON.parse(raw);
+ if (!Array.isArray(parsed)) return [...DEFAULT_PRIVATE_ALLOWLIST];
+ return parsed
+ .filter((entry): entry is string => typeof entry === "string")
+ .map((entry) => entry.trim().toLowerCase())
+ .filter(Boolean);
+ } catch {
+ return [...DEFAULT_PRIVATE_ALLOWLIST];
+ }
+}
+
+export async function readPrivateAllowlist(): Promise {
+ const raw = await createCurrentSettingsRepository().get(
+ AI_PRIVATE_ALLOWLIST_KEY,
+ );
+ return parseAllowlist(raw);
+}
+
+function normalizeHost(hostname: string): string {
+ return hostname.replace(/^\[|\]$/g, "").toLowerCase();
+}
+
+/**
+ * True when the URL names a destination the SSRF guard would refuse. A bare
+ * hostname that is not an IP literal (e.g. "ollama.internal") is treated as
+ * private only if it is "localhost" -- anything else resolves through DNS and
+ * is caught at connect time by the guard instead.
+ */
+export function isPrivateDestination(rawUrl: string): boolean {
+ let url: URL;
+ try {
+ url = new URL(rawUrl);
+ } catch {
+ return false;
+ }
+ const host = normalizeHost(url.hostname);
+ if (host === "localhost" || host.endsWith(".localhost")) return true;
+ if (isIP(host)) return isBlockedAddress(host);
+ return false;
+}
+
+export interface EgressDecision {
+ allowed: boolean;
+ /** True when the destination needs the allowlisted-private path. */
+ isPrivate: boolean;
+ reason?: string;
+}
+
+export function evaluateEgress(
+ rawUrl: string,
+ allowlist: string[],
+): EgressDecision {
+ let url: URL;
+ try {
+ url = new URL(rawUrl);
+ } catch {
+ return { allowed: false, isPrivate: false, reason: "Invalid URL" };
+ }
+
+ if (!["http:", "https:"].includes(url.protocol)) {
+ return { allowed: false, isPrivate: false, reason: "Unsupported protocol" };
+ }
+ if (url.username || url.password) {
+ return {
+ allowed: false,
+ isPrivate: false,
+ reason: "Credentials in URL are not allowed",
+ };
+ }
+
+ const host = normalizeHost(url.hostname);
+ const isPrivate = isPrivateDestination(rawUrl);
+
+ if (!isPrivate) return { allowed: true, isPrivate: false };
+
+ const normalized = allowlist.map((entry) => entry.trim().toLowerCase());
+ if (normalized.includes(host)) return { allowed: true, isPrivate: true };
+
+ return {
+ allowed: false,
+ isPrivate: true,
+ reason:
+ "This address is on a private network. An administrator must add its host to the AI endpoint allowlist first.",
+ };
+}
diff --git a/src/backend/ai/engine.ts b/src/backend/ai/engine.ts
new file mode 100644
index 0000000..17aaed0
--- /dev/null
+++ b/src/backend/ai/engine.ts
@@ -0,0 +1,150 @@
+import { getErrorMessage } from "../utils/error-message.js";
+import { getAdapter } from "./providers/registry.js";
+import type {
+ ChatMessage,
+ ProviderConfig,
+ ToolCall,
+} from "./providers/types.js";
+import { redact, redactToJson } from "./redaction.js";
+import { getTool, toolDefinitions } from "./tools/catalog.js";
+import {
+ isProposalDraft,
+ type ProposalDraft,
+ type ToolContext,
+} from "./tools/types.js";
+
+/**
+ * The agent loop: stream a turn, run any tools the model asked for, feed the
+ * results back, repeat. Bounded so a model that keeps calling tools cannot spin
+ * forever.
+ */
+
+const MAX_TURNS = 8;
+
+export type EngineEvent =
+ | { type: "token"; text: string }
+ | { type: "tool_call"; name: string; arguments: Record }
+ | { type: "tool_result"; name: string; result: unknown }
+ | { type: "proposal"; draft: ProposalDraft }
+ | { type: "assistant_message"; content: string; toolCalls: ToolCall[] }
+ | { type: "done" }
+ | { type: "error"; message: string };
+
+export interface EngineOptions {
+ config: ProviderConfig;
+ model: string;
+ system: string;
+ history: ChatMessage[];
+ context: ToolContext;
+ signal?: AbortSignal;
+}
+
+export async function* runAgent(
+ options: EngineOptions,
+): AsyncGenerator {
+ const adapter = getAdapter(options.config.providerType);
+ const tools = toolDefinitions();
+ const messages: ChatMessage[] = [...options.history];
+
+ for (let turn = 0; turn < MAX_TURNS; turn += 1) {
+ let text = "";
+ const calls: ToolCall[] = [];
+ let failed = false;
+
+ try {
+ for await (const chunk of adapter.streamChat(options.config, {
+ model: options.model,
+ system: options.system,
+ messages,
+ tools,
+ signal: options.signal,
+ })) {
+ if (chunk.type === "text") {
+ text += chunk.text;
+ yield { type: "token", text: chunk.text };
+ } else if (chunk.type === "tool_call") {
+ calls.push(chunk.call);
+ } else if (chunk.type === "error") {
+ failed = true;
+ yield { type: "error", message: chunk.message };
+ }
+ }
+ } catch (error) {
+ const message = getErrorMessage(error, "The provider request failed");
+ yield { type: "error", message };
+ return;
+ }
+
+ if (failed) return;
+
+ yield { type: "assistant_message", content: text, toolCalls: calls };
+
+ if (!calls.length) {
+ yield { type: "done" };
+ return;
+ }
+
+ messages.push({ role: "assistant", content: text, toolCalls: calls });
+
+ for (const call of calls) {
+ yield { type: "tool_call", name: call.name, arguments: call.arguments };
+
+ const result = await runTool(call, options.context);
+
+ if (isProposalDraft(result)) {
+ // Closes the tool call before the proposal card is emitted. Without
+ // this the call has no matching result and renders as permanently
+ // running, even though the work is done and awaiting the user.
+ yield {
+ type: "tool_result",
+ name: call.name,
+ result: { status: "awaiting_user_approval" },
+ };
+ yield { type: "proposal", draft: result };
+ // The model is told the proposal is awaiting the user rather than done,
+ // so it does not go on to describe the change as applied.
+ messages.push({
+ role: "tool",
+ content: JSON.stringify({
+ status: "awaiting_user_approval",
+ summary: result.summary,
+ }),
+ toolCallId: call.id,
+ toolName: call.name,
+ });
+ continue;
+ }
+
+ yield { type: "tool_result", name: call.name, result: redact(result) };
+ messages.push({
+ role: "tool",
+ content: redactToJson(result),
+ toolCallId: call.id,
+ toolName: call.name,
+ });
+ }
+ }
+
+ // Ran out of turns with the model still calling tools.
+ yield {
+ type: "error",
+ message: "The assistant used too many steps without finishing.",
+ };
+}
+
+async function runTool(call: ToolCall, context: ToolContext): Promise {
+ const tool = getTool(call.name);
+
+ // A model can emit any name it likes; only the catalog decides what runs.
+ if (!tool) {
+ return { error: `Unknown tool: ${call.name}` };
+ }
+
+ try {
+ return await tool.handler(call.arguments ?? {}, context);
+ } catch (error) {
+ return {
+ error: getErrorMessage(error, "The tool failed"),
+ };
+ }
+}
diff --git a/src/backend/ai/gating.ts b/src/backend/ai/gating.ts
new file mode 100644
index 0000000..689363a
--- /dev/null
+++ b/src/backend/ai/gating.ts
@@ -0,0 +1,70 @@
+import type { NextFunction, Response } from "express";
+import type { AuthenticatedRequest } from "../../types/index.js";
+import {
+ createCurrentSettingsRepository,
+ createCurrentUserPreferenceRepository,
+} from "../database/repositories/factory.js";
+
+/**
+ * Three gates, all checked on the server.
+ *
+ * The admin global is a hard kill switch: when it is off the feature does not
+ * exist for anyone, regardless of what any user has enabled. It defaults to
+ * false so upgrading an existing install turns nothing on by surprise.
+ *
+ * Mirrors the shape of isSharingEnabledForHost in the session-sharing routes,
+ * where the global also wins over the per-entity setting.
+ */
+
+export const AI_GLOBAL_ENABLED_KEY = "ai_globally_enabled";
+
+export async function isAiGloballyEnabled(): Promise {
+ return createCurrentSettingsRepository().getBoolean(
+ AI_GLOBAL_ENABLED_KEY,
+ false,
+ );
+}
+
+export interface AiAccess {
+ enabled: boolean;
+ allowReadOnlyCommands: boolean;
+}
+
+export async function resolveAiAccess(userId: string): Promise {
+ const globalEnabled = await isAiGloballyEnabled();
+ if (!globalEnabled) {
+ return { enabled: false, allowReadOnlyCommands: false };
+ }
+
+ const preferences =
+ await createCurrentUserPreferenceRepository().findByUserId(userId);
+
+ return {
+ // Null means the user was never asked, which is not consent.
+ enabled: preferences?.aiAssistantEnabled === true,
+ allowReadOnlyCommands: preferences?.aiReadOnlyCommands === true,
+ };
+}
+
+/** Rejects any AI request unless both gates are open. */
+export function createAiGate() {
+ return async (
+ req: AuthenticatedRequest,
+ res: Response,
+ next: NextFunction,
+ ): Promise => {
+ if (!req.userId) {
+ res.status(401).json({ error: "Authentication required" });
+ return;
+ }
+
+ const access = await resolveAiAccess(req.userId);
+ if (!access.enabled) {
+ res.status(403).json({ error: "The AI assistant is not enabled" });
+ return;
+ }
+
+ (req as AuthenticatedRequest & { aiAccess?: AiAccess }).aiAccess = access;
+ next();
+ };
+}
diff --git a/src/backend/ai/index.ts b/src/backend/ai/index.ts
new file mode 100644
index 0000000..aa31f60
--- /dev/null
+++ b/src/backend/ai/index.ts
@@ -0,0 +1,976 @@
+import { getErrorMessage } from "../utils/error-message.js";
+import express from "express";
+import type { AuthenticatedRequest } from "../../types/index.js";
+import { AuthManager } from "../utils/auth-manager.js";
+import { databaseLogger } from "../utils/logger.js";
+import {
+ getAuditUsername,
+ getRequestMeta,
+ logAudit,
+} from "../utils/audit-logger.js";
+import {
+ createCurrentAiRepository,
+ createCurrentHostRepository,
+} from "../database/repositories/factory.js";
+import { buildSystemPrompt } from "./context.js";
+import { runAgent } from "./engine.js";
+import {
+ createAiGate,
+ isAiGloballyEnabled,
+ resolveAiAccess,
+} from "./gating.js";
+import {
+ FALLBACK_MODELS,
+ getAdapter,
+ REQUIRES_API_KEY,
+ REQUIRES_BASE_URL,
+} from "./providers/registry.js";
+import type {
+ AiProviderType,
+ ChatMessage,
+ ProviderConfig,
+} from "./providers/types.js";
+import { isAiProviderType } from "./providers/types.js";
+import { applyProposal } from "./tools/executor.js";
+
+const router = express.Router();
+
+const authManager = AuthManager.getInstance();
+const authenticateJWT = authManager.createAuthMiddleware();
+const requireDataAccess = authManager.createDataAccessMiddleware();
+const aiGate = createAiGate();
+
+function parseId(raw: unknown): number | null {
+ const id = typeof raw === "string" ? parseInt(raw, 10) : Number(raw);
+ return Number.isInteger(id) && id > 0 ? id : null;
+}
+
+/**
+ * @openapi
+ * /ai/status:
+ * get:
+ * summary: Whether the AI assistant is available to this user
+ * description: >
+ * Deliberately not behind the AI gate: the frontend calls this to decide
+ * whether to render any AI surface at all, and needs a plain answer rather
+ * than a 403 when the feature is off.
+ * tags:
+ * - AI
+ * responses:
+ * 200:
+ * description: The effective enablement state.
+ */
+router.get("/status", authenticateJWT, async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ try {
+ const [globalEnabled, access] = await Promise.all([
+ isAiGloballyEnabled(),
+ resolveAiAccess(userId),
+ ]);
+ res.json({
+ globallyEnabled: globalEnabled,
+ enabled: access.enabled,
+ allowReadOnlyCommands: access.allowReadOnlyCommands,
+ });
+ } catch (err) {
+ databaseLogger.error("Failed to read AI status", err, {
+ operation: "ai_status_failed",
+ userId,
+ });
+ res.status(500).json({ error: "Failed to read AI status" });
+ }
+});
+
+/**
+ * @openapi
+ * /ai/providers:
+ * get:
+ * summary: List the user's configured AI providers
+ * tags:
+ * - AI
+ * responses:
+ * 200:
+ * description: Providers, with API keys masked.
+ * 403:
+ * description: The AI assistant is not enabled.
+ */
+router.get(
+ "/providers",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ try {
+ const providers = await createCurrentAiRepository().listProviders(userId);
+ res.json({ providers });
+ } catch (err) {
+ databaseLogger.error("Failed to list AI providers", err, {
+ operation: "ai_providers_list_failed",
+ userId,
+ });
+ res.status(500).json({ error: "Failed to list providers" });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/providers:
+ * post:
+ * summary: Add an AI provider
+ * tags:
+ * - AI
+ * requestBody:
+ * required: true
+ * content:
+ * application/json:
+ * schema:
+ * type: object
+ * properties:
+ * providerType:
+ * type: string
+ * label:
+ * type: string
+ * baseUrl:
+ * type: string
+ * apiKey:
+ * type: string
+ * defaultModel:
+ * type: string
+ * responses:
+ * 201:
+ * description: Provider created.
+ * 400:
+ * description: Invalid request body.
+ */
+router.post(
+ "/providers",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const { providerType, label, baseUrl, apiKey, defaultModel } =
+ req.body ?? {};
+
+ if (!isAiProviderType(providerType)) {
+ return res.status(400).json({ error: "Unknown provider type" });
+ }
+ if (typeof label !== "string" || !label.trim()) {
+ return res.status(400).json({ error: "label is required" });
+ }
+ if (REQUIRES_BASE_URL.includes(providerType) && !baseUrl?.trim()) {
+ return res.status(400).json({ error: "This provider needs a base URL" });
+ }
+ if (REQUIRES_API_KEY.includes(providerType) && !apiKey?.trim()) {
+ return res.status(400).json({ error: "This provider needs an API key" });
+ }
+
+ try {
+ const created = await createCurrentAiRepository().createProvider({
+ userId,
+ providerType,
+ label: label.trim(),
+ baseUrl: typeof baseUrl === "string" ? baseUrl.trim() : null,
+ apiKey: typeof apiKey === "string" ? apiKey.trim() : null,
+ defaultModel:
+ typeof defaultModel === "string" ? defaultModel.trim() : null,
+ });
+
+ const { ipAddress, userAgent } = getRequestMeta(req);
+ await logAudit({
+ userId,
+ username: await getAuditUsername(userId),
+ action: "create_ai_provider",
+ resourceType: "ai_provider",
+ resourceId: String(created.id),
+ resourceName: created.label,
+ ipAddress,
+ userAgent,
+ success: true,
+ });
+
+ res.status(201).json({ provider: created });
+ } catch (err) {
+ databaseLogger.error("Failed to create AI provider", err, {
+ operation: "ai_provider_create_failed",
+ userId,
+ });
+ res.status(500).json({ error: "Failed to create provider" });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/providers/{id}:
+ * patch:
+ * summary: Update an AI provider
+ * tags:
+ * - AI
+ * parameters:
+ * - in: path
+ * name: id
+ * required: true
+ * schema:
+ * type: integer
+ * responses:
+ * 200:
+ * description: Provider updated.
+ * 404:
+ * description: Provider not found.
+ */
+router.patch(
+ "/providers/:id",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const id = parseId(req.params.id);
+ if (!id) return res.status(400).json({ error: "Invalid provider id" });
+
+ try {
+ const updated = await createCurrentAiRepository().updateProvider(
+ id,
+ userId,
+ req.body ?? {},
+ );
+ if (!updated)
+ return res.status(404).json({ error: "Provider not found" });
+
+ const { ipAddress, userAgent } = getRequestMeta(req);
+ await logAudit({
+ userId,
+ username: await getAuditUsername(userId),
+ action: "update_ai_provider",
+ resourceType: "ai_provider",
+ resourceId: String(id),
+ resourceName: updated.label,
+ ipAddress,
+ userAgent,
+ success: true,
+ });
+
+ res.json({ provider: updated });
+ } catch (err) {
+ databaseLogger.error("Failed to update AI provider", err, {
+ operation: "ai_provider_update_failed",
+ userId,
+ });
+ res.status(500).json({ error: "Failed to update provider" });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/providers/{id}:
+ * delete:
+ * summary: Delete an AI provider
+ * tags:
+ * - AI
+ * parameters:
+ * - in: path
+ * name: id
+ * required: true
+ * schema:
+ * type: integer
+ * responses:
+ * 200:
+ * description: Provider deleted.
+ * 404:
+ * description: Provider not found.
+ */
+router.delete(
+ "/providers/:id",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const id = parseId(req.params.id);
+ if (!id) return res.status(400).json({ error: "Invalid provider id" });
+
+ try {
+ const deleted = await createCurrentAiRepository().deleteProvider(
+ id,
+ userId,
+ );
+ if (!deleted)
+ return res.status(404).json({ error: "Provider not found" });
+
+ const { ipAddress, userAgent } = getRequestMeta(req);
+ await logAudit({
+ userId,
+ username: await getAuditUsername(userId),
+ action: "delete_ai_provider",
+ resourceType: "ai_provider",
+ resourceId: String(id),
+ ipAddress,
+ userAgent,
+ success: true,
+ });
+
+ res.json({ success: true });
+ } catch (err) {
+ databaseLogger.error("Failed to delete AI provider", err, {
+ operation: "ai_provider_delete_failed",
+ userId,
+ });
+ res.status(500).json({ error: "Failed to delete provider" });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/probe-models:
+ * post:
+ * summary: List models for a provider that has not been saved yet
+ * description: >
+ * Lets the add-provider form fill its model picker before the provider
+ * exists, so nobody has to go and look up model names by hand.
+ * tags:
+ * - AI
+ * requestBody:
+ * required: true
+ * content:
+ * application/json:
+ * schema:
+ * type: object
+ * properties:
+ * providerType:
+ * type: string
+ * baseUrl:
+ * type: string
+ * apiKey:
+ * type: string
+ * providerId:
+ * type: integer
+ * responses:
+ * 200:
+ * description: Model ids, possibly a curated fallback list.
+ * 400:
+ * description: Unknown provider type.
+ */
+router.post(
+ "/probe-models",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const { providerType, baseUrl, apiKey, providerId } = req.body ?? {};
+
+ if (!isAiProviderType(providerType)) {
+ return res.status(400).json({ error: "Unknown provider type" });
+ }
+
+ try {
+ // Editing an existing provider sends no key, so fall back to the stored
+ // one rather than making the user retype it just to refresh the list.
+ let resolvedKey =
+ typeof apiKey === "string" && apiKey.trim() ? apiKey.trim() : null;
+ if (!resolvedKey && parseId(providerId)) {
+ const stored = await createCurrentAiRepository().findProviderWithSecret(
+ parseId(providerId) as number,
+ userId,
+ );
+ resolvedKey = stored?.apiKey ?? null;
+ }
+
+ const models = await getAdapter(providerType).listModels({
+ providerType,
+ baseUrl: typeof baseUrl === "string" ? baseUrl.trim() : null,
+ apiKey: resolvedKey,
+ });
+
+ res.json({ models, source: "live" });
+ } catch (err) {
+ // A provider that cannot be reached yet still gets a usable list, so the
+ // form is never a blank text box the user has to guess into.
+ const fallback = FALLBACK_MODELS[providerType as AiProviderType] ?? [];
+ res.json({
+ models: fallback,
+ source: fallback.length ? "fallback" : "none",
+ warning: err instanceof Error ? err.message : undefined,
+ });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/providers/{id}/models:
+ * get:
+ * summary: List models available from a provider
+ * tags:
+ * - AI
+ * parameters:
+ * - in: path
+ * name: id
+ * required: true
+ * schema:
+ * type: integer
+ * responses:
+ * 200:
+ * description: Model ids.
+ * 502:
+ * description: The provider could not be reached.
+ */
+router.get(
+ "/providers/:id/models",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const id = parseId(req.params.id);
+ if (!id) return res.status(400).json({ error: "Invalid provider id" });
+
+ try {
+ const provider = await createCurrentAiRepository().findProviderWithSecret(
+ id,
+ userId,
+ );
+ if (!provider)
+ return res.status(404).json({ error: "Provider not found" });
+
+ const models = await getAdapter(provider.providerType).listModels({
+ providerType: provider.providerType as ProviderConfig["providerType"],
+ baseUrl: provider.baseUrl,
+ apiKey: provider.apiKey,
+ });
+ res.json({ models });
+ } catch (err) {
+ // The message can carry the allowlist hint, which the user needs to act on.
+ const message = getErrorMessage(err, "Could not reach the provider");
+ databaseLogger.warn("Failed to list provider models", {
+ operation: "ai_provider_models_failed",
+ userId,
+ });
+ res.status(502).json({ error: message });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/conversations:
+ * get:
+ * summary: List the user's AI conversations
+ * tags:
+ * - AI
+ * responses:
+ * 200:
+ * description: Conversations, newest first.
+ */
+router.get(
+ "/conversations",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ try {
+ const conversations =
+ await createCurrentAiRepository().listConversations(userId);
+ res.json({ conversations });
+ } catch (err) {
+ databaseLogger.error("Failed to list AI conversations", err, {
+ operation: "ai_conversations_list_failed",
+ userId,
+ });
+ res.status(500).json({ error: "Failed to list conversations" });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/conversations/{id}:
+ * get:
+ * summary: Get one conversation with its messages and proposals
+ * tags:
+ * - AI
+ * parameters:
+ * - in: path
+ * name: id
+ * required: true
+ * schema:
+ * type: integer
+ * responses:
+ * 200:
+ * description: The conversation.
+ * 404:
+ * description: Conversation not found.
+ */
+router.get(
+ "/conversations/:id",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const id = parseId(req.params.id);
+ if (!id) return res.status(400).json({ error: "Invalid conversation id" });
+
+ try {
+ const repository = createCurrentAiRepository();
+ const conversation = await repository.findConversation(id, userId);
+ if (!conversation) {
+ return res.status(404).json({ error: "Conversation not found" });
+ }
+
+ const [messages, proposals] = await Promise.all([
+ repository.listMessages(id),
+ repository.listProposals(userId, id),
+ ]);
+
+ res.json({ conversation, messages, proposals });
+ } catch (err) {
+ databaseLogger.error("Failed to load AI conversation", err, {
+ operation: "ai_conversation_load_failed",
+ userId,
+ });
+ res.status(500).json({ error: "Failed to load conversation" });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/conversations/{id}:
+ * delete:
+ * summary: Delete a conversation
+ * tags:
+ * - AI
+ * parameters:
+ * - in: path
+ * name: id
+ * required: true
+ * schema:
+ * type: integer
+ * responses:
+ * 200:
+ * description: Conversation deleted.
+ */
+router.delete(
+ "/conversations/:id",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const id = parseId(req.params.id);
+ if (!id) return res.status(400).json({ error: "Invalid conversation id" });
+
+ try {
+ const deleted = await createCurrentAiRepository().deleteConversation(
+ id,
+ userId,
+ );
+ if (!deleted) {
+ return res.status(404).json({ error: "Conversation not found" });
+ }
+ res.json({ success: true });
+ } catch (err) {
+ databaseLogger.error("Failed to delete AI conversation", err, {
+ operation: "ai_conversation_delete_failed",
+ userId,
+ });
+ res.status(500).json({ error: "Failed to delete conversation" });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/chat/stream:
+ * post:
+ * summary: Send a message and stream the assistant's reply
+ * description: >
+ * Server-sent events. Emits token, tool_call, tool_result, proposal,
+ * done and error frames.
+ * tags:
+ * - AI
+ * requestBody:
+ * required: true
+ * content:
+ * application/json:
+ * schema:
+ * type: object
+ * properties:
+ * conversationId:
+ * type: integer
+ * providerId:
+ * type: integer
+ * model:
+ * type: string
+ * message:
+ * type: string
+ * activeTab:
+ * type: string
+ * responses:
+ * 200:
+ * description: An event stream.
+ * 400:
+ * description: Invalid request body.
+ */
+router.post(
+ "/chat/stream",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const { conversationId, providerId, model, message, activeTab } =
+ req.body ?? {};
+
+ if (typeof message !== "string" || !message.trim()) {
+ return res.status(400).json({ error: "message is required" });
+ }
+
+ const resolvedProviderId = parseId(providerId);
+ if (!resolvedProviderId) {
+ return res.status(400).json({ error: "providerId is required" });
+ }
+
+ const repository = createCurrentAiRepository();
+
+ try {
+ const provider = await repository.findProviderWithSecret(
+ resolvedProviderId,
+ userId,
+ );
+ if (!provider) {
+ return res.status(404).json({ error: "Provider not found" });
+ }
+
+ const chosenModel =
+ (typeof model === "string" && model.trim()) ||
+ provider.defaultModel ||
+ "";
+ if (!chosenModel) {
+ return res.status(400).json({ error: "No model selected" });
+ }
+
+ // Resolve or create the conversation before the stream opens, so a
+ // failure here is still a normal JSON error the client can render.
+ let conversation = conversationId
+ ? await repository.findConversation(Number(conversationId), userId)
+ : null;
+ if (!conversation) {
+ conversation = await repository.createConversation({
+ userId,
+ title: message.trim().slice(0, 60),
+ providerId: resolvedProviderId,
+ model: chosenModel,
+ });
+ }
+
+ const history = await repository.listMessages(conversation.id);
+ await repository.appendMessage({
+ conversationId: conversation.id,
+ role: "user",
+ content: message.trim(),
+ });
+
+ const access = await resolveAiAccess(userId);
+ const hosts = await createCurrentHostRepository().listByUserId(userId);
+
+ res.writeHead(200, {
+ "Content-Type": "text/event-stream",
+ "Cache-Control": "no-store, no-transform",
+ Connection: "keep-alive",
+ "X-Accel-Buffering": "no",
+ });
+ res.flushHeaders?.();
+
+ const heartbeat = setInterval(() => {
+ try {
+ res.write(": keepalive\n\n");
+ } catch {
+ clearInterval(heartbeat);
+ }
+ }, 30000);
+
+ const abort = new AbortController();
+ req.on("close", () => {
+ clearInterval(heartbeat);
+ abort.abort();
+ });
+
+ const send = (event: unknown) => {
+ res.write(`data: ${JSON.stringify(event)}\n\n`);
+ };
+
+ send({ type: "conversation", conversationId: conversation.id });
+
+ const chatHistory: ChatMessage[] = history.map((entry) => ({
+ role: entry.role as ChatMessage["role"],
+ content: entry.content,
+ ...(entry.toolCalls ? { toolCalls: JSON.parse(entry.toolCalls) } : {}),
+ }));
+ chatHistory.push({ role: "user", content: message.trim() });
+
+ let assistantText = "";
+ let assistantToolCalls: unknown[] = [];
+
+ try {
+ for await (const event of runAgent({
+ config: {
+ providerType:
+ provider.providerType as ProviderConfig["providerType"],
+ baseUrl: provider.baseUrl,
+ apiKey: provider.apiKey,
+ },
+ model: chosenModel,
+ system: buildSystemPrompt({
+ hostCount: hosts.length,
+ activeTab: typeof activeTab === "string" ? activeTab : null,
+ allowReadOnlyCommands: access.allowReadOnlyCommands,
+ }),
+ history: chatHistory,
+ context: {
+ userId,
+ conversationId: conversation.id,
+ allowReadOnlyCommands: access.allowReadOnlyCommands,
+ },
+ signal: abort.signal,
+ })) {
+ if (event.type === "assistant_message") {
+ assistantText = event.content;
+ // Kept so the next message replays them verbatim. Gemini rejects a
+ // turn whose functionCall parts lost their thoughtSignature, so
+ // dropping these breaks the second message in every conversation.
+ assistantToolCalls = event.toolCalls;
+ continue;
+ }
+
+ if (event.type === "proposal") {
+ const stored = await repository.createProposal({
+ conversationId: conversation.id,
+ userId,
+ kind: event.draft.kind,
+ summary: event.draft.summary,
+ payload: JSON.stringify(event.draft.payload),
+ });
+
+ const { ipAddress, userAgent } = getRequestMeta(req);
+ await logAudit({
+ userId,
+ username: await getAuditUsername(userId),
+ action: "ai_proposal_created",
+ resourceType: "ai_proposal",
+ resourceId: String(stored.id),
+ resourceName: event.draft.kind,
+ ipAddress,
+ userAgent,
+ success: true,
+ });
+
+ send({ type: "proposal", proposal: stored });
+ continue;
+ }
+
+ send(event);
+ }
+ } finally {
+ clearInterval(heartbeat);
+ }
+
+ if (assistantText || assistantToolCalls.length) {
+ await repository.appendMessage({
+ conversationId: conversation.id,
+ role: "assistant",
+ content: assistantText,
+ toolCalls: assistantToolCalls.length
+ ? JSON.stringify(assistantToolCalls)
+ : null,
+ });
+ }
+ await repository.touchConversation(conversation.id);
+
+ send({ type: "done" });
+ res.end();
+ } catch (err) {
+ databaseLogger.error("AI chat stream failed", err, {
+ operation: "ai_chat_stream_failed",
+ userId,
+ });
+ if (res.headersSent) {
+ res.write(
+ `data: ${JSON.stringify({ type: "error", message: "The assistant stopped unexpectedly" })}\n\n`,
+ );
+ res.end();
+ } else {
+ res.status(500).json({ error: "Failed to start the assistant" });
+ }
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/proposals/{id}/apply:
+ * post:
+ * summary: Apply a pending proposal
+ * description: >
+ * Re-validates the stored payload and dispatches it through the same
+ * repository logic a manual action uses.
+ * tags:
+ * - AI
+ * parameters:
+ * - in: path
+ * name: id
+ * required: true
+ * schema:
+ * type: integer
+ * responses:
+ * 200:
+ * description: Proposal applied.
+ * 400:
+ * description: The proposal could not be applied.
+ * 404:
+ * description: Proposal not found.
+ */
+router.post(
+ "/proposals/:id/apply",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const id = parseId(req.params.id);
+ if (!id) return res.status(400).json({ error: "Invalid proposal id" });
+
+ const repository = createCurrentAiRepository();
+
+ try {
+ const stored = await repository.findProposal(id, userId);
+ if (!stored) return res.status(404).json({ error: "Proposal not found" });
+ if (stored.status !== "pending") {
+ return res
+ .status(400)
+ .json({ error: `This proposal was already ${stored.status}` });
+ }
+
+ let payload: Record;
+ try {
+ payload = JSON.parse(stored.payload) as Record;
+ } catch {
+ return res
+ .status(400)
+ .json({ error: "The proposal payload is invalid" });
+ }
+
+ const result = await applyProposal(stored.kind, payload, userId);
+ await repository.setProposalStatus(id, userId, "applied", result.summary);
+
+ const { ipAddress, userAgent } = getRequestMeta(req);
+ await logAudit({
+ userId,
+ username: await getAuditUsername(userId),
+ action: "ai_proposal_applied",
+ resourceType: "ai_proposal",
+ resourceId: String(id),
+ resourceName: stored.kind,
+ ipAddress,
+ userAgent,
+ success: true,
+ });
+
+ res.json({ success: result.ok, summary: result.summary });
+ } catch (err) {
+ const message = getErrorMessage(err, "Failed to apply the proposal");
+ databaseLogger.error("Failed to apply AI proposal", err, {
+ operation: "ai_proposal_apply_failed",
+ userId,
+ });
+
+ const { ipAddress, userAgent } = getRequestMeta(req);
+ await logAudit({
+ userId,
+ username: await getAuditUsername(userId),
+ action: "ai_proposal_applied",
+ resourceType: "ai_proposal",
+ resourceId: String(id),
+ ipAddress,
+ userAgent,
+ success: false,
+ errorMessage: message,
+ });
+
+ res.status(400).json({ error: message });
+ }
+ },
+);
+
+/**
+ * @openapi
+ * /ai/proposals/{id}/reject:
+ * post:
+ * summary: Reject a pending proposal
+ * tags:
+ * - AI
+ * parameters:
+ * - in: path
+ * name: id
+ * required: true
+ * schema:
+ * type: integer
+ * responses:
+ * 200:
+ * description: Proposal rejected.
+ * 404:
+ * description: Proposal not found.
+ */
+router.post(
+ "/proposals/:id/reject",
+ authenticateJWT,
+ requireDataAccess,
+ aiGate,
+ async (req, res) => {
+ const userId = (req as AuthenticatedRequest).userId as string;
+ const id = parseId(req.params.id);
+ if (!id) return res.status(400).json({ error: "Invalid proposal id" });
+
+ try {
+ const updated = await createCurrentAiRepository().setProposalStatus(
+ id,
+ userId,
+ "rejected",
+ );
+ if (!updated) {
+ return res
+ .status(404)
+ .json({ error: "Proposal not found or already resolved" });
+ }
+
+ const { ipAddress, userAgent } = getRequestMeta(req);
+ await logAudit({
+ userId,
+ username: await getAuditUsername(userId),
+ action: "ai_proposal_rejected",
+ resourceType: "ai_proposal",
+ resourceId: String(id),
+ ipAddress,
+ userAgent,
+ success: true,
+ });
+
+ res.json({ success: true });
+ } catch (err) {
+ databaseLogger.error("Failed to reject AI proposal", err, {
+ operation: "ai_proposal_reject_failed",
+ userId,
+ });
+ res.status(500).json({ error: "Failed to reject the proposal" });
+ }
+ },
+);
+
+export default router;
diff --git a/src/backend/ai/providers/anthropic.ts b/src/backend/ai/providers/anthropic.ts
new file mode 100644
index 0000000..d07f2ad
--- /dev/null
+++ b/src/backend/ai/providers/anthropic.ts
@@ -0,0 +1,162 @@
+import Anthropic from "@anthropic-ai/sdk";
+import { providerFetch } from "./http.js";
+import type {
+ ChatChunk,
+ ChatRequest,
+ ProviderAdapter,
+ ProviderConfig,
+} from "./types.js";
+import { AiProviderError } from "./types.js";
+
+/**
+ * Model ids offered in the picker. Users can type any other id; this is a
+ * convenience list, not a restriction.
+ */
+export const ANTHROPIC_MODELS = [
+ "claude-opus-5",
+ "claude-sonnet-5",
+ "claude-haiku-4-5",
+];
+
+function createClient(config: ProviderConfig): Anthropic {
+ if (!config.apiKey) {
+ throw new AiProviderError("This provider needs an API key");
+ }
+ return new Anthropic({
+ apiKey: config.apiKey,
+ ...(config.baseUrl?.trim() ? { baseURL: config.baseUrl.trim() } : {}),
+ // Routes the SDK's HTTP through the shared egress guard.
+ fetch: providerFetch as unknown as typeof fetch,
+ });
+}
+
+function toAnthropicMessages(request: ChatRequest): Anthropic.MessageParam[] {
+ const messages: Anthropic.MessageParam[] = [];
+
+ for (const message of request.messages) {
+ if (message.role === "tool") {
+ messages.push({
+ role: "user",
+ content: [
+ {
+ type: "tool_result",
+ tool_use_id: message.toolCallId ?? "",
+ content: message.content,
+ },
+ ],
+ });
+ continue;
+ }
+
+ if (message.role === "assistant" && message.toolCalls?.length) {
+ const content: Anthropic.ContentBlockParam[] = [];
+ if (message.content)
+ content.push({ type: "text", text: message.content });
+ for (const call of message.toolCalls) {
+ content.push({
+ type: "tool_use",
+ id: call.id,
+ name: call.name,
+ input: call.arguments,
+ });
+ }
+ messages.push({ role: "assistant", content });
+ continue;
+ }
+
+ if (message.role === "system") continue;
+ messages.push({ role: message.role, content: message.content });
+ }
+
+ return messages;
+}
+
+/**
+ * The SDK throws its own typed errors rather than going through assertOk, so
+ * they are translated here to match what every other provider reports.
+ */
+function translateSdkError(error: unknown): never {
+ const status =
+ typeof (error as { status?: unknown })?.status === "number"
+ ? (error as { status: number }).status
+ : undefined;
+ const detail = error instanceof Error ? error.message : String(error);
+
+ if (status === 429) {
+ throw new AiProviderError(
+ `Anthropic rate limit reached. Wait a moment and try again, or check your plan's quota. (${detail})`,
+ 429,
+ );
+ }
+ if (status === 401 || status === 403) {
+ throw new AiProviderError(
+ `Anthropic rejected the API key. Check that it is correct and still active. (${detail})`,
+ status,
+ );
+ }
+ throw new AiProviderError(
+ status ? `Anthropic request failed (${status}): ${detail}` : detail,
+ status,
+ );
+}
+
+export const anthropicAdapter: ProviderAdapter = {
+ async *streamChat(
+ config: ProviderConfig,
+ request: ChatRequest,
+ ): AsyncIterable {
+ const client = createClient(config);
+
+ const stream = client.messages.stream({
+ model: request.model,
+ max_tokens: 16000,
+ system: request.system,
+ messages: toAnthropicMessages(request),
+ thinking: { type: "adaptive" },
+ ...(request.tools.length
+ ? {
+ tools: request.tools.map((tool) => ({
+ name: tool.name,
+ description: tool.description,
+ input_schema: tool.parameters as Anthropic.Tool.InputSchema,
+ })),
+ }
+ : {}),
+ ...(request.signal ? { signal: request.signal } : {}),
+ });
+
+ let final: Anthropic.Message;
+ try {
+ for await (const event of stream) {
+ if (
+ event.type === "content_block_delta" &&
+ event.delta.type === "text_delta"
+ ) {
+ yield { type: "text", text: event.delta.text };
+ }
+ }
+ final = await stream.finalMessage();
+ } catch (error) {
+ translateSdkError(error);
+ }
+
+ for (const block of final.content) {
+ if (block.type === "tool_use") {
+ yield {
+ type: "tool_call",
+ call: {
+ id: block.id,
+ name: block.name,
+ arguments: (block.input ?? {}) as Record,
+ },
+ };
+ }
+ }
+
+ yield { type: "done", stopReason: final.stop_reason ?? undefined };
+ },
+
+ async listModels(): Promise {
+ return [...ANTHROPIC_MODELS];
+ },
+};
diff --git a/src/backend/ai/providers/gemini.ts b/src/backend/ai/providers/gemini.ts
new file mode 100644
index 0000000..ff974f7
--- /dev/null
+++ b/src/backend/ai/providers/gemini.ts
@@ -0,0 +1,191 @@
+import { assertOk, providerFetch, readSseLines } from "./http.js";
+import type {
+ ChatChunk,
+ ChatRequest,
+ ProviderAdapter,
+ ProviderConfig,
+} from "./types.js";
+import { AiProviderError } from "./types.js";
+
+const GEMINI_DEFAULT_BASE = "https://generativelanguage.googleapis.com/v1beta";
+
+function baseFor(config: ProviderConfig): string {
+ return config.baseUrl?.trim() || GEMINI_DEFAULT_BASE;
+}
+
+/**
+ * Gemini has no tool role: a tool result is a user-side functionResponse part,
+ * and an assistant tool request is a model-side functionCall part.
+ */
+function toGeminiContents(request: ChatRequest): unknown[] {
+ const contents: unknown[] = [];
+
+ for (const message of request.messages) {
+ if (message.role === "tool") {
+ contents.push({
+ role: "user",
+ parts: [
+ {
+ functionResponse: {
+ name: message.toolName ?? "tool",
+ response: { result: message.content },
+ },
+ },
+ ],
+ });
+ continue;
+ }
+
+ if (message.role === "assistant" && message.toolCalls?.length) {
+ const parts: unknown[] = [];
+ if (message.content) parts.push({ text: message.content });
+ for (const call of message.toolCalls) {
+ // thoughtSignature must be returned exactly as received or Gemini
+ // 2.5+ rejects the turn with a 400.
+ parts.push({
+ functionCall: { name: call.name, args: call.arguments },
+ ...(call.providerSignature
+ ? { thoughtSignature: call.providerSignature }
+ : {}),
+ });
+ }
+ contents.push({ role: "model", parts });
+ continue;
+ }
+
+ if (message.role === "system") continue;
+
+ contents.push({
+ role: message.role === "assistant" ? "model" : "user",
+ parts: [{ text: message.content }],
+ });
+ }
+
+ return contents;
+}
+
+/**
+ * Gemini rejects the JSON Schema keywords it does not implement, so the tool
+ * schemas are trimmed to the subset it accepts.
+ */
+function toGeminiSchema(schema: unknown): unknown {
+ if (!schema || typeof schema !== "object") return schema;
+ if (Array.isArray(schema)) return schema.map(toGeminiSchema);
+
+ const source = schema as Record;
+ const output: Record = {};
+
+ for (const [key, value] of Object.entries(source)) {
+ if (key === "additionalProperties" || key === "$schema") continue;
+ if (key === "properties" && value && typeof value === "object") {
+ const properties: Record = {};
+ for (const [name, child] of Object.entries(
+ value as Record,
+ )) {
+ properties[name] = toGeminiSchema(child);
+ }
+ output[key] = properties;
+ continue;
+ }
+ output[key] = toGeminiSchema(value);
+ }
+
+ return output;
+}
+
+export const geminiAdapter: ProviderAdapter = {
+ async *streamChat(
+ config: ProviderConfig,
+ request: ChatRequest,
+ ): AsyncIterable {
+ if (!config.apiKey) {
+ throw new AiProviderError("This provider needs an API key");
+ }
+
+ const url = `${baseFor(config).replace(/\/+$/, "")}/models/${encodeURIComponent(request.model)}:streamGenerateContent?alt=sse`;
+
+ const response = await providerFetch(url, {
+ method: "POST",
+ headers: {
+ "Content-Type": "application/json",
+ "x-goog-api-key": config.apiKey,
+ },
+ signal: request.signal,
+ body: JSON.stringify({
+ systemInstruction: { parts: [{ text: request.system }] },
+ contents: toGeminiContents(request),
+ ...(request.tools.length
+ ? {
+ tools: [
+ {
+ functionDeclarations: request.tools.map((tool) => ({
+ name: tool.name,
+ description: tool.description,
+ parameters: toGeminiSchema(tool.parameters),
+ })),
+ },
+ ],
+ }
+ : {}),
+ }),
+ });
+
+ await assertOk(response, "Gemini");
+
+ let index = 0;
+ let stopReason: string | undefined;
+
+ for await (const data of readSseLines(response)) {
+ let frame: any;
+ try {
+ frame = JSON.parse(data);
+ } catch {
+ continue;
+ }
+
+ const candidate = frame.candidates?.[0];
+ if (!candidate) continue;
+ if (candidate.finishReason) stopReason = candidate.finishReason;
+
+ for (const part of candidate.content?.parts ?? []) {
+ if (typeof part.text === "string" && part.text) {
+ yield { type: "text", text: part.text };
+ }
+ if (part.functionCall?.name) {
+ yield {
+ type: "tool_call",
+ call: {
+ id: `call_${part.functionCall.name}_${index++}`,
+ name: part.functionCall.name,
+ arguments: (part.functionCall.args ?? {}) as Record<
+ string,
+ unknown
+ >,
+ // Carried so the next turn can echo it back; without it Gemini
+ // 400s as soon as a tool has been used once.
+ providerSignature: part.thoughtSignature,
+ },
+ };
+ }
+ }
+ }
+
+ yield { type: "done", stopReason };
+ },
+
+ async listModels(config: ProviderConfig): Promise {
+ if (!config.apiKey) return [];
+
+ const response = await providerFetch(
+ `${baseFor(config).replace(/\/+$/, "")}/models`,
+ { method: "GET", headers: { "x-goog-api-key": config.apiKey } },
+ );
+ await assertOk(response, "Gemini");
+
+ const body: any = await response.json();
+ return (body.models ?? [])
+ .map((entry: any) => String(entry.name ?? "").replace(/^models\//, ""))
+ .filter((name: string) => name.length > 0)
+ .sort();
+ },
+};
diff --git a/src/backend/ai/providers/http.ts b/src/backend/ai/providers/http.ts
new file mode 100644
index 0000000..6195da8
--- /dev/null
+++ b/src/backend/ai/providers/http.ts
@@ -0,0 +1,177 @@
+import { getFetchDispatcher } from "../../utils/proxy-agent.js";
+import { safeOutboundFetch } from "../../utils/safe-outbound-fetch.js";
+import { evaluateEgress, readPrivateAllowlist } from "../egress.js";
+import { AiProviderError } from "./types.js";
+
+/**
+ * Every outbound provider request goes through here so the egress rules cannot
+ * be bypassed by an adapter calling fetch directly.
+ *
+ * Public hosts use safeOutboundFetch, which re-checks the resolved address at
+ * connect time. Allowlisted private hosts cannot use it (its whole job is to
+ * refuse them), so they fall back to plain fetch with the proxy dispatcher --
+ * still respecting corporate proxy configuration.
+ */
+export async function providerFetch(
+ url: string,
+ init: RequestInit,
+): Promise {
+ const allowlist = await readPrivateAllowlist();
+ const decision = evaluateEgress(url, allowlist);
+
+ if (!decision.allowed) {
+ throw new AiProviderError(decision.reason ?? "Destination not allowed");
+ }
+
+ if (decision.isPrivate) {
+ return fetch(url, {
+ ...init,
+ dispatcher: getFetchDispatcher(url),
+ } as RequestInit);
+ }
+
+ return safeOutboundFetch(url, init) as unknown as Promise;
+}
+
+export function joinUrl(base: string, path: string): string {
+ return `${base.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
+}
+
+/**
+ * Yields the data payload of each SSE frame. Providers differ in what they put
+ * inside, so parsing the JSON is left to the caller.
+ */
+export async function* readSseLines(
+ response: Response,
+): AsyncGenerator {
+ const body = response.body;
+ if (!body) return;
+
+ const reader = body.getReader();
+ const decoder = new TextDecoder();
+ let buffer = "";
+
+ try {
+ while (true) {
+ const { done, value } = await reader.read();
+ if (done) break;
+ buffer += decoder.decode(value, { stream: true });
+
+ let newlineIndex = buffer.indexOf("\n");
+ while (newlineIndex !== -1) {
+ const line = buffer.slice(0, newlineIndex).trim();
+ buffer = buffer.slice(newlineIndex + 1);
+ if (line.startsWith("data:")) {
+ yield line.slice(5).trim();
+ }
+ newlineIndex = buffer.indexOf("\n");
+ }
+ }
+ } finally {
+ reader.releaseLock();
+ }
+}
+
+/** Yields one parsed JSON object per line, for newline-delimited streams. */
+export async function* readJsonLines(
+ response: Response,
+): AsyncGenerator {
+ const body = response.body;
+ if (!body) return;
+
+ const reader = body.getReader();
+ const decoder = new TextDecoder();
+ let buffer = "";
+
+ try {
+ while (true) {
+ const { done, value } = await reader.read();
+ if (done) break;
+ buffer += decoder.decode(value, { stream: true });
+
+ let newlineIndex = buffer.indexOf("\n");
+ while (newlineIndex !== -1) {
+ const line = buffer.slice(0, newlineIndex).trim();
+ buffer = buffer.slice(newlineIndex + 1);
+ if (line) {
+ try {
+ yield JSON.parse(line);
+ } catch {
+ // A partial or malformed frame is skipped rather than failing the
+ // whole stream.
+ }
+ }
+ newlineIndex = buffer.indexOf("\n");
+ }
+ }
+ } finally {
+ reader.releaseLock();
+ }
+}
+
+/**
+ * Digs the human-readable message out of an error body.
+ *
+ * Every provider nests it differently, and dumping the raw JSON produced
+ * something that got cut off mid-sentence. Falls back to a trimmed snippet
+ * when the shape is unfamiliar.
+ */
+function extractProviderMessage(body: string): string {
+ try {
+ const parsed = JSON.parse(body);
+ const message =
+ parsed?.error?.message ??
+ parsed?.error?.["message"] ??
+ parsed?.message ??
+ (typeof parsed?.error === "string" ? parsed.error : null);
+ if (typeof message === "string" && message.trim()) {
+ return message.trim();
+ }
+ } catch {
+ // Not JSON; fall through to the snippet.
+ }
+
+ const trimmed = body.trim();
+ if (!trimmed) return "";
+ return trimmed.length > 300 ? `${trimmed.slice(0, 300)}...` : trimmed;
+}
+
+export async function assertOk(
+ response: Response,
+ provider: string,
+): Promise {
+ if (response.ok) return;
+
+ let body = "";
+ try {
+ body = await response.text();
+ } catch {
+ body = "";
+ }
+
+ const detail = extractProviderMessage(body);
+
+ // Rate limits and auth failures are the two the user can actually act on,
+ // so they say what to do instead of reading like an internal failure.
+ if (response.status === 429) {
+ throw new AiProviderError(
+ `${provider} rate limit reached. Wait a moment and try again, or check your plan's quota.${
+ detail ? ` (${detail})` : ""
+ }`,
+ 429,
+ );
+ }
+ if (response.status === 401 || response.status === 403) {
+ throw new AiProviderError(
+ `${provider} rejected the API key. Check that it is correct and still active.${
+ detail ? ` (${detail})` : ""
+ }`,
+ response.status,
+ );
+ }
+
+ throw new AiProviderError(
+ `${provider} request failed (${response.status})${detail ? `: ${detail}` : ""}`,
+ response.status,
+ );
+}
diff --git a/src/backend/ai/providers/ollama.ts b/src/backend/ai/providers/ollama.ts
new file mode 100644
index 0000000..622b69c
--- /dev/null
+++ b/src/backend/ai/providers/ollama.ts
@@ -0,0 +1,131 @@
+import { assertOk, joinUrl, providerFetch, readJsonLines } from "./http.js";
+import type {
+ ChatChunk,
+ ChatRequest,
+ ProviderAdapter,
+ ProviderConfig,
+} from "./types.js";
+
+export const OLLAMA_DEFAULT_BASE = "http://localhost:11434";
+
+function baseFor(config: ProviderConfig): string {
+ return config.baseUrl?.trim() || OLLAMA_DEFAULT_BASE;
+}
+
+function toOllamaMessages(request: ChatRequest): unknown[] {
+ const messages: unknown[] = [{ role: "system", content: request.system }];
+
+ for (const message of request.messages) {
+ if (message.role === "tool") {
+ messages.push({
+ role: "tool",
+ content: message.content,
+ ...(message.toolName ? { tool_name: message.toolName } : {}),
+ });
+ continue;
+ }
+
+ if (message.role === "assistant" && message.toolCalls?.length) {
+ messages.push({
+ role: "assistant",
+ content: message.content,
+ tool_calls: message.toolCalls.map((call) => ({
+ function: { name: call.name, arguments: call.arguments },
+ })),
+ });
+ continue;
+ }
+
+ messages.push({ role: message.role, content: message.content });
+ }
+
+ return messages;
+}
+
+export const ollamaAdapter: ProviderAdapter = {
+ async *streamChat(
+ config: ProviderConfig,
+ request: ChatRequest,
+ ): AsyncIterable {
+ const response = await providerFetch(joinUrl(baseFor(config), "api/chat"), {
+ method: "POST",
+ headers: { "Content-Type": "application/json" },
+ signal: request.signal,
+ body: JSON.stringify({
+ model: request.model,
+ messages: toOllamaMessages(request),
+ stream: true,
+ ...(request.tools.length
+ ? {
+ tools: request.tools.map((tool) => ({
+ type: "function",
+ function: {
+ name: tool.name,
+ description: tool.description,
+ parameters: tool.parameters,
+ },
+ })),
+ }
+ : {}),
+ }),
+ });
+
+ await assertOk(response, "Ollama");
+
+ let index = 0;
+ let stopReason: string | undefined;
+
+ // Ollama streams newline-delimited JSON rather than SSE.
+ for await (const frame of readJsonLines(response)) {
+ const payload = frame as any;
+
+ if (
+ typeof payload.message?.content === "string" &&
+ payload.message.content
+ ) {
+ yield { type: "text", text: payload.message.content };
+ }
+
+ for (const call of payload.message?.tool_calls ?? []) {
+ const name = call.function?.name;
+ if (!name) continue;
+ const rawArgs = call.function?.arguments;
+ // Ollama sends an object, but some builds send a JSON string.
+ let args: Record = {};
+ if (rawArgs && typeof rawArgs === "object") {
+ args = rawArgs as Record;
+ } else if (typeof rawArgs === "string" && rawArgs.trim()) {
+ try {
+ args = JSON.parse(rawArgs);
+ } catch {
+ args = {};
+ }
+ }
+ yield {
+ type: "tool_call",
+ call: { id: `call_${name}_${index++}`, name, arguments: args },
+ };
+ }
+
+ if (payload.done) {
+ stopReason = payload.done_reason ?? "stop";
+ break;
+ }
+ }
+
+ yield { type: "done", stopReason };
+ },
+
+ async listModels(config: ProviderConfig): Promise {
+ const response = await providerFetch(joinUrl(baseFor(config), "api/tags"), {
+ method: "GET",
+ });
+ await assertOk(response, "Ollama");
+
+ const body: any = await response.json();
+ return (body.models ?? [])
+ .map((entry: any) => entry.name)
+ .filter((name: unknown): name is string => typeof name === "string")
+ .sort();
+ },
+};
diff --git a/src/backend/ai/providers/openai.ts b/src/backend/ai/providers/openai.ts
new file mode 100644
index 0000000..8ba3e53
--- /dev/null
+++ b/src/backend/ai/providers/openai.ts
@@ -0,0 +1,182 @@
+import { assertOk, joinUrl, providerFetch, readSseLines } from "./http.js";
+import type {
+ ChatChunk,
+ ChatRequest,
+ ProviderAdapter,
+ ProviderConfig,
+ ToolCall,
+} from "./types.js";
+import { AiProviderError } from "./types.js";
+
+const OPENAI_DEFAULT_BASE = "https://api.openai.com/v1";
+
+function baseFor(config: ProviderConfig): string {
+ if (config.baseUrl?.trim()) return config.baseUrl.trim();
+ if (config.providerType === "openai") return OPENAI_DEFAULT_BASE;
+ throw new AiProviderError("This provider needs a base URL");
+}
+
+function toOpenAiMessages(request: ChatRequest): unknown[] {
+ const messages: unknown[] = [{ role: "system", content: request.system }];
+
+ for (const message of request.messages) {
+ if (message.role === "tool") {
+ messages.push({
+ role: "tool",
+ tool_call_id: message.toolCallId,
+ content: message.content,
+ });
+ continue;
+ }
+
+ if (message.role === "assistant" && message.toolCalls?.length) {
+ messages.push({
+ role: "assistant",
+ content: message.content || null,
+ tool_calls: message.toolCalls.map((call) => ({
+ id: call.id,
+ type: "function",
+ function: {
+ name: call.name,
+ arguments: JSON.stringify(call.arguments),
+ },
+ })),
+ });
+ continue;
+ }
+
+ messages.push({ role: message.role, content: message.content });
+ }
+
+ return messages;
+}
+
+/**
+ * Tool call arguments arrive as JSON fragments spread across many deltas, so
+ * they are accumulated per index and only parsed once the stream ends.
+ */
+interface PartialCall {
+ id: string;
+ name: string;
+ args: string;
+}
+
+export const openAiAdapter: ProviderAdapter = {
+ async *streamChat(
+ config: ProviderConfig,
+ request: ChatRequest,
+ ): AsyncIterable {
+ const url = joinUrl(baseFor(config), "chat/completions");
+
+ const headers: Record = {
+ "Content-Type": "application/json",
+ };
+ if (config.apiKey) headers.Authorization = `Bearer ${config.apiKey}`;
+
+ const response = await providerFetch(url, {
+ method: "POST",
+ headers,
+ signal: request.signal,
+ body: JSON.stringify({
+ model: request.model,
+ messages: toOpenAiMessages(request),
+ stream: true,
+ ...(request.tools.length
+ ? {
+ tools: request.tools.map((tool) => ({
+ type: "function",
+ function: {
+ name: tool.name,
+ description: tool.description,
+ parameters: tool.parameters,
+ },
+ })),
+ }
+ : {}),
+ }),
+ });
+
+ await assertOk(response, "OpenAI");
+
+ const partial = new Map();
+ let stopReason: string | undefined;
+
+ for await (const data of readSseLines(response)) {
+ if (data === "[DONE]") break;
+
+ let frame: any;
+ try {
+ frame = JSON.parse(data);
+ } catch {
+ continue;
+ }
+
+ const choice = frame.choices?.[0];
+ if (!choice) continue;
+
+ if (choice.finish_reason) stopReason = choice.finish_reason;
+
+ const delta = choice.delta;
+ if (!delta) continue;
+
+ if (typeof delta.content === "string" && delta.content) {
+ yield { type: "text", text: delta.content };
+ }
+
+ for (const call of delta.tool_calls ?? []) {
+ const index = call.index ?? 0;
+ const existing = partial.get(index) ?? { id: "", name: "", args: "" };
+ if (call.id) existing.id = call.id;
+ if (call.function?.name) existing.name = call.function.name;
+ if (call.function?.arguments) existing.args += call.function.arguments;
+ partial.set(index, existing);
+ }
+ }
+
+ for (const call of partial.values()) {
+ if (!call.name) continue;
+ yield { type: "tool_call", call: finalizeCall(call) };
+ }
+
+ yield { type: "done", stopReason };
+ },
+
+ async listModels(config: ProviderConfig): Promise {
+ const headers: Record = {};
+ if (config.apiKey) headers.Authorization = `Bearer ${config.apiKey}`;
+
+ const response = await providerFetch(joinUrl(baseFor(config), "models"), {
+ method: "GET",
+ headers,
+ });
+ await assertOk(response, "OpenAI");
+
+ const body: any = await response.json();
+ return (body.data ?? [])
+ .map((entry: any) => entry.id)
+ .filter((id: unknown): id is string => typeof id === "string")
+ .sort();
+ },
+};
+
+export function finalizeCall(call: PartialCall): ToolCall {
+ let args: Record = {};
+ if (call.args.trim()) {
+ try {
+ const parsed = JSON.parse(call.args);
+ if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+ args = parsed as Record;
+ }
+ } catch {
+ // A model that emitted malformed arguments gets an empty object; the
+ // tool's own schema validation reports the problem back to it.
+ args = {};
+ }
+ }
+ return {
+ id:
+ call.id || `call_${call.name}_${Math.random().toString(36).slice(2, 10)}`,
+ name: call.name,
+ arguments: args,
+ };
+}
diff --git a/src/backend/ai/providers/registry.ts b/src/backend/ai/providers/registry.ts
new file mode 100644
index 0000000..0bbc987
--- /dev/null
+++ b/src/backend/ai/providers/registry.ts
@@ -0,0 +1,64 @@
+import { anthropicAdapter } from "./anthropic.js";
+import { geminiAdapter } from "./gemini.js";
+import { ollamaAdapter } from "./ollama.js";
+import { openAiAdapter } from "./openai.js";
+import {
+ AiProviderError,
+ type AiProviderType,
+ type ProviderAdapter,
+} from "./types.js";
+
+/**
+ * openai_compatible reuses the OpenAI adapter: OpenRouter, Groq, Mistral,
+ * DeepSeek, together.ai, LM Studio and vLLM all speak the same wire format,
+ * they differ only in base URL.
+ */
+const ADAPTERS: Record = {
+ ollama: ollamaAdapter,
+ anthropic: anthropicAdapter,
+ openai: openAiAdapter,
+ gemini: geminiAdapter,
+ openai_compatible: openAiAdapter,
+};
+
+export function getAdapter(providerType: string): ProviderAdapter {
+ const adapter = ADAPTERS[providerType as AiProviderType];
+ if (!adapter) {
+ throw new AiProviderError(`Unknown provider type: ${providerType}`);
+ }
+ return adapter;
+}
+
+/** Provider types that cannot work without a base URL. */
+export const REQUIRES_BASE_URL: AiProviderType[] = [
+ "ollama",
+ "openai_compatible",
+];
+
+/** Provider types that cannot work without an API key. */
+export const REQUIRES_API_KEY: AiProviderType[] = [
+ "anthropic",
+ "openai",
+ "gemini",
+];
+
+/**
+ * Shown when a provider's model list cannot be fetched: no key entered yet,
+ * the endpoint is unreachable, or the vendor has no list endpoint. Users can
+ * always type a model id the list does not contain, so this is a starting
+ * point rather than a restriction.
+ */
+export const FALLBACK_MODELS: Record = {
+ ollama: [
+ "llama3.2",
+ "llama3.1",
+ "qwen2.5-coder",
+ "mistral",
+ "phi4",
+ "gemma2",
+ ],
+ anthropic: ["claude-opus-5", "claude-sonnet-5", "claude-haiku-4-5"],
+ openai: ["gpt-5", "gpt-5-mini", "o4-mini", "gpt-4.1"],
+ gemini: ["gemini-2.5-pro", "gemini-2.5-flash", "gemini-2.0-flash"],
+ openai_compatible: [],
+};
diff --git a/src/backend/ai/providers/types.ts b/src/backend/ai/providers/types.ts
new file mode 100644
index 0000000..e170dfb
--- /dev/null
+++ b/src/backend/ai/providers/types.ts
@@ -0,0 +1,90 @@
+/**
+ * The shape every provider adapter normalizes to. Adding a provider means
+ * translating its wire format into these events; nothing downstream (the
+ * engine, the tool dispatcher, the SSE route) knows which vendor is in use.
+ */
+
+export type AiProviderType =
+ "ollama" | "anthropic" | "openai" | "gemini" | "openai_compatible";
+
+export const AI_PROVIDER_TYPES: AiProviderType[] = [
+ "ollama",
+ "anthropic",
+ "openai",
+ "gemini",
+ "openai_compatible",
+];
+
+export function isAiProviderType(value: unknown): value is AiProviderType {
+ return (
+ typeof value === "string" && (AI_PROVIDER_TYPES as string[]).includes(value)
+ );
+}
+
+export interface ChatMessage {
+ role: "system" | "user" | "assistant" | "tool";
+ content: string;
+ /** Set on assistant turns that requested tools. */
+ toolCalls?: ToolCall[];
+ /** Set on tool turns, matching the id of the call being answered. */
+ toolCallId?: string;
+ toolName?: string;
+}
+
+export interface ToolCall {
+ id: string;
+ name: string;
+ arguments: Record;
+ /**
+ * Opaque provider state that has to be echoed back verbatim on the next
+ * turn. Gemini 2.5+ rejects a follow-up whose functionCall parts have lost
+ * their thoughtSignature, so this rides along rather than being dropped.
+ */
+ providerSignature?: string;
+}
+
+export interface ToolDefinition {
+ name: string;
+ description: string;
+ parameters: Record;
+}
+
+export interface ChatRequest {
+ model: string;
+ system: string;
+ messages: ChatMessage[];
+ tools: ToolDefinition[];
+ signal?: AbortSignal;
+}
+
+export type ChatChunk =
+ | { type: "text"; text: string }
+ | { type: "tool_call"; call: ToolCall }
+ | { type: "done"; stopReason?: string }
+ | { type: "error"; message: string };
+
+export interface ProviderConfig {
+ providerType: AiProviderType;
+ baseUrl?: string | null;
+ apiKey?: string | null;
+}
+
+export interface ProviderAdapter {
+ /** Streams a single assistant turn. Tool execution happens in the engine. */
+ streamChat(
+ config: ProviderConfig,
+ request: ChatRequest,
+ ): AsyncIterable;
+ /** Model ids to offer in the picker, best effort. */
+ listModels(config: ProviderConfig): Promise;
+}
+
+export class AiProviderError extends Error {
+ constructor(
+ message: string,
+ readonly status?: number,
+ ) {
+ super(message);
+ this.name = "AiProviderError";
+ }
+}
diff --git a/src/backend/ai/redaction.ts b/src/backend/ai/redaction.ts
new file mode 100644
index 0000000..4876182
--- /dev/null
+++ b/src/backend/ai/redaction.ts
@@ -0,0 +1,90 @@
+/**
+ * Defense in depth for anything about to leave the server.
+ *
+ * Read tools already select explicit field allowlists rather than spreading
+ * rows, so nothing secret should reach here. This exists because "should" is
+ * not a guarantee: a future tool that forgets to project its fields would
+ * otherwise ship credentials to a third-party model provider.
+ */
+
+const SECRET_KEY_PATTERN =
+ /^(password|passwd|pass|secret|token|api_?key|apikey|private_?key|privatekey|key_?password|keypassword|passphrase|client_?secret|authorization|auth_?token|access_?token|refresh_?token|totp_?secret|backup_?codes|session_?token|cookie|credential|ssh_?cert|data_?key|dek)$/i;
+
+/** Substring markers for keys that are not exact matches but still sensitive. */
+const SECRET_KEY_SUBSTRINGS = [
+ "password",
+ "secret",
+ "privatekey",
+ "private_key",
+ "apikey",
+ "api_key",
+ "passphrase",
+];
+
+const VALUE_PATTERNS: Array<{ pattern: RegExp; label: string }> = [
+ {
+ pattern:
+ /-----BEGIN[^-]*PRIVATE KEY-----[\s\S]*?-----END[^-]*PRIVATE KEY-----/g,
+ label: "[redacted private key]",
+ },
+ { pattern: /\bsk-[A-Za-z0-9_-]{16,}\b/g, label: "[redacted api key]" },
+ { pattern: /\bsk-ant-[A-Za-z0-9_-]{16,}\b/g, label: "[redacted api key]" },
+ { pattern: /\bghp_[A-Za-z0-9]{20,}\b/g, label: "[redacted token]" },
+ { pattern: /\btmx_[A-Za-z0-9_-]{16,}\b/g, label: "[redacted token]" },
+ {
+ pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+\b/g,
+ label: "[redacted token]",
+ },
+ {
+ pattern: /\bBearer\s+[A-Za-z0-9._-]{16,}/gi,
+ label: "Bearer [redacted]",
+ },
+];
+
+export const REDACTED = "[redacted]";
+
+function isSecretKey(key: string): boolean {
+ if (SECRET_KEY_PATTERN.test(key)) return true;
+ const lower = key.toLowerCase();
+ return SECRET_KEY_SUBSTRINGS.some((marker) => lower.includes(marker));
+}
+
+export function redactString(value: string): string {
+ let output = value;
+ for (const { pattern, label } of VALUE_PATTERNS) {
+ output = output.replace(pattern, label);
+ }
+ return output;
+}
+
+/**
+ * Recursively drops secret-named fields and masks secret-shaped values.
+ * Depth is bounded so a cyclic or pathological structure cannot hang the loop.
+ */
+export function redact(value: unknown, depth = 0): unknown {
+ if (depth > 12) return REDACTED;
+
+ if (typeof value === "string") return redactString(value);
+ if (value === null || typeof value !== "object") return value;
+
+ if (Array.isArray(value)) {
+ return value.map((entry) => redact(entry, depth + 1));
+ }
+
+ const output: Record = {};
+ for (const [key, entry] of Object.entries(value as Record)) {
+ if (isSecretKey(key)) {
+ // Preserve the shape so the model can still reason about presence,
+ // without ever seeing the value.
+ output[key] = entry === null || entry === undefined ? null : REDACTED;
+ continue;
+ }
+ output[key] = redact(entry, depth + 1);
+ }
+ return output;
+}
+
+/** Convenience wrapper for serializing a tool result. */
+export function redactToJson(value: unknown): string {
+ return JSON.stringify(redact(value));
+}
diff --git a/src/backend/ai/tools/catalog.ts b/src/backend/ai/tools/catalog.ts
new file mode 100644
index 0000000..2edbf55
--- /dev/null
+++ b/src/backend/ai/tools/catalog.ts
@@ -0,0 +1,68 @@
+import { proposeTools } from "./propose-tools.js";
+import { readTools } from "./read-tools.js";
+import type { AiTool, ToolDefinitionShape } from "./types.js";
+
+/**
+ * The allowlist, and the security boundary for the whole feature.
+ *
+ * A model can only ever invoke what appears here. This matters more than usual
+ * in this codebase: PermissionManager.requirePermission exists but is currently
+ * mounted on zero routes, so RBAC strings are a vocabulary for the admin role
+ * editor rather than route enforcement. "The assistant cannot reach credentials
+ * or user administration" is therefore a property of this list, not of the
+ * permission system.
+ *
+ * Anything touching credentials, vaults, RBAC, users, identity, certificates,
+ * SSO or instance settings is deliberately absent and must stay absent.
+ */
+export const AI_TOOLS: AiTool[] = [...readTools, ...proposeTools];
+
+const BY_NAME = new Map(AI_TOOLS.map((tool) => [tool.name, tool]));
+
+export function getTool(name: string): AiTool | undefined {
+ return BY_NAME.get(name);
+}
+
+export function listToolNames(): string[] {
+ return AI_TOOLS.map((tool) => tool.name);
+}
+
+/**
+ * Domains the assistant must never be able to reach, in any tool, ever.
+ * The catalog test asserts no tool name references these.
+ */
+export const FORBIDDEN_DOMAINS = [
+ "credential",
+ "vault",
+ "rbac",
+ "role",
+ "permission",
+ "user_admin",
+ "password",
+ "totp",
+ "webauthn",
+ "passkey",
+ "api_key",
+ "session",
+ "oidc",
+ "sso",
+ "ldap",
+ "termix_id",
+ "identity",
+ "certificate",
+ "opkssh",
+ "acme",
+ "ssl",
+ "audit",
+ "sync",
+ "settings",
+];
+
+/** Tool definitions in the shape the provider adapters expect. */
+export function toolDefinitions(): ToolDefinitionShape[] {
+ return AI_TOOLS.map((tool) => ({
+ name: tool.name,
+ description: tool.description,
+ parameters: tool.parameters,
+ }));
+}
diff --git a/src/backend/ai/tools/command-allowlist.ts b/src/backend/ai/tools/command-allowlist.ts
new file mode 100644
index 0000000..16b15c6
--- /dev/null
+++ b/src/backend/ai/tools/command-allowlist.ts
@@ -0,0 +1,136 @@
+/**
+ * Which commands the assistant may run without a per-command approval click,
+ * for users who opted into read-only execution.
+ *
+ * The check parses the command into arguments and matches the resolved binary
+ * against the allowlist. Substring matching would be trivially defeated
+ * ("df; rm -rf /" contains "df"), so any shell metacharacter that could chain,
+ * redirect or substitute a second command rejects the whole string outright.
+ */
+
+export const READ_ONLY_COMMANDS = new Set([
+ "df",
+ "du",
+ "free",
+ "uptime",
+ "uname",
+ "whoami",
+ "hostname",
+ "id",
+ "ps",
+ "top",
+ "systemctl",
+ "journalctl",
+ "docker",
+ "ip",
+ "ss",
+ "netstat",
+ "lsblk",
+ "cat",
+ "ls",
+ "stat",
+ "which",
+ "date",
+ "lscpu",
+ "vmstat",
+ "iostat",
+]);
+
+/** Characters that let one command become several. */
+const SHELL_METACHARACTERS = /[;&|`$><\n\r\\]/;
+
+/** Subcommands that are safe for otherwise-powerful binaries. */
+const SUBCOMMAND_ALLOWLIST: Record> = {
+ systemctl: new Set([
+ "status",
+ "list-units",
+ "list-unit-files",
+ "is-active",
+ "is-enabled",
+ "show",
+ ]),
+ docker: new Set([
+ "ps",
+ "stats",
+ "images",
+ "logs",
+ "inspect",
+ "version",
+ "info",
+ ]),
+ ip: new Set(["a", "addr", "link", "route", "neigh"]),
+};
+
+/** Paths `cat` may read. Anything else could disclose credentials. */
+const CAT_ALLOWED_PREFIXES = ["/proc/", "/sys/", "/etc/os-release"];
+
+export interface CommandCheck {
+ allowed: boolean;
+ reason?: string;
+}
+
+export function isReadOnlyCommand(raw: string): CommandCheck {
+ const command = raw.trim();
+ if (!command) return { allowed: false, reason: "Empty command" };
+
+ if (SHELL_METACHARACTERS.test(command)) {
+ return {
+ allowed: false,
+ reason: "Command chaining, redirection and substitution are not allowed",
+ };
+ }
+
+ const parts = command.split(/\s+/).filter(Boolean);
+ if (!parts.length) return { allowed: false, reason: "Empty command" };
+
+ // Reject env-prefixed and privilege-escalating forms outright.
+ const head = parts[0];
+ if (head === "sudo" || head === "su" || head === "doas" || head === "env") {
+ return { allowed: false, reason: `${head} is not allowed` };
+ }
+
+ // A path like /usr/bin/df resolves to its basename.
+ const binary = head.includes("/")
+ ? head.slice(head.lastIndexOf("/") + 1)
+ : head;
+
+ if (!READ_ONLY_COMMANDS.has(binary)) {
+ return {
+ allowed: false,
+ reason: `${binary} is not on the read-only allowlist`,
+ };
+ }
+
+ const allowedSubcommands = SUBCOMMAND_ALLOWLIST[binary];
+ if (allowedSubcommands) {
+ const subcommand = parts.slice(1).find((part) => !part.startsWith("-"));
+ if (!subcommand || !allowedSubcommands.has(subcommand)) {
+ return {
+ allowed: false,
+ reason:
+ `${binary} ${subcommand ?? ""}`.trim() +
+ " is not on the read-only allowlist",
+ };
+ }
+ }
+
+ if (binary === "cat") {
+ const targets = parts.slice(1).filter((part) => !part.startsWith("-"));
+ if (!targets.length) {
+ return { allowed: false, reason: "cat needs a file path" };
+ }
+ for (const target of targets) {
+ const permitted = CAT_ALLOWED_PREFIXES.some((prefix) =>
+ prefix.endsWith("/") ? target.startsWith(prefix) : target === prefix,
+ );
+ if (!permitted) {
+ return {
+ allowed: false,
+ reason: `cat is limited to ${CAT_ALLOWED_PREFIXES.join(", ")}`,
+ };
+ }
+ }
+ }
+
+ return { allowed: true };
+}
diff --git a/src/backend/ai/tools/executor.ts b/src/backend/ai/tools/executor.ts
new file mode 100644
index 0000000..1459e0e
--- /dev/null
+++ b/src/backend/ai/tools/executor.ts
@@ -0,0 +1,332 @@
+import {
+ createCurrentAlertRepository,
+ createCurrentAutomationRepository,
+ createCurrentFleetRepository,
+ createCurrentHostRepository,
+ createCurrentSnippetRepository,
+} from "../../database/repositories/factory.js";
+import { validateDefinition } from "../../database/routes/automations.js";
+import { resolveHostById } from "../../hosts/host-resolver.js";
+import { execCommand } from "../../hosts/metrics/widgets/common-utils.js";
+import {
+ createFleetSshFactory,
+ getFleetPoolKey,
+} from "../../hosts/ssh-client-factory.js";
+import { withConnection } from "../../hosts/ssh-connection-pool.js";
+import { getTool } from "./catalog.js";
+
+/** Approved commands get a bounded window rather than hanging the request. */
+const COMMAND_TIMEOUT_MS = 60_000;
+
+/**
+ * Applies an approved proposal.
+ *
+ * The stored payload is treated as untrusted input even though the server wrote
+ * it: the proposal could have sat in the table across a release, and defending
+ * the apply path rather than the create path means one place to get right.
+ * Everything goes through the same repositories a human action uses, scoped to
+ * the approving user.
+ */
+
+export interface ApplyResult {
+ ok: boolean;
+ summary: string;
+}
+
+function requireNumber(value: unknown, field: string): number {
+ const parsed = Number(value);
+ if (!Number.isInteger(parsed) || parsed <= 0) {
+ throw new Error(`${field} must be a positive integer`);
+ }
+ return parsed;
+}
+
+function requireString(value: unknown, field: string): string {
+ if (typeof value !== "string" || !value.trim()) {
+ throw new Error(`${field} is required`);
+ }
+ return value.trim();
+}
+
+function optionalString(value: unknown): string | null {
+ if (typeof value !== "string") return null;
+ const trimmed = value.trim();
+ return trimmed ? trimmed : null;
+}
+
+export async function applyProposal(
+ kind: string,
+ payload: Record,
+ userId: string,
+): Promise {
+ // A payload whose tool no longer exists is refused rather than guessed at.
+ if (!getTool(kind)) {
+ throw new Error(`Unknown proposal kind: ${kind}`);
+ }
+
+ switch (kind) {
+ case "propose_create_host": {
+ const created = await createCurrentHostRepository().create({
+ userId,
+ name: requireString(payload.name, "name"),
+ ip: requireString(payload.ip, "ip"),
+ port: Number(payload.port) || 22,
+ username: optionalString(payload.username) ?? "",
+ folder: optionalString(payload.folder) ?? "",
+ tags: JSON.stringify(Array.isArray(payload.tags) ? payload.tags : []),
+ } as any);
+ return {
+ ok: true,
+ summary: `Created host ${(created as any).name ?? ""}`.trim(),
+ };
+ }
+
+ case "propose_update_host": {
+ const hostId = requireNumber(payload.hostId, "hostId");
+ const changes = (payload.changes ?? {}) as Record;
+
+ const existing = await createCurrentHostRepository().findByIdForUser(
+ userId,
+ hostId,
+ );
+ if (!existing) throw new Error("Host not found");
+
+ const updates: Record = {};
+ if (changes.name !== undefined)
+ updates.name = requireString(changes.name, "name");
+ if (changes.ip !== undefined)
+ updates.ip = requireString(changes.ip, "ip");
+ if (changes.port !== undefined) updates.port = Number(changes.port);
+ if (changes.username !== undefined)
+ updates.username = optionalString(changes.username) ?? "";
+ if (changes.folder !== undefined)
+ updates.folder = optionalString(changes.folder) ?? "";
+ if (changes.tags !== undefined) {
+ updates.tags = JSON.stringify(
+ Array.isArray(changes.tags) ? changes.tags : [],
+ );
+ }
+
+ if (!Object.keys(updates).length) {
+ return { ok: false, summary: "Nothing to change" };
+ }
+
+ await createCurrentHostRepository().updateForUser(
+ userId,
+ hostId,
+ updates as any,
+ );
+ return { ok: true, summary: `Updated host ${hostId}` };
+ }
+
+ case "propose_delete_host": {
+ const hostId = requireNumber(payload.hostId, "hostId");
+ const deleted = await createCurrentHostRepository().deleteForUser(
+ userId,
+ hostId,
+ );
+ if (!deleted) throw new Error("Host not found");
+ return { ok: true, summary: `Deleted host ${hostId}` };
+ }
+
+ case "propose_create_snippet": {
+ const created = await createCurrentSnippetRepository().createSnippet(
+ userId,
+ {
+ name: requireString(payload.name, "name"),
+ content: requireString(payload.content, "content"),
+ description: optionalString(payload.description),
+ folder: optionalString(payload.folder),
+ } as any,
+ );
+ return {
+ ok: true,
+ summary: `Created snippet ${(created as any)?.name ?? ""}`.trim(),
+ };
+ }
+
+ case "propose_update_snippet": {
+ const snippetId = requireNumber(payload.snippetId, "snippetId");
+ const changes = (payload.changes ?? {}) as Record;
+
+ const existing = await createCurrentSnippetRepository().findOwnedById(
+ userId,
+ snippetId,
+ );
+ if (!existing) throw new Error("Snippet not found");
+
+ const updates: Record = {};
+ if (changes.name !== undefined)
+ updates.name = requireString(changes.name, "name");
+ if (changes.content !== undefined)
+ updates.content = requireString(changes.content, "content");
+ if (changes.description !== undefined)
+ updates.description = optionalString(changes.description);
+ if (changes.folder !== undefined)
+ updates.folder = optionalString(changes.folder);
+
+ if (!Object.keys(updates).length) {
+ return { ok: false, summary: "Nothing to change" };
+ }
+
+ await createCurrentSnippetRepository().updateSnippet(
+ userId,
+ snippetId,
+ updates as any,
+ );
+ return { ok: true, summary: `Updated snippet ${snippetId}` };
+ }
+
+ case "propose_delete_snippet": {
+ const snippetId = requireNumber(payload.snippetId, "snippetId");
+ const deleted = await createCurrentSnippetRepository().deleteSnippet(
+ userId,
+ snippetId,
+ );
+ if (!deleted) throw new Error("Snippet not found");
+ return { ok: true, summary: `Deleted snippet ${snippetId}` };
+ }
+
+ case "propose_create_fleet": {
+ const fleet = await createCurrentFleetRepository().create(userId, {
+ name: requireString(payload.name, "name"),
+ description: optionalString(payload.description),
+ } as any);
+
+ const hostIds = Array.isArray(payload.hostIds) ? payload.hostIds : [];
+ let added = 0;
+ for (const raw of hostIds) {
+ const hostId = Number(raw);
+ if (!Number.isInteger(hostId) || hostId <= 0) continue;
+ // Only hosts the approving user owns can join their fleet.
+ const host = await createCurrentHostRepository().findByIdForUser(
+ userId,
+ hostId,
+ );
+ if (!host) continue;
+ await createCurrentFleetRepository().addMember(
+ (fleet as any).id,
+ hostId,
+ );
+ added += 1;
+ }
+
+ return {
+ ok: true,
+ summary: `Created fleet ${(fleet as any).name} with ${added} host${added === 1 ? "" : "s"}`,
+ };
+ }
+
+ case "propose_create_alert_rule": {
+ const created = await createCurrentAlertRepository().createAlertRule({
+ userId,
+ name: requireString(payload.name, "name"),
+ hostId:
+ payload.hostId === null || payload.hostId === undefined
+ ? null
+ : requireNumber(payload.hostId, "hostId"),
+ enabled: true,
+ triggerType: requireString(payload.triggerType, "triggerType"),
+ thresholdValue:
+ payload.thresholdValue === null ||
+ payload.thresholdValue === undefined
+ ? null
+ : Number(payload.thresholdValue),
+ thresholdDurationSeconds:
+ payload.thresholdDurationSeconds === null ||
+ payload.thresholdDurationSeconds === undefined
+ ? null
+ : Number(payload.thresholdDurationSeconds),
+ cooldownMinutes: Number(payload.cooldownMinutes) || 15,
+ channelIds: [],
+ } as any);
+ return {
+ ok: true,
+ summary: `Created alert rule ${(created as any)?.name ?? ""}`.trim(),
+ };
+ }
+
+ case "propose_create_automation": {
+ // Reuses the same validator the automations route runs, so an
+ // LLM-authored definition is held to exactly the human standard.
+ const validation = validateDefinition(payload.definition);
+ if (!validation.ok || !validation.definition) {
+ throw new Error(
+ validation.error ?? "The automation definition is invalid",
+ );
+ }
+
+ const created = await createCurrentAutomationRepository().create({
+ userId,
+ name: requireString(payload.name, "name"),
+ description: optionalString(payload.description),
+ definition: JSON.stringify(validation.definition),
+ // Starts disabled: an automation the user has not watched run once
+ // should not begin firing against their servers on approval.
+ enabled: false,
+ });
+
+ return {
+ ok: true,
+ summary: `Created automation ${(created as any).name} (disabled until you enable it)`,
+ };
+ }
+
+ case "propose_run_command": {
+ const hostId = requireNumber(payload.hostId, "hostId");
+ const command = requireString(payload.command, "command");
+
+ // resolveHostById, not the raw repository row: it runs the connect-level
+ // permission check, decrypts auth under the owner's key, and resolves the
+ // jump host chain. A plain row has none of that, so the SSH factory saw
+ // an unresolved jumpHosts field and failed the connection.
+ const host = await resolveHostById(hostId, userId);
+ if (!host) throw new Error("Host not found");
+
+ const result = await runCommandOnHost(host, command);
+ if (result.error) {
+ throw new Error(result.error);
+ }
+ return {
+ ok: true,
+ summary: result.output?.slice(0, 2000) ?? "(no output)",
+ };
+ }
+
+ default:
+ throw new Error(`Proposal kind ${kind} cannot be applied automatically`);
+ }
+}
+
+/**
+ * Runs one approved command over the shared SSH pool, mirroring how an
+ * automation run_command step executes.
+ */
+async function runCommandOnHost(
+ host: Record,
+ command: string,
+): Promise<{ output?: string; error?: string }> {
+ try {
+ const result = await withConnection(
+ getFleetPoolKey(host as any),
+ createFleetSshFactory(host as any),
+ async (client) => execCommand(client, command, COMMAND_TIMEOUT_MS),
+ );
+
+ const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
+ if (result.code === 0 || result.code === null) {
+ return { output: output || "(no output)" };
+ }
+ return { error: `Exited with code ${result.code}: ${output}`.trim() };
+ } catch (error) {
+ return {
+ error: error instanceof Error ? error.message : String(error),
+ };
+ }
+}
+
+/**
+ * Kinds the route handles itself rather than through applyProposal.
+ * Empty: everything the assistant can propose can now be applied.
+ */
+export const ROUTE_APPLIED_KINDS = new Set();
diff --git a/src/backend/ai/tools/propose-tools.ts b/src/backend/ai/tools/propose-tools.ts
new file mode 100644
index 0000000..107d2aa
--- /dev/null
+++ b/src/backend/ai/tools/propose-tools.ts
@@ -0,0 +1,279 @@
+import { num, objectSchema, proposal, str, type AiTool } from "./types.js";
+
+/**
+ * Propose tools never mutate anything. They return a draft that is stored as a
+ * pending proposal and rendered as a card; the change happens only when the
+ * user approves it, and the payload is re-validated at that point.
+ */
+
+export const proposeTools: AiTool[] = [
+ {
+ name: "propose_create_host",
+ description:
+ "Propose adding a new SSH host. Never include credentials: the user attaches those themselves after approving.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ name: str("Display name for the host"),
+ ip: str("Hostname or IP address"),
+ port: num("SSH port (defaults to 22)"),
+ username: str("SSH username"),
+ folder: str("Folder to file the host under"),
+ tags: {
+ type: "array",
+ items: { type: "string" },
+ description: "Tags to apply",
+ },
+ },
+ ["name", "ip"],
+ ),
+ handler: async (args) =>
+ proposal("propose_create_host", `Add host ${String(args.name)}`, {
+ name: args.name,
+ ip: args.ip,
+ port: args.port ?? 22,
+ username: args.username ?? null,
+ folder: args.folder ?? null,
+ tags: args.tags ?? [],
+ }),
+ },
+ {
+ name: "propose_update_host",
+ description:
+ "Propose changing an existing host's non-secret settings. Only include the fields that should change.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ hostId: num("The host id to update"),
+ name: str("New display name"),
+ ip: str("New hostname or IP address"),
+ port: num("New SSH port"),
+ username: str("New SSH username"),
+ folder: str("New folder"),
+ tags: {
+ type: "array",
+ items: { type: "string" },
+ description: "Replacement tag list",
+ },
+ },
+ ["hostId"],
+ ),
+ handler: async (args) => {
+ const changes: Record = {};
+ for (const field of [
+ "name",
+ "ip",
+ "port",
+ "username",
+ "folder",
+ "tags",
+ ]) {
+ if (args[field] !== undefined) changes[field] = args[field];
+ }
+ return proposal(
+ "propose_update_host",
+ `Update host ${String(args.hostId)}`,
+ { hostId: args.hostId, changes },
+ );
+ },
+ },
+ {
+ name: "propose_delete_host",
+ description:
+ "Propose removing a host. Use sparingly and explain why in the reason.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ hostId: num("The host id to delete"),
+ reason: str("Why this host should be removed"),
+ },
+ ["hostId", "reason"],
+ ),
+ handler: async (args) =>
+ proposal("propose_delete_host", `Delete host ${String(args.hostId)}`, {
+ hostId: args.hostId,
+ reason: args.reason,
+ }),
+ },
+ {
+ name: "propose_create_snippet",
+ description:
+ "Propose saving a new command snippet the user can run against their hosts.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ name: str("Snippet name"),
+ content: str("The command text"),
+ description: str("What the snippet does"),
+ folder: str("Folder to file it under"),
+ },
+ ["name", "content"],
+ ),
+ handler: async (args) =>
+ proposal(
+ "propose_create_snippet",
+ `Create snippet ${String(args.name)}`,
+ {
+ name: args.name,
+ content: args.content,
+ description: args.description ?? null,
+ folder: args.folder ?? null,
+ },
+ ),
+ },
+ {
+ name: "propose_update_snippet",
+ description: "Propose editing an existing snippet.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ snippetId: num("The snippet id to update"),
+ name: str("New name"),
+ content: str("New command text"),
+ description: str("New description"),
+ folder: str("New folder"),
+ },
+ ["snippetId"],
+ ),
+ handler: async (args) => {
+ const changes: Record = {};
+ for (const field of ["name", "content", "description", "folder"]) {
+ if (args[field] !== undefined) changes[field] = args[field];
+ }
+ return proposal(
+ "propose_update_snippet",
+ `Update snippet ${String(args.snippetId)}`,
+ { snippetId: args.snippetId, changes },
+ );
+ },
+ },
+ {
+ name: "propose_delete_snippet",
+ description: "Propose deleting a snippet.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ snippetId: num("The snippet id to delete"),
+ reason: str("Why this snippet should be removed"),
+ },
+ ["snippetId", "reason"],
+ ),
+ handler: async (args) =>
+ proposal(
+ "propose_delete_snippet",
+ `Delete snippet ${String(args.snippetId)}`,
+ { snippetId: args.snippetId, reason: args.reason },
+ ),
+ },
+ {
+ name: "propose_create_automation",
+ description:
+ "Propose a new automation. The definition must be a valid AutomationDefinition object with a trigger and an ordered list of steps. It is validated server-side and previewed with a dry run before anything happens.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ name: str("Automation name"),
+ description: str("What the automation does"),
+ definition: {
+ type: "object",
+ description:
+ "The AutomationDefinition: { trigger: {...}, steps: [...] }",
+ },
+ },
+ ["name", "definition"],
+ ),
+ handler: async (args) =>
+ proposal(
+ "propose_create_automation",
+ `Create automation ${String(args.name)}`,
+ {
+ name: args.name,
+ description: args.description ?? null,
+ definition: args.definition,
+ },
+ ),
+ },
+ {
+ name: "propose_create_fleet",
+ description: "Propose grouping hosts into a new fleet.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ name: str("Fleet name"),
+ description: str("What this fleet is for"),
+ hostIds: {
+ type: "array",
+ items: { type: "number" },
+ description: "Host ids to add as members",
+ },
+ },
+ ["name"],
+ ),
+ handler: async (args) =>
+ proposal("propose_create_fleet", `Create fleet ${String(args.name)}`, {
+ name: args.name,
+ description: args.description ?? null,
+ hostIds: args.hostIds ?? [],
+ }),
+ },
+ {
+ name: "propose_create_alert_rule",
+ description:
+ "Propose a new alert rule that fires when a host metric crosses a threshold.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ name: str("Rule name"),
+ hostId: num("Host id to watch, or omit to watch all hosts"),
+ triggerType: str(
+ "What to watch, for example cpu, memory, disk or host_status",
+ ),
+ thresholdValue: num("Threshold to compare against"),
+ thresholdDurationSeconds: num(
+ "How long the breach must persist before firing",
+ ),
+ cooldownMinutes: num("Minimum minutes between repeat firings"),
+ },
+ ["name", "triggerType"],
+ ),
+ handler: async (args) =>
+ proposal(
+ "propose_create_alert_rule",
+ `Create alert rule ${String(args.name)}`,
+ {
+ name: args.name,
+ hostId: args.hostId ?? null,
+ triggerType: args.triggerType,
+ thresholdValue: args.thresholdValue ?? null,
+ thresholdDurationSeconds: args.thresholdDurationSeconds ?? null,
+ cooldownMinutes: args.cooldownMinutes ?? 15,
+ },
+ ),
+ },
+ {
+ name: "propose_run_command",
+ description:
+ "Propose running a command on a host. The user reviews and approves it before it runs. Use this for anything that changes state; read-only diagnostics may run directly if the user has enabled that.",
+ category: "propose",
+ parameters: objectSchema(
+ {
+ hostId: num("The host id to run on"),
+ command: str("The exact command to run"),
+ explanation: str("What the command does and why it is needed"),
+ },
+ ["hostId", "command", "explanation"],
+ ),
+ handler: async (args) =>
+ proposal(
+ "propose_run_command",
+ // Deliberately short: the card renders the command in its own block,
+ // so repeating it here made every card twice as tall as it needed.
+ `Run a command on host ${String(args.hostId)}`,
+ {
+ hostId: args.hostId,
+ command: args.command,
+ explanation: args.explanation,
+ },
+ ),
+ },
+];
diff --git a/src/backend/ai/tools/read-tools.ts b/src/backend/ai/tools/read-tools.ts
new file mode 100644
index 0000000..77ec7e3
--- /dev/null
+++ b/src/backend/ai/tools/read-tools.ts
@@ -0,0 +1,331 @@
+import {
+ createCurrentAlertRepository,
+ createCurrentAutomationRepository,
+ createCurrentCommandHistoryRepository,
+ createCurrentFleetRepository,
+ createCurrentHomepageItemRepository,
+ createCurrentHostRepository,
+ createCurrentNetworkTopologyRepository,
+ createCurrentSnippetRepository,
+ createCurrentWorkspaceRepository,
+} from "../../database/repositories/factory.js";
+import { num, objectSchema, type AiTool } from "./types.js";
+
+/**
+ * Read tools project explicit fields rather than spreading rows. Redaction runs
+ * afterwards as a second line of defense, but the projection here is the
+ * primary control: a field that is never selected cannot leak.
+ */
+
+interface HostSummary {
+ id: number;
+ name: string | null;
+ ip: string | null;
+ port: number | null;
+ username: string | null;
+ folder: string | null;
+ tags: unknown;
+ protocol: string | null;
+ enableTerminal: boolean | null;
+ enableFileManager: boolean | null;
+ enableTunnel: boolean | null;
+ enableDocker: boolean | null;
+}
+
+function toHostSummary(host: Record): HostSummary {
+ return {
+ id: host.id,
+ name: host.name ?? null,
+ ip: host.ip ?? null,
+ port: host.port ?? null,
+ username: host.username ?? null,
+ folder: host.folder ?? null,
+ tags: host.tags ?? null,
+ protocol: host.protocol ?? null,
+ enableTerminal: host.enableTerminal ?? null,
+ enableFileManager: host.enableFileManager ?? null,
+ enableTunnel: host.enableTunnel ?? null,
+ enableDocker: host.enableDocker ?? null,
+ };
+}
+
+export const readTools: AiTool[] = [
+ {
+ name: "list_hosts",
+ description:
+ "List the user's SSH hosts with their names, addresses, folders and tags. Never returns passwords or keys. Call this before proposing anything that references a host.",
+ category: "read",
+ parameters: objectSchema({}),
+ handler: async (_args, context) => {
+ const hosts = await createCurrentHostRepository().listByUserId(
+ context.userId,
+ );
+ return { hosts: hosts.map((host) => toHostSummary(host as any)) };
+ },
+ },
+ {
+ name: "get_host",
+ description:
+ "Get one host's non-secret configuration by id. Use it to inspect settings before proposing an update.",
+ category: "read",
+ parameters: objectSchema(
+ { hostId: num("The host id, as returned by list_hosts") },
+ ["hostId"],
+ ),
+ handler: async (args, context) => {
+ const hostId = Number(args.hostId);
+ const host = await createCurrentHostRepository().findByIdForUser(
+ context.userId,
+ hostId,
+ );
+ if (!host) return { error: "Host not found" };
+ return { host: toHostSummary(host as any) };
+ },
+ },
+ {
+ name: "list_fleets",
+ description:
+ "List the user's fleets. Fleets group hosts for bulk operations and inventory.",
+ category: "read",
+ parameters: objectSchema({}),
+ handler: async (_args, context) => {
+ const fleets = await createCurrentFleetRepository().listByUser(
+ context.userId,
+ );
+ return {
+ fleets: fleets.map((fleet: any) => ({
+ id: fleet.id,
+ name: fleet.name,
+ description: fleet.description ?? null,
+ })),
+ };
+ },
+ },
+ {
+ name: "list_snippets",
+ description:
+ "List the user's saved command snippets, including their folder and the command text.",
+ category: "read",
+ parameters: objectSchema({}),
+ handler: async (_args, context) => {
+ const snippets = await createCurrentSnippetRepository().listOwnedSnippets(
+ context.userId,
+ );
+ return {
+ snippets: snippets.map((snippet: any) => ({
+ id: snippet.id,
+ name: snippet.name,
+ content: snippet.content,
+ folder: snippet.folder ?? null,
+ description: snippet.description ?? null,
+ })),
+ };
+ },
+ },
+ {
+ name: "list_automations",
+ description:
+ "List the user's automations with their trigger kind and enabled state. Read this before proposing a change to an existing automation.",
+ category: "read",
+ parameters: objectSchema({}),
+ handler: async (_args, context) => {
+ const automations = await createCurrentAutomationRepository().list(
+ context.userId,
+ );
+ return {
+ automations: automations.map((automation: any) => ({
+ id: automation.id,
+ name: automation.name,
+ description: automation.description ?? null,
+ enabled: automation.enabled,
+ lastRunAt: automation.lastRunAt ?? null,
+ lastRunStatus: automation.lastRunStatus ?? null,
+ })),
+ };
+ },
+ },
+ {
+ name: "get_automation",
+ description:
+ "Get one automation's full definition (trigger and steps) by id.",
+ category: "read",
+ parameters: objectSchema(
+ {
+ automationId: num("The automation id, as returned by list_automations"),
+ },
+ ["automationId"],
+ ),
+ handler: async (args, context) => {
+ const automation = await createCurrentAutomationRepository().findForUser(
+ Number(args.automationId),
+ context.userId,
+ );
+ if (!automation) return { error: "Automation not found" };
+ return {
+ automation: {
+ id: (automation as any).id,
+ name: (automation as any).name,
+ enabled: (automation as any).enabled,
+ definition: (automation as any).definition,
+ },
+ };
+ },
+ },
+ {
+ name: "list_workspaces",
+ description:
+ "List the user's saved workspace layouts (named sets of open tabs and splits).",
+ category: "read",
+ parameters: objectSchema({}),
+ handler: async (_args, context) => {
+ const workspaces = await createCurrentWorkspaceRepository().listByUser(
+ context.userId,
+ );
+ return {
+ workspaces: workspaces.map((workspace: any) => ({
+ id: workspace.id,
+ name: workspace.name,
+ isDefault: workspace.isDefault ?? false,
+ })),
+ };
+ },
+ },
+ {
+ name: "list_alert_rules",
+ description:
+ "List the user's alert rules with their thresholds and enabled state.",
+ category: "read",
+ parameters: objectSchema({}),
+ handler: async (_args, context) => {
+ const rules = await createCurrentAlertRepository().listAlertRules(
+ context.userId,
+ );
+ return {
+ rules: rules.map((rule) => ({
+ id: rule.id,
+ name: rule.name,
+ hostId: rule.host_id,
+ enabled: rule.enabled === 1,
+ triggerType: rule.trigger_type,
+ thresholdValue: rule.threshold_value,
+ thresholdDurationSeconds: rule.threshold_duration_seconds,
+ cooldownMinutes: rule.cooldown_minutes,
+ })),
+ };
+ },
+ },
+ {
+ name: "list_notification_channels",
+ description:
+ "List the user's notification channels by id, name and type. Channel configuration is never returned because it holds tokens.",
+ category: "read",
+ parameters: objectSchema({}),
+ handler: async (_args, context) => {
+ const channels =
+ await createCurrentAlertRepository().listNotificationChannels(
+ context.userId,
+ );
+ return {
+ channels: channels.map((channel) => ({
+ id: channel.id,
+ name: channel.name,
+ type: channel.type,
+ enabled: channel.enabled === 1,
+ })),
+ };
+ },
+ },
+ {
+ name: "get_alert_firings",
+ description:
+ "Recent alert firings, newest first. Use this to answer questions about what has been alerting.",
+ category: "read",
+ parameters: objectSchema({
+ limit: num("How many firings to return (default 25, max 100)"),
+ }),
+ handler: async (args, context) => {
+ const limit = Math.min(Math.max(Number(args.limit) || 25, 1), 100);
+ const result = await createCurrentAlertRepository().listAlertFirings({
+ userId: context.userId,
+ limit,
+ offset: 0,
+ });
+ return {
+ firings: (result.firings ?? []).map((firing) => ({
+ id: firing.id,
+ ruleName: firing.rule_name,
+ hostName: firing.host_name,
+ firedAt: firing.fired_at,
+ resolvedAt: firing.resolved_at,
+ severity: firing.severity,
+ message: firing.message,
+ acknowledged: firing.acknowledged === 1,
+ })),
+ };
+ },
+ },
+ {
+ name: "list_homepage_items",
+ description: "List the user's homepage service-link tiles.",
+ category: "read",
+ parameters: objectSchema({}),
+ handler: async (_args, context) => {
+ const items = await createCurrentHomepageItemRepository().listByUserId(
+ context.userId,
+ );
+ return {
+ items: (items as any[]).map((item) => ({
+ id: item.id,
+ typeId: item.typeId,
+ title: item.title ?? null,
+ })),
+ };
+ },
+ },
+ {
+ name: "get_command_history",
+ description:
+ "Recent commands the user has run on one host, newest first. Useful for understanding what they have been working on.",
+ category: "read",
+ parameters: objectSchema(
+ {
+ hostId: num("The host id, as returned by list_hosts"),
+ limit: num("How many entries to return (default 25, max 100)"),
+ },
+ ["hostId"],
+ ),
+ handler: async (args, context) => {
+ const limit = Math.min(Math.max(Number(args.limit) || 25, 1), 100);
+ const hostId = Number(args.hostId);
+
+ // Ownership is enforced here rather than trusted from the model.
+ const host = await createCurrentHostRepository().findByIdForUser(
+ context.userId,
+ hostId,
+ );
+ if (!host) return { error: "Host not found" };
+
+ const commands =
+ await createCurrentCommandHistoryRepository().listCommandsForHost(
+ context.userId,
+ hostId,
+ limit,
+ );
+ return { commands };
+ },
+ },
+ {
+ name: "get_network_topology",
+ description: "The user's saved network topology graph, if they have one.",
+ category: "read",
+ parameters: objectSchema({}),
+ handler: async (_args, context) => {
+ const topology =
+ await createCurrentNetworkTopologyRepository().findByUserId(
+ context.userId,
+ );
+ if (!topology) return { topology: null };
+ return { topology: (topology as any).data ?? null };
+ },
+ },
+];
diff --git a/src/backend/ai/tools/types.ts b/src/backend/ai/tools/types.ts
new file mode 100644
index 0000000..34117dc
--- /dev/null
+++ b/src/backend/ai/tools/types.ts
@@ -0,0 +1,72 @@
+export type ToolCategory = "read" | "propose";
+
+export interface ToolContext {
+ /** Always taken from the verified JWT, never from model input. */
+ userId: string;
+ conversationId: number;
+ /** Per-user opt-in for running allowlisted read-only commands. */
+ allowReadOnlyCommands: boolean;
+}
+
+export interface AiTool {
+ name: string;
+ description: string;
+ category: ToolCategory;
+ /** JSON Schema for the arguments, sent to the provider verbatim. */
+ parameters: Record;
+ /**
+ * Read tools return data to feed back to the model. Propose tools return a
+ * ProposalDraft and must not mutate anything.
+ */
+ handler: (
+ args: Record,
+ context: ToolContext,
+ ) => Promise;
+}
+
+/** What a provider adapter needs to describe a tool to its model. */
+export interface ToolDefinitionShape {
+ name: string;
+ description: string;
+ parameters: Record;
+}
+
+export interface ProposalDraft {
+ __proposal: true;
+ kind: string;
+ summary: string;
+ payload: Record;
+}
+
+export function isProposalDraft(value: unknown): value is ProposalDraft {
+ return (
+ typeof value === "object" &&
+ value !== null &&
+ (value as ProposalDraft).__proposal === true
+ );
+}
+
+export function proposal(
+ kind: string,
+ summary: string,
+ payload: Record,
+): ProposalDraft {
+ return { __proposal: true, kind, summary, payload };
+}
+
+/** Small helper so tool schemas stay readable. */
+export function objectSchema(
+ properties: Record,
+ required: string[] = [],
+): Record {
+ return {
+ type: "object",
+ properties,
+ required,
+ additionalProperties: false,
+ };
+}
+
+export const str = (description: string) => ({ type: "string", description });
+export const num = (description: string) => ({ type: "number", description });
+export const bool = (description: string) => ({ type: "boolean", description });
diff --git a/src/backend/automations/actions/host-targets.ts b/src/backend/automations/actions/host-targets.ts
new file mode 100644
index 0000000..adb9366
--- /dev/null
+++ b/src/backend/automations/actions/host-targets.ts
@@ -0,0 +1,90 @@
+import type { HostSelector } from "../../../types/automations.js";
+import { resolveHostById } from "../../hosts/host-resolver.js";
+import { createCurrentFleetRepository } from "../../database/repositories/factory.js";
+import { PermissionManager } from "../../utils/permission-manager.js";
+import type { StepExecutionContext } from "./types.js";
+
+/** A host the caller is allowed to act on. `host` is always resolved. */
+export interface ResolvedTarget {
+ id: number;
+ name: string;
+ host: NonNullable>>;
+}
+
+/**
+ * Turns a selector into the hosts a step may actually act on.
+ *
+ * Access is checked here, at execution time rather than when the automation
+ * was saved, so a permission revoked after the fact takes effect on the next
+ * run. resolveHostById performs its own connect-level check and returns null
+ * when the owner can no longer reach the host.
+ */
+export async function resolveTargets(
+ selector: HostSelector,
+ context: StepExecutionContext,
+): Promise<{ targets: ResolvedTarget[]; skipped: number[] }> {
+ const ids = await selectorHostIds(selector, context);
+ const targets: ResolvedTarget[] = [];
+ const skipped: number[] = [];
+
+ for (const id of ids) {
+ const host = await resolveHostById(id, context.userId);
+ if (!host) {
+ skipped.push(id);
+ continue;
+ }
+ targets.push({ id, name: host.name || host.ip, host });
+ }
+
+ return { targets, skipped };
+}
+
+async function selectorHostIds(
+ selector: HostSelector,
+ context: StepExecutionContext,
+): Promise {
+ switch (selector.kind) {
+ case "host":
+ return [selector.hostId];
+ case "hosts":
+ return selector.hostIds;
+ case "trigger":
+ return context.triggerHostId ? [context.triggerHostId] : [];
+ case "fleet":
+ return fleetHostIds(selector.fleetId, context.userId);
+ case "all":
+ return allAccessibleHostIds(context.userId);
+ default:
+ return [];
+ }
+}
+
+async function fleetHostIds(
+ fleetId: number,
+ userId: string,
+): Promise {
+ try {
+ const repository = createCurrentFleetRepository();
+ const members = await repository.listEffectiveMembers(userId, fleetId);
+ return members.map((member) => member.id);
+ } catch {
+ return [];
+ }
+}
+
+async function allAccessibleHostIds(userId: string): Promise {
+ try {
+ const { createCurrentHostRepository } =
+ await import("../../database/repositories/factory.js");
+ const hosts = await createCurrentHostRepository().listByUserId(userId);
+ const ids = hosts.map((host) => host.id);
+ const allowed =
+ await PermissionManager.getInstance().filterAccessibleHostIds(
+ userId,
+ ids,
+ );
+ return ids.filter((id) => allowed.has(id));
+ } catch {
+ return [];
+ }
+}
diff --git a/src/backend/automations/actions/index.ts b/src/backend/automations/actions/index.ts
new file mode 100644
index 0000000..f288df4
--- /dev/null
+++ b/src/backend/automations/actions/index.ts
@@ -0,0 +1,406 @@
+import {
+ DEFAULT_STEP_TIMEOUT_MS,
+ type Step,
+} from "../../../types/automations.js";
+import { execCommand } from "../../hosts/metrics/widgets/common-utils.js";
+import {
+ execElevated,
+ shellSingleQuote,
+} from "../../hosts/metrics/managers/exec-elevated.js";
+import {
+ createFleetSshFactory,
+ getFleetPoolKey,
+} from "../../hosts/ssh-client-factory.js";
+import { withConnection } from "../../hosts/ssh-connection-pool.js";
+import { resolveSnippetCommand } from "../../database/routes/snippets-execution.js";
+import {
+ createCurrentAlertRepository,
+ createCurrentSnippetRepository,
+} from "../../database/repositories/factory.js";
+import { sendAutomationNotification } from "../notify.js";
+import { automationFetch } from "../http.js";
+import { renderRecord, renderTemplate } from "../template.js";
+import { resolveTargets, type ResolvedTarget } from "./host-targets.js";
+import {
+ fail,
+ ok,
+ stepTimeout,
+ type StepExecutionContext,
+ type StepResult,
+} from "./types.js";
+
+/**
+ * One executor per step type.
+ *
+ * Anything that leaves Termix checks context.dryRun first and reports what it
+ * would have done instead of doing it, so an automation can be exercised
+ * safely while it is being built.
+ */
+export async function executeStep(
+ step: Step,
+ context: StepExecutionContext,
+): Promise {
+ switch (step.type) {
+ case "notify":
+ return runNotify(step, context);
+ case "http":
+ return runHttp(step, context);
+ case "run_command":
+ return runCommand(step, context);
+ case "run_snippet":
+ return runSnippet(step, context);
+ case "docker":
+ return runDocker(step, context);
+ case "tunnel":
+ return runTunnel(step, context);
+ case "wol":
+ return runWol(step, context);
+ case "wait":
+ return runWait(step, context);
+ case "set_var":
+ return runSetVar(step, context);
+ case "stop":
+ return {
+ success: true,
+ halt: { status: step.status ?? "success" },
+ output: `Stopped with status ${step.status ?? "success"}`,
+ };
+ default:
+ return fail(`Unsupported step type: ${(step as Step).type}`);
+ }
+}
+
+async function runNotify(
+ step: Extract,
+ context: StepExecutionContext,
+): Promise {
+ const title = renderTemplate(step.title ?? "", context.template);
+ const body = renderTemplate(step.body ?? "", context.template);
+
+ if (step.channelIds.length === 0) {
+ return fail("No notification channels selected");
+ }
+ if (context.dryRun) {
+ return ok(
+ `Would notify ${step.channelIds.length} channel(s): ${title || body}`,
+ );
+ }
+
+ const repository = createCurrentAlertRepository();
+ const channels = await repository.listNotificationChannels(context.userId);
+ const selected = channels.filter((channel) =>
+ step.channelIds.includes(channel.id),
+ );
+
+ if (selected.length === 0) {
+ return fail("Selected notification channels no longer exist");
+ }
+
+ let delivered = 0;
+ const errors: string[] = [];
+ for (const channel of selected) {
+ if (!channel.enabled) continue;
+ try {
+ await sendAutomationNotification(
+ { id: channel.id, type: channel.type, config: channel.config },
+ {
+ title,
+ body,
+ severity: step.severity ?? "warning",
+ context: context.template,
+ },
+ );
+ delivered++;
+ } catch (error) {
+ errors.push(
+ `${channel.name}: ${error instanceof Error ? error.message : String(error)}`,
+ );
+ }
+ }
+
+ if (delivered === 0) {
+ return fail(errors.join("; ") || "No enabled channels to notify");
+ }
+ return ok(
+ `Notified ${delivered} channel(s)${errors.length ? `; ${errors.join("; ")}` : ""}`,
+ );
+}
+
+async function runHttp(
+ step: Extract,
+ context: StepExecutionContext,
+): Promise {
+ const url = renderTemplate(step.url, context.template);
+ const headers = renderRecord(step.headers, context.template);
+ const body = step.body
+ ? renderTemplate(step.body, context.template)
+ : undefined;
+
+ if (context.dryRun) {
+ return ok(`Would ${step.method} ${url}`);
+ }
+
+ try {
+ const response = await automationFetch(url, {
+ method: step.method,
+ headers,
+ body,
+ allowPrivateNetwork: step.allowPrivateNetwork,
+ timeoutMs: stepTimeout(context, step.timeoutMs, DEFAULT_STEP_TIMEOUT_MS),
+ });
+
+ const text = await response.text();
+ const summary = `HTTP ${response.status} ${response.statusText}\n${text}`;
+ return response.ok ? ok(summary) : fail(`HTTP ${response.status}`, summary);
+ } catch (error) {
+ return fail(error instanceof Error ? error.message : String(error));
+ }
+}
+
+async function runCommand(
+ step: Extract,
+ context: StepExecutionContext,
+): Promise {
+ const command = renderTemplate(step.command, context.template);
+ return runOnTargets(step.hostSelector, context, async (target) => {
+ if (context.dryRun) {
+ return { output: `Would run on ${target.name}: ${command}` };
+ }
+ return execOnHost(
+ target.host,
+ command,
+ step.elevated,
+ context,
+ step.timeoutMs,
+ );
+ });
+}
+
+async function runSnippet(
+ step: Extract,
+ context: StepExecutionContext,
+): Promise {
+ const snippet = await createCurrentSnippetRepository()
+ .findOwnedById(context.userId, step.snippetId)
+ .catch(() => null);
+
+ if (!snippet) return fail("Snippet not found");
+ if (snippet.isNote) return fail("Notes cannot be executed on a host");
+
+ // Template values only ever reach the snippet through inputValues, never by
+ // rewriting the snippet body, so automation variables cannot inject snippet
+ // syntax of their own.
+ const inputValues = renderRecord(step.inputValues, context.template) ?? {};
+
+ return runOnTargets(step.hostSelector, context, async (target) => {
+ const command = resolveSnippetCommand(
+ snippet.content,
+ {
+ ip: target.host.ip,
+ username: target.host.username,
+ port: target.host.port,
+ name: target.host.name,
+ },
+ inputValues,
+ );
+
+ if (context.dryRun) {
+ return { output: `Would run snippet on ${target.name}: ${command}` };
+ }
+ return execOnHost(
+ target.host,
+ command,
+ step.elevated,
+ context,
+ step.timeoutMs,
+ );
+ });
+}
+
+async function runDocker(
+ step: Extract,
+ context: StepExecutionContext,
+): Promise {
+ const container = renderTemplate(step.container, context.template);
+ if (!container) return fail("Container name is required");
+
+ return runOnTargets(step.hostSelector, context, async (target) => {
+ if (context.dryRun) {
+ return {
+ output: `Would ${step.action} container ${container} on ${target.name}`,
+ };
+ }
+
+ // The Docker HTTP routes are tied to an interactive session, so run the
+ // equivalent command over the same pooled SSH connection everything else
+ // uses. The container name is quoted because it comes from a template.
+ const command = `docker ${step.action} ${shellSingleQuote(container)}`;
+ return execOnHost(target.host, command, false, context, step.timeoutMs);
+ });
+}
+
+async function runTunnel(
+ step: Extract,
+ context: StepExecutionContext,
+): Promise {
+ const name = renderTemplate(step.tunnelName, context.template);
+ if (context.dryRun) return ok(`Would ${step.action} tunnel ${name}`);
+
+ try {
+ const manager = await import("../../hosts/tunnel/manager.js");
+ const config = manager.tunnelConfigs?.get(name);
+ if (!config) return fail(`Tunnel "${name}" is not configured`);
+
+ if (step.action === "connect") {
+ await manager.connectSSHTunnel(config);
+ return ok(`Tunnel ${name} connected`);
+ }
+
+ // shouldRetry false, otherwise the manager immediately reconnects the
+ // tunnel the automation just asked it to drop.
+ manager.manualDisconnects.add(name);
+ await manager.handleDisconnect(name, config, false);
+ return ok(`Tunnel ${name} disconnected`);
+ } catch (error) {
+ return fail(error instanceof Error ? error.message : String(error));
+ }
+}
+
+async function runWol(
+ step: Extract,
+ context: StepExecutionContext,
+): Promise {
+ const host = await resolveTargets(
+ { kind: "host", hostId: step.hostId },
+ context,
+ );
+ const target = host.targets[0];
+ if (!target?.host) return fail("Host not found or not accessible");
+
+ const mac = (target.host as { macAddress?: string }).macAddress;
+ if (!mac) return fail("Host has no MAC address configured");
+ if (context.dryRun) return ok(`Would wake ${target.name} (${mac})`);
+
+ try {
+ const { sendWakeOnLan, isValidMac } =
+ await import("../../utils/wake-on-lan.js");
+ if (!isValidMac(mac)) return fail(`Invalid MAC address: ${mac}`);
+ await sendWakeOnLan(mac);
+ return ok(`Sent magic packet to ${target.name}`);
+ } catch (error) {
+ return fail(error instanceof Error ? error.message : String(error));
+ }
+}
+
+async function runWait(
+ step: Extract,
+ context: StepExecutionContext,
+): Promise {
+ const requested = Math.max(step.seconds, 0) * 1000;
+ const waitMs = Math.min(
+ requested,
+ stepTimeout(context, undefined, requested),
+ );
+ if (context.dryRun) return ok(`Would wait ${step.seconds}s`);
+
+ await new Promise((resolve) => setTimeout(resolve, waitMs));
+ return ok(`Waited ${Math.round(waitMs / 1000)}s`);
+}
+
+async function runSetVar(
+ step: Extract,
+ context: StepExecutionContext,
+): Promise {
+ const value = renderTemplate(step.value, context.template);
+ return ok(`${step.name} = ${value}`, { [step.name]: value });
+}
+
+/**
+ * Runs a per-host action across a selector's targets. One host failing does
+ * not stop the others, matching how fleet execution behaves.
+ */
+async function runOnTargets(
+ selector: Extract["hostSelector"],
+ context: StepExecutionContext,
+ run: (target: ResolvedTarget) => Promise<{ output?: string; error?: string }>,
+): Promise {
+ const { targets, skipped } = await resolveTargets(selector, context);
+
+ if (targets.length === 0) {
+ return fail(
+ skipped.length > 0
+ ? `No accessible hosts (${skipped.length} skipped)`
+ : "No hosts matched the selector",
+ );
+ }
+
+ const results = await Promise.allSettled(
+ targets.map(async (target) => ({
+ target,
+ result: await run(target),
+ })),
+ );
+
+ const lines: string[] = [];
+ let failures = 0;
+
+ for (const [index, settled] of results.entries()) {
+ const name = targets[index].name;
+ if (settled.status === "rejected") {
+ failures++;
+ lines.push(`${name}: ${String(settled.reason)}`);
+ continue;
+ }
+ const { result } = settled.value;
+ if (result.error) {
+ failures++;
+ lines.push(`${name}: ${result.error}`);
+ } else {
+ lines.push(`${name}: ${result.output ?? "ok"}`);
+ }
+ }
+
+ if (skipped.length > 0) {
+ lines.push(`${skipped.length} host(s) skipped: no access`);
+ }
+
+ const output = lines.join("\n");
+ return failures > 0 && failures === targets.length
+ ? fail(`All ${failures} host(s) failed`, output)
+ : ok(output);
+}
+
+async function execOnHost(
+ host: ResolvedTarget["host"],
+ command: string,
+ elevated: boolean | undefined,
+ context: StepExecutionContext,
+ timeoutMs: number | undefined,
+): Promise<{ output?: string; error?: string }> {
+ const sshHost = host as ResolvedTarget["host"] & { sudoPassword?: string };
+ const timeout = stepTimeout(context, timeoutMs, DEFAULT_STEP_TIMEOUT_MS);
+ if (timeout <= 0) return { error: "Run deadline exceeded" };
+
+ try {
+ const result = await withConnection(
+ getFleetPoolKey(sshHost),
+ createFleetSshFactory(sshHost),
+ async (client) => {
+ if (elevated) {
+ return execElevated(client, command, sshHost.sudoPassword, {
+ timeoutMs: timeout,
+ });
+ }
+ return execCommand(client, command, timeout);
+ },
+ );
+
+ const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
+ if (result.code === 0 || result.code === null) {
+ return { output: output || "(no output)" };
+ }
+ return { error: `Exited with code ${result.code}`, output };
+ } catch (error) {
+ return { error: error instanceof Error ? error.message : String(error) };
+ }
+}
diff --git a/src/backend/automations/actions/types.ts b/src/backend/automations/actions/types.ts
new file mode 100644
index 0000000..b6f325e
--- /dev/null
+++ b/src/backend/automations/actions/types.ts
@@ -0,0 +1,58 @@
+import type { Step } from "../../../types/automations.js";
+import type { TemplateContext } from "../template.js";
+
+/** What every executor returns. `output` is what later steps can read. */
+export interface StepResult {
+ success: boolean;
+ output?: string;
+ error?: string;
+ /** Merged into the run's variables, for set_var and friends. */
+ vars?: Record;
+ /** Set by the stop step to end the run early. */
+ halt?: { status: "success" | "failed" };
+}
+
+export interface StepExecutionContext {
+ userId: string;
+ automationId: number;
+ runId: number;
+ /** Nothing that leaves Termix may actually happen when this is set. */
+ dryRun: boolean;
+ template: TemplateContext;
+ /** Host the trigger fired for, when there was one. */
+ triggerHostId?: number;
+ /** Automations already on the stack, to refuse recursion. */
+ ancestry: number[];
+ depth: number;
+ /** Wall-clock deadline for the whole run. */
+ deadlineAt: number;
+ signal?: AbortSignal;
+}
+
+export type StepExecutor = (
+ step: T,
+ context: StepExecutionContext,
+) => Promise;
+
+export function ok(output?: string, vars?: Record): StepResult {
+ return { success: true, output, vars };
+}
+
+export function fail(error: string, output?: string): StepResult {
+ return { success: false, error, output };
+}
+
+/** Milliseconds left before the run's overall deadline. */
+export function remainingMs(context: StepExecutionContext): number {
+ return Math.max(context.deadlineAt - Date.now(), 0);
+}
+
+/** A step's timeout, clamped so it can never outlive the run. */
+export function stepTimeout(
+ context: StepExecutionContext,
+ requested: number | undefined,
+ fallback: number,
+): number {
+ const wanted = requested && requested > 0 ? requested : fallback;
+ return Math.max(Math.min(wanted, remainingMs(context)), 0);
+}
diff --git a/src/backend/automations/conditions.ts b/src/backend/automations/conditions.ts
new file mode 100644
index 0000000..8e1711e
--- /dev/null
+++ b/src/backend/automations/conditions.ts
@@ -0,0 +1,203 @@
+import type { MetricPath, Operator } from "../../types/automations.js";
+
+/**
+ * Operator evaluation and metric extraction.
+ *
+ * Pure: no database, no SSH, no clock. Everything here is driven by values the
+ * caller already has, which keeps the comparison rules testable on their own.
+ */
+
+/** Shape of the metrics snapshot this module reads. Mirrors collectMetrics(). */
+export interface MetricsSnapshot {
+ cpu?: {
+ percent?: number | null;
+ load?: [number, number, number] | null;
+ } | null;
+ memory?: { percent?: number | null; usedGiB?: number | null } | null;
+ disk?: {
+ percent?: number | null;
+ filesystems?: Array<{
+ mount?: string;
+ percent?: number | null;
+ availableBytes?: number | null;
+ }> | null;
+ } | null;
+ network?: {
+ interfaces?: Array<{
+ name?: string;
+ rxBytes?: string | number | null;
+ txBytes?: string | number | null;
+ rxRateBps?: number | null;
+ txRateBps?: number | null;
+ }> | null;
+ } | null;
+ temperature?: { highestCelsius?: number | null } | null;
+ uptime?: { seconds?: number | null } | null;
+ processes?: { total?: number | null } | null;
+}
+
+function toNumber(value: unknown): number | null {
+ if (value === null || value === undefined || value === "") return null;
+ const parsed = typeof value === "number" ? value : Number(value);
+ return Number.isFinite(parsed) ? parsed : null;
+}
+
+/**
+ * Pulls the value a trigger watches out of a metrics snapshot.
+ *
+ * The mount and iface selectors are what let a rule watch one filesystem or
+ * one interface. Without a selector the aggregate is used, which for disk is
+ * the primary (root) mount, matching what the metrics UI shows.
+ */
+export function extractMetricValue(
+ metrics: MetricsSnapshot | null | undefined,
+ metric: MetricPath,
+): number | null {
+ if (!metrics) return null;
+
+ switch (metric.path) {
+ case "cpu.percent":
+ return toNumber(metrics.cpu?.percent);
+ case "cpu.load1":
+ return toNumber(metrics.cpu?.load?.[0]);
+ case "cpu.load5":
+ return toNumber(metrics.cpu?.load?.[1]);
+ case "cpu.load15":
+ return toNumber(metrics.cpu?.load?.[2]);
+ case "memory.percent":
+ return toNumber(metrics.memory?.percent);
+ case "memory.usedGiB":
+ return toNumber(metrics.memory?.usedGiB);
+ case "disk.percent": {
+ if (!metric.mount) return toNumber(metrics.disk?.percent);
+ const fs = findMount(metrics, metric.mount);
+ return fs ? toNumber(fs.percent) : null;
+ }
+ case "disk.availableBytes": {
+ const fs = metric.mount ? findMount(metrics, metric.mount) : null;
+ if (metric.mount) return fs ? toNumber(fs.availableBytes) : null;
+ const first = metrics.disk?.filesystems?.[0];
+ return first ? toNumber(first.availableBytes) : null;
+ }
+ case "temperature.highestCelsius":
+ return toNumber(metrics.temperature?.highestCelsius);
+ case "uptime.seconds":
+ return toNumber(metrics.uptime?.seconds);
+ case "processes.total":
+ return toNumber(metrics.processes?.total);
+ case "network.rxBytes":
+ return toNumber(findInterface(metrics, metric.iface)?.rxBytes);
+ case "network.txBytes":
+ return toNumber(findInterface(metrics, metric.iface)?.txBytes);
+ case "network.rxRateBps":
+ return toNumber(findInterface(metrics, metric.iface)?.rxRateBps);
+ case "network.txRateBps":
+ return toNumber(findInterface(metrics, metric.iface)?.txRateBps);
+ default:
+ return null;
+ }
+}
+
+function findMount(metrics: MetricsSnapshot, mount: string) {
+ return (
+ metrics.disk?.filesystems?.find((entry) => entry.mount === mount) ?? null
+ );
+}
+
+function findInterface(metrics: MetricsSnapshot, iface?: string) {
+ const interfaces = metrics.network?.interfaces;
+ if (!interfaces || interfaces.length === 0) return null;
+ if (!iface) return interfaces[0];
+ return interfaces.find((entry) => entry.name === iface) ?? null;
+}
+
+/**
+ * The key a trigger's durable state is stored under. Including the mount or
+ * container is what allows a sustained-breach window per filesystem rather
+ * than per host.
+ */
+export function metricStateKey(hostId: number, metric: MetricPath): string {
+ if ("mount" in metric && metric.mount) return `${hostId}:${metric.mount}`;
+ if ("iface" in metric && metric.iface) return `${hostId}:${metric.iface}`;
+ return String(hostId);
+}
+
+/**
+ * Compares two values. Numeric when both sides look numeric, so "90" and 90
+ * behave the same; string comparison otherwise. `changed` is handled by the
+ * caller, which is the only place that knows the previous value.
+ */
+export function compare(
+ left: unknown,
+ operator: Operator,
+ right: unknown,
+): boolean {
+ if (operator === "contains" || operator === "not_contains") {
+ const haystack = String(left ?? "");
+ const needle = String(right ?? "");
+ const found = haystack.includes(needle);
+ return operator === "contains" ? found : !found;
+ }
+
+ const leftNumber = toNumber(left);
+ const rightNumber = toNumber(right);
+ const numeric = leftNumber !== null && rightNumber !== null;
+
+ switch (operator) {
+ case ">":
+ return numeric && leftNumber > rightNumber;
+ case "<":
+ return numeric && leftNumber < rightNumber;
+ case ">=":
+ return numeric && leftNumber >= rightNumber;
+ case "<=":
+ return numeric && leftNumber <= rightNumber;
+ case "==":
+ return numeric
+ ? leftNumber === rightNumber
+ : String(left ?? "") === String(right ?? "");
+ case "!=":
+ return numeric
+ ? leftNumber !== rightNumber
+ : String(left ?? "") !== String(right ?? "");
+ case "changed":
+ return String(left ?? "") !== String(right ?? "");
+ default:
+ return false;
+ }
+}
+
+/** Whether a cooldown window is still open. */
+export function isCoolingDown(
+ lastFiredAt: string | null | undefined,
+ cooldownMinutes: number,
+ now: number = Date.now(),
+): boolean {
+ if (!lastFiredAt) return false;
+ const last = Date.parse(lastFiredAt);
+ if (Number.isNaN(last)) return false;
+ return now - last < Math.max(cooldownMinutes, 0) * 60_000;
+}
+
+/** Whether a sustained breach has been held long enough to fire. */
+export function hasDwelled(
+ breachStartedAt: string | null | undefined,
+ forSeconds: number | undefined,
+ now: number = Date.now(),
+): boolean {
+ if (!forSeconds) return true;
+ if (!breachStartedAt) return false;
+ const started = Date.parse(breachStartedAt);
+ if (Number.isNaN(started)) return false;
+ return now - started >= forSeconds * 1000;
+}
+
+/** Severity for a threshold breach, matching the old engine's behaviour. */
+export function severityForValue(
+ value: number | null,
+ explicit?: "info" | "warning" | "critical",
+): "info" | "warning" | "critical" {
+ if (explicit) return explicit;
+ if (value !== null && value >= 95) return "critical";
+ return "warning";
+}
diff --git a/src/backend/automations/cron.ts b/src/backend/automations/cron.ts
new file mode 100644
index 0000000..7fd2a33
--- /dev/null
+++ b/src/backend/automations/cron.ts
@@ -0,0 +1,291 @@
+/**
+ * A small five field cron parser, used only to work out when a schedule is
+ * next due.
+ *
+ * Deliberately not a dependency: the engine needs "when is this next due?" and
+ * nothing else, and a pure function is far easier to test than a scheduler
+ * library. Fields are the standard minute, hour, day-of-month, month and
+ * day-of-week, supporting *, lists (1,2), ranges (1-5) and steps (a slash).
+ *
+ * Day-of-month and day-of-week follow cron's union rule: when both are
+ * restricted, a date matching either one matches.
+ */
+
+interface CronFields {
+ minutes: Set;
+ hours: Set;
+ daysOfMonth: Set;
+ months: Set;
+ daysOfWeek: Set;
+ domRestricted: boolean;
+ dowRestricted: boolean;
+}
+
+const RANGES: Record = {
+ minute: [0, 59],
+ hour: [0, 23],
+ dayOfMonth: [1, 31],
+ month: [1, 12],
+ // 7 is accepted as an alias for Sunday and folded to 0 once parsed.
+ dayOfWeek: [0, 7],
+};
+
+const NAMED_MONTHS: Record = {
+ jan: 1,
+ feb: 2,
+ mar: 3,
+ apr: 4,
+ may: 5,
+ jun: 6,
+ jul: 7,
+ aug: 8,
+ sep: 9,
+ oct: 10,
+ nov: 11,
+ dec: 12,
+};
+
+const NAMED_DAYS: Record = {
+ sun: 0,
+ mon: 1,
+ tue: 2,
+ wed: 3,
+ thu: 4,
+ fri: 5,
+ sat: 6,
+};
+
+function normalize(token: string, kind: string): string {
+ const lower = token.toLowerCase();
+ if (kind === "month" && lower in NAMED_MONTHS) {
+ return String(NAMED_MONTHS[lower]);
+ }
+ if (kind === "dayOfWeek" && lower in NAMED_DAYS) {
+ return String(NAMED_DAYS[lower]);
+ }
+ return token;
+}
+
+function parseField(field: string, kind: keyof typeof RANGES): Set {
+ const [min, max] = RANGES[kind];
+ const values = new Set();
+
+ for (const part of field.split(",")) {
+ const trimmed = part.trim();
+ if (!trimmed) throw new Error(`Empty value in ${kind} field`);
+
+ const [rangePart, stepPart] = trimmed.split("/");
+ const step = stepPart === undefined ? 1 : Number(stepPart);
+ if (!Number.isInteger(step) || step < 1) {
+ throw new Error(`Invalid step in ${kind} field`);
+ }
+
+ let start: number;
+ let end: number;
+
+ if (rangePart === "*" || rangePart === "") {
+ start = min;
+ end = max;
+ } else if (rangePart.includes("-")) {
+ const [from, to] = rangePart.split("-");
+ start = Number(normalize(from, kind));
+ end = Number(normalize(to, kind));
+ } else {
+ start = Number(normalize(rangePart, kind));
+ end = stepPart === undefined ? start : max;
+ }
+
+ if (!Number.isInteger(start) || !Number.isInteger(end)) {
+ throw new Error(`Invalid value in ${kind} field`);
+ }
+ if (start < min || end > max || start > end) {
+ throw new Error(`Value out of range in ${kind} field`);
+ }
+
+ for (let value = start; value <= end; value += step) {
+ // Sunday can be written as 7; cron treats it as 0.
+ values.add(kind === "dayOfWeek" && value === 7 ? 0 : value);
+ }
+ }
+
+ return values;
+}
+
+export function parseCron(expression: string): CronFields {
+ const fields = expression.trim().split(/\s+/);
+ if (fields.length !== 5) {
+ throw new Error("A cron expression needs five fields");
+ }
+
+ const [minute, hour, dayOfMonth, month, dayOfWeek] = fields;
+ return {
+ minutes: parseField(minute, "minute"),
+ hours: parseField(hour, "hour"),
+ daysOfMonth: parseField(dayOfMonth, "dayOfMonth"),
+ months: parseField(month, "month"),
+ daysOfWeek: parseField(dayOfWeek, "dayOfWeek"),
+ domRestricted: dayOfMonth.trim() !== "*",
+ dowRestricted: dayOfWeek.trim() !== "*",
+ };
+}
+
+export function isValidCron(expression: string): boolean {
+ try {
+ parseCron(expression);
+ return true;
+ } catch {
+ return false;
+ }
+}
+
+/** Wall-clock fields for a moment, in a given zone or server local time. */
+interface WallClock {
+ minute: number;
+ hour: number;
+ dayOfMonth: number;
+ month: number;
+ dayOfWeek: number;
+}
+
+const WEEKDAYS: Record = {
+ Sun: 0,
+ Mon: 1,
+ Tue: 2,
+ Wed: 3,
+ Thu: 4,
+ Fri: 5,
+ Sat: 6,
+};
+
+const formatterCache = new Map();
+
+/**
+ * Whether a zone name is one this runtime actually knows. An unknown zone
+ * falls back to server local time rather than throwing, so a bad value saved
+ * against a schedule cannot stop it from ever running.
+ */
+export function isValidTimezone(timezone: string): boolean {
+ try {
+ new Intl.DateTimeFormat("en-US", { timeZone: timezone });
+ return true;
+ } catch {
+ return false;
+ }
+}
+
+function formatterFor(timezone: string): Intl.DateTimeFormat | null {
+ const cached = formatterCache.get(timezone);
+ if (cached) return cached;
+
+ try {
+ const formatter = new Intl.DateTimeFormat("en-US", {
+ timeZone: timezone,
+ hour12: false,
+ weekday: "short",
+ month: "numeric",
+ day: "numeric",
+ hour: "numeric",
+ minute: "numeric",
+ });
+ formatterCache.set(timezone, formatter);
+ return formatter;
+ } catch {
+ return null;
+ }
+}
+
+function wallClock(date: Date, timezone?: string | null): WallClock {
+ const formatter = timezone ? formatterFor(timezone) : null;
+ if (!formatter) {
+ return {
+ minute: date.getMinutes(),
+ hour: date.getHours(),
+ dayOfMonth: date.getDate(),
+ month: date.getMonth() + 1,
+ dayOfWeek: date.getDay(),
+ };
+ }
+
+ const parts: Record = {};
+ for (const part of formatter.formatToParts(date)) {
+ parts[part.type] = part.value;
+ }
+
+ return {
+ // Midnight formats as 24 in some locales' hour-cycle handling.
+ minute: Number(parts.minute),
+ hour: Number(parts.hour) % 24,
+ dayOfMonth: Number(parts.day),
+ month: Number(parts.month),
+ dayOfWeek: WEEKDAYS[parts.weekday] ?? date.getDay(),
+ };
+}
+
+function matches(
+ fields: CronFields,
+ date: Date,
+ timezone?: string | null,
+): boolean {
+ const clock = wallClock(date, timezone);
+ if (!fields.months.has(clock.month)) return false;
+ if (!fields.minutes.has(clock.minute)) return false;
+ if (!fields.hours.has(clock.hour)) return false;
+
+ const domMatch = fields.daysOfMonth.has(clock.dayOfMonth);
+ const dowMatch = fields.daysOfWeek.has(clock.dayOfWeek);
+
+ // Both restricted means either may match, which is how cron behaves.
+ if (fields.domRestricted && fields.dowRestricted) return domMatch || dowMatch;
+ if (fields.domRestricted) return domMatch;
+ if (fields.dowRestricted) return dowMatch;
+ return true;
+}
+
+/**
+ * The next time on or after `from` that the expression matches, or null when
+ * nothing matches within a four year window (e.g. Feb 30).
+ */
+export function nextCronRun(
+ expression: string,
+ from: Date = new Date(),
+ timezone?: string | null,
+): Date | null {
+ const fields = parseCron(expression);
+
+ const candidate = new Date(from.getTime());
+ candidate.setSeconds(0, 0);
+ candidate.setMinutes(candidate.getMinutes() + 1);
+
+ // Four years covers every leap year cycle, so a date that never matches
+ // gives up rather than looping.
+ const limit = 366 * 4 * 24 * 60;
+ for (let i = 0; i < limit; i++) {
+ if (matches(fields, candidate, timezone)) return candidate;
+ candidate.setMinutes(candidate.getMinutes() + 1);
+ }
+ return null;
+}
+
+/**
+ * Next due time for a schedule trigger, as an ISO string. Interval wins over
+ * cron when both are set, matching the editor which offers one or the other.
+ */
+export function computeNextDueAt(
+ schedule: {
+ cron?: string | null;
+ intervalSeconds?: number | null;
+ timezone?: string | null;
+ },
+ from: Date = new Date(),
+): string | null {
+ if (schedule.intervalSeconds && schedule.intervalSeconds > 0) {
+ return new Date(
+ from.getTime() + schedule.intervalSeconds * 1000,
+ ).toISOString();
+ }
+ if (schedule.cron) {
+ const next = nextCronRun(schedule.cron, from, schedule.timezone);
+ return next ? next.toISOString() : null;
+ }
+ return null;
+}
diff --git a/src/backend/automations/docker-watcher.ts b/src/backend/automations/docker-watcher.ts
new file mode 100644
index 0000000..1626faa
--- /dev/null
+++ b/src/backend/automations/docker-watcher.ts
@@ -0,0 +1,238 @@
+import type { AutomationDefinition } from "../../types/automations.js";
+import { createCurrentAutomationRepository } from "../database/repositories/factory.js";
+import { resolveHostById } from "../hosts/host-resolver.js";
+import { DataCrypto } from "../utils/data-crypto.js";
+import { execCommand } from "../hosts/metrics/widgets/common-utils.js";
+import {
+ createFleetSshFactory,
+ getFleetPoolKey,
+} from "../hosts/ssh-client-factory.js";
+import { withConnection } from "../hosts/ssh-connection-pool.js";
+import { statsLogger } from "../utils/logger.js";
+import { onDockerEvent } from "./triggers.js";
+
+/**
+ * Container state polling for docker_event triggers.
+ *
+ * Everything else Docker-related in the backend hangs off an interactive
+ * session that only exists while somebody has the UI open, so a trigger built
+ * on it would only ever fire while being watched. This polls over the same
+ * pooled SSH connection the other automation steps use, and only for hosts a
+ * docker_event trigger actually names, so an install with no such automation
+ * does no extra work at all.
+ *
+ * Events are derived by diffing successive snapshots: the poll interval is the
+ * resolution, so a container that stops and starts between two polls is not
+ * reported. That is the tradeoff for not holding a `docker events` stream open
+ * against every host.
+ */
+
+const POLL_INTERVAL_MS = 60_000;
+const EXEC_TIMEOUT_MS = 15_000;
+
+interface ContainerState {
+ /** Docker's own state word: running, exited, restarting, ... */
+ state: string;
+ /** Health from the status text, when the image declares a healthcheck. */
+ unhealthy: boolean;
+}
+
+/** Last snapshot per host, so transitions can be spotted. */
+const snapshots = new Map>();
+const lastPolledAt = new Map();
+
+/** Hosts named by an enabled docker_event trigger, with the owning user. */
+export async function listDockerWatchedHosts(): Promise> {
+ const watched = new Map();
+
+ try {
+ const rows = await createCurrentAutomationRepository().listAllEnabled();
+ for (const row of rows) {
+ let definition: AutomationDefinition;
+ try {
+ definition = JSON.parse(row.definition) as AutomationDefinition;
+ } catch {
+ continue;
+ }
+
+ const trigger = definition.trigger;
+ if (trigger?.kind !== "docker_event") continue;
+
+ const selector = trigger.hostSelector;
+ if (selector?.kind === "host") {
+ watched.set(selector.hostId, row.userId);
+ } else if (selector?.kind === "hosts") {
+ for (const hostId of selector.hostIds) watched.set(hostId, row.userId);
+ }
+ // Fleet and "all" selectors are deliberately not expanded: polling every
+ // host a user owns for container state is far too costly to do blindly.
+ }
+ } catch {
+ return watched;
+ }
+
+ return watched;
+}
+
+/**
+ * Parses `docker ps -a` output. One JSON object per line, matching the format
+ * string the container routes use.
+ */
+export function parseContainerStates(
+ output: string,
+): Map {
+ const states = new Map();
+
+ for (const line of output.split("\n")) {
+ const trimmed = line.trim();
+ if (!trimmed) continue;
+
+ try {
+ const parsed = JSON.parse(trimmed) as {
+ name?: string;
+ state?: string;
+ status?: string;
+ };
+ if (!parsed.name) continue;
+
+ states.set(parsed.name, {
+ state: (parsed.state ?? "").toLowerCase(),
+ unhealthy: /\(unhealthy\)/i.test(parsed.status ?? ""),
+ });
+ } catch {
+ // A partial line is not worth failing the whole poll over.
+ }
+ }
+
+ return states;
+}
+
+/**
+ * Works out which events a pair of snapshots implies.
+ *
+ * A container missing from the previous snapshot is treated as newly seen
+ * rather than started, so the first poll after a restart does not replay every
+ * running container as a fresh start event.
+ */
+export function diffContainerStates(
+ previous: Map,
+ current: Map,
+): Array<{ container: string; event: DockerEventName }> {
+ const events: Array<{ container: string; event: DockerEventName }> = [];
+
+ for (const [name, now] of current) {
+ const before = previous.get(name);
+ if (!before) continue;
+
+ if (before.state !== now.state) {
+ if (now.state === "exited")
+ events.push({ container: name, event: "exited" });
+ else if (now.state === "running")
+ events.push({ container: name, event: "started" });
+ else if (now.state === "restarting")
+ events.push({ container: name, event: "restarting" });
+ }
+
+ // Health is independent of state: a container can go unhealthy while it
+ // stays up, which is exactly the case worth alerting on.
+ if (!before.unhealthy && now.unhealthy) {
+ events.push({ container: name, event: "unhealthy" });
+ }
+ }
+
+ return events;
+}
+
+export type DockerEventName = "exited" | "started" | "unhealthy" | "restarting";
+
+const PS_FORMAT = `'{"name":"{{.Names}}","state":"{{.State}}","status":"{{.Status}}"}'`;
+
+async function pollHost(hostId: number, userId: string): Promise {
+ const host = await resolveHostById(hostId, userId);
+ if (!host) {
+ snapshots.delete(hostId);
+ return;
+ }
+
+ const result = await withConnection(
+ getFleetPoolKey(host as never),
+ createFleetSshFactory(host as never),
+ (client) =>
+ execCommand(
+ client,
+ `docker ps -a --format ${PS_FORMAT}`,
+ EXEC_TIMEOUT_MS,
+ ),
+ );
+
+ if (result.code !== 0 && result.code !== null) {
+ // Docker missing or not permitted on this host. Drop the snapshot so a
+ // later success is treated as a first observation rather than a diff.
+ snapshots.delete(hostId);
+ return;
+ }
+
+ const current = parseContainerStates(result.stdout);
+ const previous = snapshots.get(hostId);
+ snapshots.set(hostId, current);
+
+ if (!previous) return;
+
+ for (const { container, event } of diffContainerStates(previous, current)) {
+ await onDockerEvent({
+ hostId,
+ ownerUserId: userId,
+ container,
+ event,
+ }).catch(() => undefined);
+ }
+}
+
+/**
+ * Polls every watched host whose interval has elapsed. Called from the
+ * automation scheduler tick rather than owning a timer of its own.
+ */
+export async function pollDockerEvents(
+ now: number = Date.now(),
+): Promise {
+ const watched = await listDockerWatchedHosts();
+
+ for (const hostId of [...snapshots.keys()]) {
+ if (!watched.has(hostId)) {
+ snapshots.delete(hostId);
+ lastPolledAt.delete(hostId);
+ }
+ }
+
+ for (const [hostId, userId] of watched) {
+ const last = lastPolledAt.get(hostId) ?? 0;
+ if (now - last < POLL_INTERVAL_MS) continue;
+ // Host credentials cannot be decrypted while the owner's key is locked.
+ if (!canAccess(userId)) continue;
+ lastPolledAt.set(hostId, now);
+
+ try {
+ await pollHost(hostId, userId);
+ } catch (error) {
+ statsLogger.warn("Docker event poll failed", {
+ operation: "automation_docker_poll_error",
+ hostId,
+ error: error instanceof Error ? error.message : String(error),
+ });
+ }
+ }
+}
+
+function canAccess(userId: string): boolean {
+ try {
+ return DataCrypto.canUserAccessData(userId);
+ } catch {
+ return false;
+ }
+}
+
+/** Clears cached state, for shutdown and tests. */
+export function resetDockerWatcher(): void {
+ snapshots.clear();
+ lastPolledAt.clear();
+}
diff --git a/src/backend/automations/engine.ts b/src/backend/automations/engine.ts
new file mode 100644
index 0000000..813a2cf
--- /dev/null
+++ b/src/backend/automations/engine.ts
@@ -0,0 +1,422 @@
+import type {
+ AutomationDefinition,
+ RunStatus,
+ Step,
+} from "../../types/automations.js";
+import {
+ DEFAULT_MAX_RUN_SECONDS,
+ MAX_AUTOMATION_DEPTH,
+ MAX_STEP_OUTPUT_BYTES,
+} from "../../types/automations.js";
+import { createCurrentAutomationRepository } from "../database/repositories/factory.js";
+import { statsLogger } from "../utils/logger.js";
+import { executeStep } from "./actions/index.js";
+import type { StepExecutionContext, StepResult } from "./actions/types.js";
+import { compare } from "./conditions.js";
+import { renderTemplate, type TemplateContext } from "./template.js";
+
+export interface RunRequest {
+ automationId: number;
+ triggerType: string;
+ triggerContext?: Record;
+ triggerHostId?: number;
+ /** Overrides the automation's own dry-run flag, for "test run". */
+ dryRun?: boolean;
+ parentRunId?: number;
+ ancestry?: number[];
+ depth?: number;
+}
+
+export interface RunOutcome {
+ runId: number | null;
+ status: RunStatus;
+ error?: string;
+}
+
+/**
+ * Executes automations.
+ *
+ * Both HTTP handlers and the metrics hooks live in this same process, so this
+ * is a plain singleton rather than anything cross-process. State that has to
+ * survive a restart (cooldowns, dwell windows) lives in the database; the only
+ * thing held in memory is the set of runs currently in flight, which is
+ * meaningless after a restart anyway.
+ */
+export class AutomationEngine {
+ private static instance: AutomationEngine;
+
+ private readonly running = new Set();
+ private readonly queued = new Map();
+
+ static getInstance(): AutomationEngine {
+ if (!AutomationEngine.instance) {
+ AutomationEngine.instance = new AutomationEngine();
+ }
+ return AutomationEngine.instance;
+ }
+
+ isRunning(automationId: number): boolean {
+ return this.running.has(automationId);
+ }
+
+ async run(request: RunRequest): Promise {
+ const repository = createCurrentAutomationRepository();
+ const automation = await repository.findById(request.automationId);
+
+ if (!automation) {
+ return { runId: null, status: "failed", error: "Automation not found" };
+ }
+
+ const depth = request.depth ?? 0;
+ const ancestry = request.ancestry ?? [];
+
+ // Refuse recursion before anything is recorded, so a cycle cannot spin.
+ if (depth > MAX_AUTOMATION_DEPTH) {
+ return {
+ runId: null,
+ status: "failed",
+ error: `Maximum automation depth of ${MAX_AUTOMATION_DEPTH} exceeded`,
+ };
+ }
+ if (ancestry.includes(automation.id)) {
+ return {
+ runId: null,
+ status: "failed",
+ error: `Automation ${automation.id} is already running in this chain`,
+ };
+ }
+
+ let definition: AutomationDefinition;
+ try {
+ definition = JSON.parse(automation.definition) as AutomationDefinition;
+ } catch {
+ return {
+ runId: null,
+ status: "failed",
+ error: "Automation definition is not valid JSON",
+ };
+ }
+
+ // A second trigger while a run is in flight is recorded as skipped rather
+ // than dropped silently, so the history explains what happened.
+ //
+ // The slot has to be claimed in the same tick as the check. It used to be
+ // claimed several awaits later, so two triggers arriving together both
+ // passed this test and both ran.
+ let claimed = false;
+ if (this.running.has(automation.id)) {
+ const policy = automation.concurrencyPolicy;
+ if (policy === "skip") {
+ const run = await repository.createRun({
+ automationId: automation.id,
+ userId: automation.userId,
+ triggerType: request.triggerType,
+ triggerContext: JSON.stringify(request.triggerContext ?? {}),
+ status: "skipped",
+ });
+ await repository.finishRun(run.id, {
+ status: "skipped",
+ error: "A previous run was still in progress",
+ durationMs: 0,
+ });
+ return { runId: run.id, status: "skipped" };
+ }
+ if (policy === "queue") {
+ const depthNow = this.queued.get(automation.id) ?? 0;
+ if (depthNow >= 5) {
+ return { runId: null, status: "skipped", error: "Queue is full" };
+ }
+ this.queued.set(automation.id, depthNow + 1);
+ try {
+ await this.waitUntilFree(automation.id);
+ } finally {
+ this.queued.set(
+ automation.id,
+ (this.queued.get(automation.id) ?? 1) - 1,
+ );
+ }
+ // waitUntilFree gives up on its own deadline, so the slot may still be
+ // taken. Only claim it when it is genuinely free.
+ if (!this.running.has(automation.id)) {
+ this.running.add(automation.id);
+ claimed = true;
+ }
+ }
+ } else {
+ this.running.add(automation.id);
+ claimed = true;
+ }
+
+ const dryRun = request.dryRun ?? automation.dryRun;
+ const maxRunSeconds = automation.maxRunSeconds || DEFAULT_MAX_RUN_SECONDS;
+ const startedAt = Date.now();
+
+ let run: { id: number };
+ try {
+ run = await repository.createRun({
+ automationId: automation.id,
+ userId: automation.userId,
+ triggerType: request.triggerType,
+ triggerContext: JSON.stringify(request.triggerContext ?? {}),
+ status: "running",
+ dryRun,
+ parentRunId: request.parentRunId ?? null,
+ });
+ } catch (err) {
+ // The slot is already claimed at this point, so it has to be given back
+ // here; the finally below is only reached once a run row exists.
+ if (claimed) this.running.delete(automation.id);
+ return {
+ runId: null,
+ status: "failed",
+ error: err instanceof Error ? err.message : String(err),
+ };
+ }
+
+ if (!claimed) this.running.add(automation.id);
+
+ const template: TemplateContext = {
+ trigger: request.triggerContext ?? {},
+ steps: {},
+ vars: {},
+ run: {
+ id: run.id,
+ automationId: automation.id,
+ startedAt: new Date(startedAt).toISOString(),
+ },
+ };
+
+ const context: StepExecutionContext = {
+ userId: automation.userId,
+ automationId: automation.id,
+ runId: run.id,
+ dryRun,
+ template,
+ triggerHostId: request.triggerHostId,
+ ancestry: [...ancestry, automation.id],
+ depth,
+ deadlineAt: startedAt + maxRunSeconds * 1000,
+ };
+
+ let status: RunStatus = "success";
+ let error: string | undefined;
+
+ try {
+ const result = await this.runSteps(definition.steps ?? [], context, {
+ index: 0,
+ });
+ if (result.halted?.status === "failed") {
+ status = "failed";
+ error = "Stopped by a stop step";
+ } else if (result.failed) {
+ status = "failed";
+ error = result.error;
+ }
+ if (Date.now() >= context.deadlineAt) {
+ status = "timeout";
+ error = `Run exceeded ${maxRunSeconds}s`;
+ }
+ } catch (err) {
+ status = "failed";
+ error = err instanceof Error ? err.message : String(err);
+ } finally {
+ this.running.delete(automation.id);
+ }
+
+ await repository.finishRun(run.id, {
+ status,
+ error: error ?? null,
+ durationMs: Date.now() - startedAt,
+ });
+
+ if (status === "failed") {
+ statsLogger.warn(`Automation "${automation.name}" failed`, {
+ operation: "automation_run_failed",
+ automationId: automation.id,
+ runId: run.id,
+ error,
+ });
+
+ // An automation_failed handler that itself fails must not re-announce
+ // its own failure, so the event is not emitted for runs that this event
+ // already started.
+ if (request.triggerType !== "internal_event") {
+ import("../hosts/metrics/automation-bridge.js")
+ .then(({ notifyAutomationInternalEvent }) =>
+ notifyAutomationInternalEvent(
+ "automation_failed",
+ automation.userId,
+ undefined,
+ {
+ automationId: automation.id,
+ automationName: automation.name,
+ runId: run.id,
+ error: error ?? null,
+ },
+ ),
+ )
+ .catch(() => undefined);
+ }
+ }
+
+ return { runId: run.id, status, error };
+ }
+
+ /**
+ * Runs a list of steps in order, descending into if/else. Returns as soon as
+ * a stop step halts the run or a failing step's policy says to stop.
+ */
+ private async runSteps(
+ steps: Step[],
+ context: StepExecutionContext,
+ cursor: { index: number },
+ ): Promise<{
+ failed: boolean;
+ error?: string;
+ halted?: { status: "success" | "failed" };
+ }> {
+ const repository = createCurrentAutomationRepository();
+
+ for (const step of steps) {
+ if (step.enabled === false) continue;
+
+ if (Date.now() >= context.deadlineAt) {
+ return { failed: true, error: "Run deadline exceeded" };
+ }
+
+ const stepIndex = cursor.index++;
+
+ if (step.type === "if") {
+ const left = renderTemplate(step.condition.left, context.template);
+ const right = renderTemplate(
+ step.condition.right ?? "",
+ context.template,
+ );
+ const matched = compare(left, step.condition.operator, right);
+
+ const rowId = await repository.createRunStep({
+ runId: context.runId,
+ stepIndex,
+ stepId: step.id,
+ stepType: "if",
+ status: "running",
+ });
+ await repository.finishRunStep(rowId, {
+ status: "success",
+ output: `Condition ${matched ? "matched" : "did not match"}: ${left} ${step.condition.operator} ${right}`,
+ });
+
+ const branch = matched ? step.then : (step.else ?? []);
+ const result = await this.runSteps(branch, context, cursor);
+ if (result.halted) return result;
+ if (result.failed) return result;
+ continue;
+ }
+
+ if (step.type === "run_automation") {
+ const rowId = await repository.createRunStep({
+ runId: context.runId,
+ stepIndex,
+ stepId: step.id,
+ stepType: step.type,
+ status: "running",
+ });
+
+ const nested = await this.run({
+ automationId: step.automationId,
+ triggerType: "run_automation",
+ triggerContext: { parentAutomationId: context.automationId },
+ triggerHostId: context.triggerHostId,
+ dryRun: context.dryRun,
+ parentRunId: context.runId,
+ ancestry: context.ancestry,
+ depth: context.depth + 1,
+ });
+
+ const nestedOk = nested.status === "success";
+ await repository.finishRunStep(rowId, {
+ status: nestedOk ? "success" : "failed",
+ output: `Nested run ${nested.runId ?? "not started"}: ${nested.status}`,
+ error: nested.error ?? null,
+ });
+
+ if (!nestedOk && (step.onError ?? "stop") === "stop") {
+ return { failed: true, error: nested.error ?? "Nested run failed" };
+ }
+ continue;
+ }
+
+ const rowId = await repository.createRunStep({
+ runId: context.runId,
+ stepIndex,
+ stepId: step.id,
+ stepType: step.type,
+ status: "running",
+ });
+
+ let result: StepResult;
+ try {
+ result = await executeStep(step, context);
+ } catch (err) {
+ result = {
+ success: false,
+ error: err instanceof Error ? err.message : String(err),
+ };
+ }
+
+ const { text, truncated } = truncate(result.output);
+ await repository.finishRunStep(rowId, {
+ status: result.success ? "success" : "failed",
+ output: text,
+ error: result.error ?? null,
+ truncated,
+ });
+
+ // Later steps read earlier output through {{steps..stdout}}.
+ context.template.steps = {
+ ...context.template.steps,
+ [step.id]: {
+ stdout: result.output ?? "",
+ code: result.success ? 0 : 1,
+ },
+ };
+ if (result.vars) {
+ context.template.vars = { ...context.template.vars, ...result.vars };
+ }
+
+ if (result.halt) return { failed: false, halted: result.halt };
+
+ if (!result.success) {
+ const policy = step.onError ?? "stop";
+ if (policy === "stop") {
+ return { failed: true, error: result.error };
+ }
+ }
+ }
+
+ return { failed: false };
+ }
+
+ private async waitUntilFree(automationId: number): Promise {
+ const started = Date.now();
+ while (this.running.has(automationId)) {
+ if (Date.now() - started > 60_000) return;
+ await new Promise((resolve) => setTimeout(resolve, 250));
+ }
+ }
+}
+
+/** Keeps a single step's output from bloating the database. */
+function truncate(output: string | undefined): {
+ text: string | null;
+ truncated: boolean;
+} {
+ if (!output) return { text: null, truncated: false };
+ if (Buffer.byteLength(output, "utf8") <= MAX_STEP_OUTPUT_BYTES) {
+ return { text: output, truncated: false };
+ }
+ return {
+ text: output.slice(0, MAX_STEP_OUTPUT_BYTES) + "\n... (truncated)",
+ truncated: true,
+ };
+}
diff --git a/src/backend/automations/headless-viewer.ts b/src/backend/automations/headless-viewer.ts
new file mode 100644
index 0000000..8123aff
--- /dev/null
+++ b/src/backend/automations/headless-viewer.ts
@@ -0,0 +1,105 @@
+import { statsLogger } from "../utils/logger.js";
+import { listAutomationWatchedHosts } from "./triggers.js";
+
+/**
+ * Keeps metric collection running for hosts an automation watches.
+ *
+ * Heavy metric collection is normally started by a UI viewer and stops when
+ * the last one leaves, which means threshold rules only ever evaluated while
+ * somebody had the host open. Automations register a synthetic viewer instead
+ * of bypassing that mechanism, so a real viewer arriving or leaving still
+ * behaves exactly as before.
+ *
+ * The catch is `cleanupInactiveViewers`, which drops any viewer whose
+ * heartbeat is older than 120s. Without the heartbeat below, headless polling
+ * would quietly stop two minutes after it started.
+ */
+
+export interface ViewerRegistry {
+ registerViewer(hostId: number, sessionId: string, userId: string): void;
+ unregisterViewer(hostId: number, sessionId: string): void;
+ updateHeartbeat(sessionId: string): boolean;
+}
+
+const SESSION_PREFIX = "automation:";
+
+let registry: ViewerRegistry | null = null;
+const registered = new Map();
+
+export function setViewerRegistry(next: ViewerRegistry | null): void {
+ registry = next;
+}
+
+export function automationSessionId(hostId: number): string {
+ return `${SESSION_PREFIX}${hostId}`;
+}
+
+/**
+ * Brings the set of synthetic viewers in line with what the enabled
+ * automations currently watch, and heartbeats the ones that stay.
+ */
+export async function reconcileHeadlessViewers(): Promise<{
+ added: number;
+ removed: number;
+ active: number;
+}> {
+ if (!registry) return { added: 0, removed: 0, active: 0 };
+
+ let watched: Map;
+ try {
+ watched = await listAutomationWatchedHosts();
+ } catch {
+ return { added: 0, removed: 0, active: registered.size };
+ }
+
+ let added = 0;
+ let removed = 0;
+
+ for (const [hostId, userId] of watched) {
+ const sessionId = automationSessionId(hostId);
+ if (registered.has(hostId)) {
+ // Refresh before the 120s reaper would take it.
+ registry.updateHeartbeat(sessionId);
+ continue;
+ }
+
+ try {
+ registry.registerViewer(hostId, sessionId, userId);
+ registered.set(hostId, userId);
+ added++;
+ } catch (error) {
+ statsLogger.warn("Could not start headless metrics for a host", {
+ operation: "automation_headless_register_error",
+ hostId,
+ error: error instanceof Error ? error.message : String(error),
+ });
+ }
+ }
+
+ for (const hostId of [...registered.keys()]) {
+ if (watched.has(hostId)) continue;
+ try {
+ registry.unregisterViewer(hostId, automationSessionId(hostId));
+ } catch {
+ // Already gone; drop it either way.
+ }
+ registered.delete(hostId);
+ removed++;
+ }
+
+ return { added, removed, active: registered.size };
+}
+
+/** Drops every synthetic viewer, for shutdown and tests. */
+export function releaseHeadlessViewers(): void {
+ if (registry) {
+ for (const hostId of registered.keys()) {
+ try {
+ registry.unregisterViewer(hostId, automationSessionId(hostId));
+ } catch {
+ // Nothing useful to do during teardown.
+ }
+ }
+ }
+ registered.clear();
+}
diff --git a/src/backend/automations/http.ts b/src/backend/automations/http.ts
new file mode 100644
index 0000000..db06951
--- /dev/null
+++ b/src/backend/automations/http.ts
@@ -0,0 +1,77 @@
+import { safeOutboundFetch } from "../utils/safe-outbound-fetch.js";
+
+/**
+ * Outbound HTTP for automation steps and notification channels.
+ *
+ * safeOutboundFetch refuses private and loopback addresses, which is the right
+ * default against SSRF but also blocks the self-hosted ntfy or Gotify sitting
+ * on a LAN that many installs actually use. Rather than weaken the guard
+ * globally, a destination can opt in explicitly; everything else about the
+ * guard (scheme, embedded credentials, no redirects) still applies.
+ */
+export interface AutomationFetchOptions {
+ method?: string;
+ headers?: Record;
+ body?: string;
+ allowPrivateNetwork?: boolean;
+ timeoutMs?: number;
+}
+
+export async function automationFetch(
+ url: string,
+ options: AutomationFetchOptions = {},
+): Promise {
+ const {
+ method = "GET",
+ headers,
+ body,
+ allowPrivateNetwork,
+ timeoutMs = 30_000,
+ } = options;
+
+ const controller = new AbortController();
+ const timer = setTimeout(() => controller.abort(), Math.max(timeoutMs, 1));
+
+ const init: RequestInit = {
+ method,
+ headers: body
+ ? { "Content-Type": "application/json", ...(headers ?? {}) }
+ : headers,
+ body,
+ signal: controller.signal,
+ };
+
+ try {
+ if (allowPrivateNetwork) {
+ return await privateNetworkFetch(url, init);
+ }
+ return await safeOutboundFetch(url, init);
+ } finally {
+ clearTimeout(timer);
+ }
+}
+
+/**
+ * The opt-in path. Keeps the parts of the guard that are always right and
+ * drops only the address blocklist.
+ */
+async function privateNetworkFetch(
+ rawUrl: string,
+ init: RequestInit,
+): Promise {
+ let parsed: URL;
+ try {
+ parsed = new URL(rawUrl);
+ } catch {
+ throw new Error("Invalid URL");
+ }
+
+ if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+ throw new Error("Only http and https URLs are allowed");
+ }
+ if (parsed.username || parsed.password) {
+ throw new Error("URLs with embedded credentials are not allowed");
+ }
+
+ return fetch(rawUrl, { ...init, redirect: "error" });
+}
diff --git a/src/backend/automations/notify.ts b/src/backend/automations/notify.ts
new file mode 100644
index 0000000..ce44625
--- /dev/null
+++ b/src/backend/automations/notify.ts
@@ -0,0 +1,183 @@
+import { statsLogger } from "../utils/logger.js";
+import { automationFetch } from "./http.js";
+import type { TemplateContext } from "./template.js";
+
+/**
+ * Notification delivery for automations.
+ *
+ * The alert engine special-cased Discord because its dispatcher only knew
+ * webhook and ntfy; here every transport goes through one switch, so adding a
+ * channel type is a single edit.
+ */
+export interface AutomationChannel {
+ id: number;
+ type: string;
+ config: string;
+}
+
+export interface AutomationNotification {
+ title: string;
+ body: string;
+ severity: "info" | "warning" | "critical";
+ context?: TemplateContext;
+}
+
+const NTFY_PRIORITY: Record = {
+ info: 2,
+ warning: 3,
+ critical: 5,
+};
+
+const NTFY_TAGS: Record = {
+ info: "information_source",
+ warning: "warning",
+ critical: "rotating_light",
+};
+
+const DISCORD_COLORS: Record = {
+ info: 3066993,
+ warning: 16753920,
+ critical: 15158332,
+};
+
+export async function sendAutomationNotification(
+ channel: AutomationChannel,
+ notification: AutomationNotification,
+): Promise {
+ let config: Record;
+ try {
+ config = JSON.parse(channel.config) as Record;
+ } catch {
+ throw new Error("Channel configuration is not valid JSON");
+ }
+
+ const allowPrivateNetwork = config.allowPrivateNetwork === true;
+
+ switch (channel.type) {
+ case "webhook":
+ return sendWebhook(config, notification, allowPrivateNetwork);
+ case "ntfy":
+ return sendNtfy(config, notification, allowPrivateNetwork);
+ case "discord":
+ return sendDiscord(config, notification, allowPrivateNetwork);
+ default:
+ throw new Error(`Unsupported channel type: ${channel.type}`);
+ }
+}
+
+function requireUrl(config: Record): string {
+ const url = typeof config.url === "string" ? config.url.trim() : "";
+ if (!url) throw new Error("Channel is missing a URL");
+ return url;
+}
+
+async function sendWebhook(
+ config: Record,
+ notification: AutomationNotification,
+ allowPrivateNetwork: boolean,
+): Promise {
+ const url = requireUrl(config);
+ const method = config.method === "PUT" ? "PUT" : "POST";
+ const headers =
+ config.headers && typeof config.headers === "object"
+ ? (config.headers as Record)
+ : {};
+
+ const response = await automationFetch(url, {
+ method,
+ headers,
+ body: JSON.stringify({
+ title: notification.title,
+ message: notification.body,
+ severity: notification.severity,
+ timestamp: new Date().toISOString(),
+ }),
+ allowPrivateNetwork,
+ });
+
+ if (!response.ok) {
+ throw new Error(`HTTP ${response.status} ${response.statusText}`);
+ }
+}
+
+async function sendNtfy(
+ config: Record,
+ notification: AutomationNotification,
+ allowPrivateNetwork: boolean,
+): Promise {
+ const base = requireUrl(config).replace(/\/$/, "");
+ const topic = typeof config.topic === "string" ? config.topic.trim() : "";
+ if (!topic) throw new Error("ntfy channel is missing a topic");
+
+ const headers: Record = {
+ Title: notification.title || "Termix automation",
+ Priority: String(NTFY_PRIORITY[notification.severity] ?? 3),
+ Tags: NTFY_TAGS[notification.severity] ?? "information_source",
+ };
+ if (typeof config.token === "string" && config.token) {
+ headers.Authorization = `Bearer ${config.token}`;
+ }
+
+ const response = await automationFetch(`${base}/${topic}`, {
+ method: "POST",
+ headers,
+ body: notification.body || notification.title,
+ allowPrivateNetwork,
+ });
+
+ if (!response.ok) {
+ throw new Error(`HTTP ${response.status} ${response.statusText}`);
+ }
+}
+
+async function sendDiscord(
+ config: Record,
+ notification: AutomationNotification,
+ allowPrivateNetwork: boolean,
+): Promise {
+ const url = requireUrl(config);
+ const payload: Record = {
+ embeds: [
+ {
+ title: notification.title || "Termix automation",
+ description: notification.body || undefined,
+ color: DISCORD_COLORS[notification.severity] ?? 3447003,
+ timestamp: new Date().toISOString(),
+ },
+ ],
+ };
+ if (typeof config.username === "string" && config.username) {
+ payload.username = config.username;
+ }
+ if (typeof config.avatar_url === "string" && config.avatar_url) {
+ payload.avatar_url = config.avatar_url;
+ }
+
+ const response = await automationFetch(url, {
+ method: "POST",
+ body: JSON.stringify(payload),
+ allowPrivateNetwork,
+ });
+
+ if (!response.ok) {
+ const detail = await response.text().catch(() => "");
+ throw new Error(
+ `HTTP ${response.status} ${response.statusText}${detail ? `: ${detail}` : ""}`,
+ );
+ }
+}
+
+/** Fire-and-forget wrapper for callers that must not block on delivery. */
+export function sendAutomationNotificationSafely(
+ channel: AutomationChannel,
+ notification: AutomationNotification,
+): void {
+ sendAutomationNotification(channel, notification).catch((error) => {
+ statsLogger.warn("Automation notification failed", {
+ operation: "automation_notification_error",
+ channelId: channel.id,
+ type: channel.type,
+ error: error instanceof Error ? error.message : String(error),
+ });
+ });
+}
diff --git a/src/backend/automations/scheduler.ts b/src/backend/automations/scheduler.ts
new file mode 100644
index 0000000..2b2cc94
--- /dev/null
+++ b/src/backend/automations/scheduler.ts
@@ -0,0 +1,207 @@
+import type { AutomationDefinition } from "../../types/automations.js";
+import { createCurrentAutomationRepository } from "../database/repositories/factory.js";
+import { DataCrypto } from "../utils/data-crypto.js";
+import { statsLogger } from "../utils/logger.js";
+import { computeNextDueAt } from "./cron.js";
+import { hasDwelled, isCoolingDown } from "./conditions.js";
+import { pollDockerEvents } from "./docker-watcher.js";
+import { AutomationEngine } from "./engine.js";
+import { reconcileHeadlessViewers } from "./headless-viewer.js";
+
+/**
+ * The one timer the automations feature owns.
+ *
+ * Every other periodic job in the backend is its own module-level setInterval;
+ * this deliberately is not one per automation. A single tick handles due
+ * schedules, dwell windows that need re-checking without a fresh sample, the
+ * synthetic viewer heartbeat, and history pruning.
+ */
+
+const TICK_MS = 15_000;
+const STARTUP_DELAY_MS = 30_000;
+const PRUNE_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const RUN_RETENTION_DAYS = 30;
+/** A "running" row older than this belongs to a process that is gone. */
+const STALE_RUN_MS = 6 * 60 * 60 * 1000;
+
+let tickTimer: NodeJS.Timeout | null = null;
+let startupTimer: NodeJS.Timeout | null = null;
+let lastPruneAt = 0;
+let ticking = false;
+
+export function startAutomationScheduler(): void {
+ if (tickTimer) return;
+
+ startupTimer = setTimeout(() => {
+ void tick();
+ }, STARTUP_DELAY_MS);
+ startupTimer.unref?.();
+
+ tickTimer = setInterval(() => {
+ void tick();
+ }, TICK_MS);
+ tickTimer.unref?.();
+}
+
+export function stopAutomationScheduler(): void {
+ if (tickTimer) clearInterval(tickTimer);
+ if (startupTimer) clearTimeout(startupTimer);
+ tickTimer = null;
+ startupTimer = null;
+}
+
+/** Exposed for tests; the interval calls this. */
+export async function tick(now: Date = new Date()): Promise {
+ // A slow tick must not overlap the next one.
+ if (ticking) return;
+ ticking = true;
+
+ try {
+ await reconcileHeadlessViewers().catch(() => undefined);
+ await runDueSchedules(now);
+ await recheckOpenBreaches(now);
+ await pollDockerEvents(now.getTime()).catch(() => undefined);
+ await pruneIfDue(now);
+ } catch (error) {
+ statsLogger.warn("Automation scheduler tick failed", {
+ operation: "automation_scheduler_tick_error",
+ error: error instanceof Error ? error.message : String(error),
+ });
+ } finally {
+ ticking = false;
+ }
+}
+
+async function runDueSchedules(now: Date): Promise {
+ const repository = createCurrentAutomationRepository();
+ const due = await repository.listDueSchedules(now.toISOString());
+
+ for (const schedule of due) {
+ const automation = await repository.findById(schedule.automationId);
+ if (!automation) continue;
+
+ // Background work can only touch a user's data while their key resolves.
+ if (!canAccess(automation.userId)) {
+ statsLogger.warn("Skipping scheduled automation: data key unavailable", {
+ operation: "automation_schedule_locked",
+ automationId: automation.id,
+ });
+ continue;
+ }
+
+ const nextDueAt = computeNextDueAt(
+ {
+ cron: schedule.cron,
+ intervalSeconds: schedule.intervalSeconds,
+ timezone: schedule.timezone,
+ },
+ now,
+ );
+ await repository.markScheduleTicked(
+ schedule.automationId,
+ nextDueAt,
+ now.toISOString(),
+ );
+
+ AutomationEngine.getInstance()
+ .run({
+ automationId: schedule.automationId,
+ triggerType: "schedule",
+ triggerContext: { scheduledFor: now.toISOString() },
+ })
+ .catch((error) => {
+ statsLogger.warn("Scheduled automation failed to start", {
+ operation: "automation_schedule_error",
+ automationId: schedule.automationId,
+ error: error instanceof Error ? error.message : String(error),
+ });
+ });
+ }
+}
+
+/**
+ * Fires sustained breaches whose window has elapsed.
+ *
+ * Without this a dwell window only completes when another sample happens to
+ * arrive, so a breach that starts just before polling stops would never fire.
+ */
+async function recheckOpenBreaches(now: Date): Promise {
+ const repository = createCurrentAutomationRepository();
+ const open = await repository.listOpenBreaches();
+ const nowMs = now.getTime();
+
+ for (const state of open) {
+ const automation = await repository.findById(state.automationId);
+ if (!automation || !automation.enabled) continue;
+ if (!canAccess(automation.userId)) continue;
+
+ let definition: AutomationDefinition;
+ try {
+ definition = JSON.parse(automation.definition) as AutomationDefinition;
+ } catch {
+ continue;
+ }
+
+ const trigger = definition.trigger;
+ if (trigger?.kind !== "metric_threshold") continue;
+ if (!trigger.forSeconds) continue;
+ if (!hasDwelled(state.breachStartedAt, trigger.forSeconds, nowMs)) continue;
+ if (isCoolingDown(state.lastFiredAt, trigger.cooldownMinutes, nowMs)) {
+ continue;
+ }
+
+ const hostId = Number(state.stateKey.split(":")[0]);
+ await repository.upsertTriggerState({
+ automationId: automation.id,
+ stateKey: state.stateKey,
+ lastFiredAt: now.toISOString(),
+ });
+
+ AutomationEngine.getInstance()
+ .run({
+ automationId: automation.id,
+ triggerType: "metric_threshold",
+ triggerContext: {
+ hostId,
+ value: state.lastValue,
+ threshold: trigger.value,
+ metric: trigger.metric.path,
+ sustained: true,
+ },
+ triggerHostId: Number.isFinite(hostId) ? hostId : undefined,
+ })
+ .catch(() => undefined);
+ }
+}
+
+async function pruneIfDue(now: Date): Promise {
+ if (now.getTime() - lastPruneAt < PRUNE_INTERVAL_MS) return;
+ lastPruneAt = now.getTime();
+
+ const repository = createCurrentAutomationRepository();
+ try {
+ await repository.failStaleRunningRuns(
+ new Date(now.getTime() - STALE_RUN_MS).toISOString(),
+ );
+ const deleted = await repository.pruneRunsOlderThan(RUN_RETENTION_DAYS);
+ if (deleted > 0) {
+ statsLogger.info(`Pruned ${deleted} old automation run(s)`, {
+ operation: "automation_run_prune",
+ deleted,
+ });
+ }
+ } catch (error) {
+ statsLogger.warn("Automation run pruning failed", {
+ operation: "automation_run_prune_error",
+ error: error instanceof Error ? error.message : String(error),
+ });
+ }
+}
+
+function canAccess(userId: string): boolean {
+ try {
+ return DataCrypto.canUserAccessData(userId);
+ } catch {
+ return false;
+ }
+}
diff --git a/src/backend/automations/template.ts b/src/backend/automations/template.ts
new file mode 100644
index 0000000..9efc86a
--- /dev/null
+++ b/src/backend/automations/template.ts
@@ -0,0 +1,101 @@
+/**
+ * Variable substitution for automation steps.
+ *
+ * Templates read from the run context: {{host.name}}, {{trigger.value}},
+ * {{steps..stdout}}, {{vars.myVar}}. Resolution always produces a
+ * plain string and never shell syntax; callers that build a command are
+ * responsible for quoting the result (see shellSingleQuote in
+ * hosts/metrics/managers/exec-elevated.ts). Nothing here escapes anything,
+ * precisely so there is one obvious place where quoting happens.
+ */
+
+export interface TemplateContext {
+ host?: {
+ id?: number;
+ name?: string;
+ ip?: string;
+ username?: string;
+ port?: number;
+ };
+ trigger?: Record;
+ steps?: Record;
+ vars?: Record;
+ run?: { id?: number; automationId?: number; startedAt?: string };
+}
+
+const TOKEN = /\{\{\s*([a-zA-Z0-9_.-]+)\s*\}\}/g;
+
+function readPath(context: TemplateContext, path: string): unknown {
+ const parts = path.split(".");
+ let current: unknown = context;
+
+ for (const part of parts) {
+ if (current === null || current === undefined) return undefined;
+ if (typeof current !== "object") return undefined;
+ current = (current as Record)[part];
+ }
+ return current;
+}
+
+function stringify(value: unknown): string {
+ if (value === null || value === undefined) return "";
+ if (typeof value === "string") return value;
+ if (typeof value === "number" || typeof value === "boolean") {
+ return String(value);
+ }
+ return JSON.stringify(value);
+}
+
+/**
+ * Replaces every {{token}} it can resolve. An unresolvable token is left
+ * as-is so a typo shows up in the run output rather than silently becoming an
+ * empty string, which is the difference between a visible mistake and a
+ * command that quietly does the wrong thing.
+ */
+export function renderTemplate(
+ input: string,
+ context: TemplateContext,
+): string {
+ if (!input || !input.includes("{{")) return input;
+
+ return input.replace(TOKEN, (match, path: string) => {
+ const value = readPath(context, path);
+ return value === undefined ? match : stringify(value);
+ });
+}
+
+/** Renders every string in a flat record, leaving keys untouched. */
+export function renderRecord(
+ input: Record | undefined,
+ context: TemplateContext,
+): Record | undefined {
+ if (!input) return undefined;
+ const output: Record = {};
+ for (const [key, value] of Object.entries(input)) {
+ output[key] = renderTemplate(value, context);
+ }
+ return output;
+}
+
+/** True when a template still has unresolved tokens after rendering. */
+export function hasUnresolvedTokens(rendered: string): boolean {
+ TOKEN.lastIndex = 0;
+ return TOKEN.test(rendered);
+}
+
+const SECRET_KEY = /(authorization|token|password|secret|api[-_]?key|cookie)/i;
+
+/**
+ * Masks values whose key looks like a credential, for anything written to run
+ * history or returned by the API.
+ */
+export function redactSecrets(
+ input: Record | undefined,
+): Record | undefined {
+ if (!input) return undefined;
+ const output: Record = {};
+ for (const [key, value] of Object.entries(input)) {
+ output[key] = SECRET_KEY.test(key) ? "***" : value;
+ }
+ return output;
+}
diff --git a/src/backend/automations/triggers.ts b/src/backend/automations/triggers.ts
new file mode 100644
index 0000000..ed88f55
--- /dev/null
+++ b/src/backend/automations/triggers.ts
@@ -0,0 +1,387 @@
+import type {
+ AutomationDefinition,
+ HostSelector,
+ Trigger,
+} from "../../types/automations.js";
+import { createCurrentAutomationRepository } from "../database/repositories/factory.js";
+import type { AutomationEngineRow } from "../database/repositories/automation-repository.js";
+import { statsLogger } from "../utils/logger.js";
+import {
+ compare,
+ extractMetricValue,
+ hasDwelled,
+ isCoolingDown,
+ metricStateKey,
+ severityForValue,
+ type MetricsSnapshot,
+} from "./conditions.js";
+import { AutomationEngine } from "./engine.js";
+
+/**
+ * Matches events against automation triggers and decides what fires.
+ *
+ * Dwell windows and cooldowns live in automation_trigger_state rather than in
+ * memory, so a restart mid-breach neither loses the window nor re-fires an
+ * alert that already went out.
+ */
+
+export interface MetricEvent {
+ hostId: number;
+ ownerUserId: string;
+ metrics: MetricsSnapshot;
+}
+
+export interface StatusEvent {
+ hostId: number;
+ ownerUserId: string;
+ online: boolean;
+}
+
+export interface HealthEvent {
+ hostId: number;
+ userId: string;
+ checkId: string;
+ ok: boolean;
+ detail?: string;
+}
+
+export interface DockerEvent {
+ hostId: number;
+ ownerUserId: string;
+ container: string;
+ event: "exited" | "started" | "unhealthy" | "restarting";
+}
+
+export interface InternalEvent {
+ event: string;
+ userId: string;
+ hostId?: number;
+ details?: Record;
+}
+
+interface LoadedAutomation {
+ row: AutomationEngineRow;
+ definition: AutomationDefinition;
+}
+
+async function loadEnabledFor(userId: string): Promise {
+ try {
+ const rows =
+ await createCurrentAutomationRepository().listEnabledForUser(userId);
+ const loaded: LoadedAutomation[] = [];
+ for (const row of rows) {
+ try {
+ loaded.push({
+ row,
+ definition: JSON.parse(row.definition) as AutomationDefinition,
+ });
+ } catch {
+ // A malformed definition should not stop the others from evaluating.
+ }
+ }
+ return loaded;
+ } catch {
+ return [];
+ }
+}
+
+/** Whether a selector covers a host. Ownership is checked by the caller. */
+function selectorCoversHost(
+ selector: HostSelector | undefined,
+ hostId: number,
+): boolean {
+ if (!selector) return true;
+ switch (selector.kind) {
+ case "all":
+ case "trigger":
+ return true;
+ case "host":
+ return selector.hostId === hostId;
+ case "hosts":
+ return selector.hostIds.includes(hostId);
+ case "fleet":
+ // Fleet membership is resolved at execution time; evaluate optimistically
+ // so a fleet-scoped trigger still reaches the engine.
+ return true;
+ default:
+ return false;
+ }
+}
+
+async function fire(
+ automation: AutomationEngineRow,
+ stateKey: string,
+ triggerType: string,
+ triggerContext: Record,
+ hostId?: number,
+): Promise {
+ const repository = createCurrentAutomationRepository();
+ await repository.upsertTriggerState({
+ automationId: automation.id,
+ stateKey,
+ lastFiredAt: new Date().toISOString(),
+ });
+
+ AutomationEngine.getInstance()
+ .run({
+ automationId: automation.id,
+ triggerType,
+ triggerContext,
+ triggerHostId: hostId,
+ })
+ .catch((error) => {
+ statsLogger.warn("Automation run failed to start", {
+ operation: "automation_trigger_error",
+ automationId: automation.id,
+ error: error instanceof Error ? error.message : String(error),
+ });
+ });
+}
+
+/**
+ * Metric samples. Called for every polled host, including hosts polled only
+ * because an automation asked for them.
+ */
+export async function onMetrics(event: MetricEvent): Promise {
+ const automations = await loadEnabledFor(event.ownerUserId);
+ const repository = createCurrentAutomationRepository();
+ const now = Date.now();
+
+ for (const { row, definition } of automations) {
+ const trigger = definition.trigger;
+ if (trigger?.kind !== "metric_threshold") continue;
+ if (!selectorCoversHost(trigger.hostSelector, event.hostId)) continue;
+
+ const value = extractMetricValue(event.metrics, trigger.metric);
+ if (value === null) continue;
+
+ const stateKey = metricStateKey(event.hostId, trigger.metric);
+ const state = await repository.getTriggerState(row.id, stateKey);
+ const breaching = compare(value, trigger.operator, trigger.value);
+
+ if (!breaching) {
+ if (state?.breachStartedAt) {
+ await repository.clearBreach(row.id, stateKey);
+ }
+ continue;
+ }
+
+ // Open the dwell window on the first breaching sample.
+ if (!state?.breachStartedAt) {
+ await repository.upsertTriggerState({
+ automationId: row.id,
+ stateKey,
+ breachStartedAt: new Date(now).toISOString(),
+ lastValue: value,
+ });
+ if (trigger.forSeconds) continue;
+ }
+
+ const breachStartedAt =
+ state?.breachStartedAt ?? new Date(now).toISOString();
+ if (!hasDwelled(breachStartedAt, trigger.forSeconds, now)) continue;
+ if (isCoolingDown(state?.lastFiredAt, trigger.cooldownMinutes, now))
+ continue;
+
+ await fire(
+ row,
+ stateKey,
+ "metric_threshold",
+ {
+ hostId: event.hostId,
+ value,
+ threshold: trigger.value,
+ operator: trigger.operator,
+ metric: trigger.metric.path,
+ mount: "mount" in trigger.metric ? trigger.metric.mount : undefined,
+ severity: severityForValue(value, trigger.severity),
+ },
+ event.hostId,
+ );
+ }
+}
+
+/** Host reachability transitions. Only edges fire, never steady state. */
+export async function onStatus(event: StatusEvent): Promise {
+ const automations = await loadEnabledFor(event.ownerUserId);
+ const repository = createCurrentAutomationRepository();
+ const now = Date.now();
+ const observed = event.online ? "online" : "offline";
+
+ for (const { row, definition } of automations) {
+ const trigger = definition.trigger;
+ if (trigger?.kind !== "host_status") continue;
+ if (!selectorCoversHost(trigger.hostSelector, event.hostId)) continue;
+
+ const stateKey = String(event.hostId);
+ const state = await repository.getTriggerState(row.id, stateKey);
+
+ if (state?.lastObservedState === observed) continue;
+
+ await repository.upsertTriggerState({
+ automationId: row.id,
+ stateKey,
+ lastObservedState: observed,
+ });
+
+ // The first observation establishes a baseline rather than firing, so a
+ // restart does not announce every host as though it just changed.
+ if (!state?.lastObservedState) continue;
+ if (trigger.to !== observed) continue;
+ if (isCoolingDown(state?.lastFiredAt, trigger.cooldownMinutes, now))
+ continue;
+
+ await fire(
+ row,
+ stateKey,
+ "host_status",
+ { hostId: event.hostId, status: observed },
+ event.hostId,
+ );
+ }
+}
+
+export async function onHealthCheck(event: HealthEvent): Promise {
+ const automations = await loadEnabledFor(event.userId);
+ const repository = createCurrentAutomationRepository();
+ const now = Date.now();
+ const observed = event.ok ? "recovered" : "failing";
+
+ for (const { row, definition } of automations) {
+ const trigger = definition.trigger;
+ if (trigger?.kind !== "health_check") continue;
+ if (!selectorCoversHost(trigger.hostSelector, event.hostId)) continue;
+ if (trigger.checkId && trigger.checkId !== event.checkId) continue;
+
+ const stateKey = `${event.hostId}:${event.checkId}`;
+ const state = await repository.getTriggerState(row.id, stateKey);
+
+ if (state?.lastObservedState === observed) continue;
+
+ await repository.upsertTriggerState({
+ automationId: row.id,
+ stateKey,
+ lastObservedState: observed,
+ });
+
+ if (!state?.lastObservedState) continue;
+ if (trigger.to !== observed) continue;
+ if (isCoolingDown(state?.lastFiredAt, trigger.cooldownMinutes, now))
+ continue;
+
+ await fire(
+ row,
+ stateKey,
+ "health_check",
+ {
+ hostId: event.hostId,
+ checkId: event.checkId,
+ state: observed,
+ detail: event.detail,
+ },
+ event.hostId,
+ );
+ }
+}
+
+export async function onDockerEvent(event: DockerEvent): Promise {
+ const automations = await loadEnabledFor(event.ownerUserId);
+ const repository = createCurrentAutomationRepository();
+ const now = Date.now();
+
+ for (const { row, definition } of automations) {
+ const trigger = definition.trigger;
+ if (trigger?.kind !== "docker_event") continue;
+ if (!selectorCoversHost(trigger.hostSelector, event.hostId)) continue;
+ if (trigger.container && trigger.container !== event.container) continue;
+ if (trigger.event !== event.event) continue;
+
+ const stateKey = `${event.hostId}:${event.container}`;
+ const state = await repository.getTriggerState(row.id, stateKey);
+ if (isCoolingDown(state?.lastFiredAt, trigger.cooldownMinutes, now))
+ continue;
+
+ await fire(
+ row,
+ stateKey,
+ "docker_event",
+ {
+ hostId: event.hostId,
+ container: event.container,
+ event: event.event,
+ },
+ event.hostId,
+ );
+ }
+}
+
+export async function onInternalEvent(event: InternalEvent): Promise {
+ const automations = await loadEnabledFor(event.userId);
+ const repository = createCurrentAutomationRepository();
+ const now = Date.now();
+
+ for (const { row, definition } of automations) {
+ const trigger = definition.trigger;
+ if (trigger?.kind !== "internal_event") continue;
+ if (trigger.event !== event.event) continue;
+ if (
+ event.hostId !== undefined &&
+ !selectorCoversHost(trigger.hostSelector, event.hostId)
+ ) {
+ continue;
+ }
+
+ const stateKey = event.hostId ? String(event.hostId) : "global";
+ const state = await repository.getTriggerState(row.id, stateKey);
+ if (isCoolingDown(state?.lastFiredAt, trigger.cooldownMinutes, now))
+ continue;
+
+ await fire(
+ row,
+ stateKey,
+ "internal_event",
+ { event: event.event, hostId: event.hostId, ...(event.details ?? {}) },
+ event.hostId,
+ );
+ }
+}
+
+/**
+ * Hosts that an enabled automation watches, so the poller knows to collect
+ * metrics for them even when nobody is looking.
+ */
+export async function listAutomationWatchedHosts(): Promise<
+ Map
+> {
+ const watched = new Map();
+
+ try {
+ const rows = await createCurrentAutomationRepository().listAllEnabled();
+ for (const row of rows) {
+ let definition: AutomationDefinition;
+ try {
+ definition = JSON.parse(row.definition) as AutomationDefinition;
+ } catch {
+ continue;
+ }
+
+ const trigger: Trigger | undefined = definition.trigger;
+ // Only metric thresholds need heavy collection; status triggers are
+ // already served by the cheap reachability probe.
+ if (trigger?.kind !== "metric_threshold") continue;
+
+ const selector = trigger.hostSelector;
+ if (selector?.kind === "host") {
+ watched.set(selector.hostId, row.userId);
+ } else if (selector?.kind === "hosts") {
+ for (const hostId of selector.hostIds) watched.set(hostId, row.userId);
+ }
+ // Fleet and "all" selectors are resolved by the scheduler, which can
+ // expand them without blocking this call.
+ }
+ } catch {
+ return watched;
+ }
+
+ return watched;
+}
diff --git a/src/backend/database/database.ts b/src/backend/database/database.ts
index 66914a1..efec183 100644
--- a/src/backend/database/database.ts
+++ b/src/backend/database/database.ts
@@ -1,5 +1,7 @@
+import { getErrorMessage } from "../utils/error-message.js";
import express from "express";
import http from "http";
+import https from "https";
import bodyParser from "body-parser";
import multer from "multer";
import cookieParser from "cookie-parser";
@@ -8,21 +10,31 @@ import hostRoutes from "./routes/host.js";
import alertRoutes from "./routes/alerts.js";
import credentialsRoutes from "./routes/credentials.js";
import snippetsRoutes from "./routes/snippets.js";
+import fleetRoutes from "./routes/fleet-routes.js";
+import workspaceRoutes from "./routes/workspaces.js";
import c2sTunnelPresetRoutes from "./routes/c2s-tunnel-presets.js";
import terminalRoutes from "./routes/terminal.js";
import sessionLogRoutes from "./routes/session-log-routes.js";
import guacamoleRoutes from "../hosts/guacamole/routes.js";
+import sessionSharingRoutes from "../hosts/session-sharing/routes.js";
import networkTopologyRoutes from "./routes/network-topology.js";
import rbacRoutes from "./routes/rbac.js";
import openTabsRoutes from "./routes/open-tabs.js";
import userPreferencesRoutes from "./routes/user-preferences.js";
+import hostSidebarPreferencesRoutes from "./routes/host-sidebar-preferences.js";
+import credentialSidebarPreferencesRoutes from "./routes/credential-sidebar-preferences.js";
+import uiPreferencesRoutes from "./routes/ui-preferences.js";
import proxmoxRoutes from "./routes/proxmox.js";
import termixIdRoutes from "./routes/termix-id.js";
import { registerAuditLogRoutes } from "./routes/audit-log-routes.js";
import { registerTailscaleRoutes } from "./routes/tailscale-routes.js";
import vaultRoutes from "./routes/vault.js";
import alertRulesRoutes from "./routes/alert-rules-routes.js";
+import aiRoutes from "../ai/index.js";
+import automationsRoutes from "./routes/automations.js";
+import syncRoutes from "./routes/sync.js";
import { createCorsMiddleware } from "../utils/cors-config.js";
+import { createCompressionMiddleware } from "../utils/compression-config.js";
import fs from "fs";
import path from "path";
import os from "os";
@@ -66,6 +78,7 @@ app.set("trust proxy", true);
const authManager = AuthManager.getInstance();
const authenticateJWT = authManager.createAuthMiddleware();
const requireAdmin = authManager.createAdminMiddleware();
+app.use(createCompressionMiddleware());
app.use(createCorsMiddleware());
type SettingData = {
@@ -480,7 +493,7 @@ app.get("/releases/rss", authenticateJWT, async (req, res) => {
});
res.status(500).json({
error: "Failed to generate RSS format",
- details: error instanceof Error ? error.message : "Unknown error",
+ details: getErrorMessage(error),
});
}
});
@@ -711,7 +724,7 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
}
const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
- const filename = `termix-export-${user[0].username}-${timestamp}.sqlite`;
+ const filename = `termix-export-${user.username}-${timestamp}.sqlite`;
const tempPath = path.join(tempDir, filename);
apiLogger.info("Creating export database", {
@@ -880,7 +893,7 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
);
`);
- const userRecord = user[0];
+ const userRecord = user;
const insertUser = exportDb.prepare(`
INSERT INTO users (id, username, password_hash, is_admin, is_oidc, oidc_identifier, client_id, client_secret, issuer_url, authorization_url, token_url, identifier_path, name_path, scopes, totp_secret, totp_enabled, totp_backup_codes)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
@@ -1135,7 +1148,7 @@ app.post("/database/export", authenticateJWT, async (req, res) => {
});
res.status(500).json({
error: "Failed to export user data",
- details: error instanceof Error ? error.message : "Unknown error",
+ details: getErrorMessage(error),
});
}
});
@@ -1601,7 +1614,7 @@ app.post(
});
res.status(500).json({
error: "Failed to import SQLite data",
- details: error instanceof Error ? error.message : "Unknown error",
+ details: getErrorMessage(error),
});
}
},
@@ -1662,7 +1675,7 @@ app.post("/database/export/preview", authenticateJWT, async (req, res) => {
});
res.status(500).json({
error: "Failed to generate export preview",
- details: error instanceof Error ? error.message : "Unknown error",
+ details: getErrorMessage(error),
});
}
});
@@ -1723,7 +1736,7 @@ app.post("/database/restore", requireAdmin, async (req, res) => {
});
res.status(500).json({
error: "Database restore failed",
- details: error instanceof Error ? error.message : "Unknown error",
+ details: getErrorMessage(error),
});
}
});
@@ -1733,20 +1746,31 @@ app.use("/host", hostRoutes);
app.use("/alerts", alertRoutes);
app.use("/credentials", credentialsRoutes);
app.use("/snippets", snippetsRoutes);
+app.use("/fleets", fleetRoutes);
+app.use("/workspaces", workspaceRoutes);
app.use("/c2s-tunnel-presets", c2sTunnelPresetRoutes);
app.use("/terminal", terminalRoutes);
app.use("/session_logs", sessionLogRoutes);
app.use("/guacamole", guacamoleRoutes);
+app.use("/session-sharing", sessionSharingRoutes);
app.use("/network-topology", networkTopologyRoutes);
app.use("/rbac", rbacRoutes);
app.use("/open-tabs", openTabsRoutes);
app.use("/user-preferences", userPreferencesRoutes);
+app.use("/host-sidebar/preferences", hostSidebarPreferencesRoutes);
+app.use("/credential-sidebar/preferences", credentialSidebarPreferencesRoutes);
+app.use("/ui-preferences", uiPreferencesRoutes);
app.use("/proxmox", proxmoxRoutes);
app.use("/termix-id", termixIdRoutes);
registerAuditLogRoutes(app, authenticateJWT);
registerTailscaleRoutes(app, authenticateJWT);
app.use("/vault", vaultRoutes);
+// Before the alert routes, which are mounted at the root and would otherwise
+// have first claim on the path.
+app.use("/automations", automationsRoutes);
+app.use("/ai", aiRoutes);
app.use("/", alertRulesRoutes);
+app.use("/sync", syncRoutes);
const frontendDistPaths = [
path.join(__dirname, "../../../dist"),
@@ -1909,7 +1933,7 @@ app.get(
});
res.status(500).json({
error: "Failed to get migration status",
- details: error instanceof Error ? error.message : "Unknown error",
+ details: getErrorMessage(error),
});
}
},
@@ -1987,7 +2011,7 @@ app.get(
});
res.status(500).json({
error: "Failed to get migration history",
- details: error instanceof Error ? error.message : "Unknown error",
+ details: getErrorMessage(error),
});
}
},
@@ -2025,7 +2049,54 @@ const sslConfig = AutoSSLSetup.getSSLConfig();
if (sslConfig.enabled) {
databaseLogger.info(`SSL is enabled`, {
operation: "ssl_info",
- nginx_https_port: sslConfig.port,
+ ssl_port: sslConfig.port,
backend_http_port: HTTP_PORT,
});
+
+ try {
+ const httpsServer = https.createServer(
+ {
+ cert: fs.readFileSync(sslConfig.certPath),
+ key: fs.readFileSync(sslConfig.keyPath),
+ },
+ app,
+ );
+
+ httpsServer.on("error", (err: NodeJS.ErrnoException) => {
+ if (err.code === "EADDRINUSE") {
+ databaseLogger.error(
+ `SSL port ${sslConfig.port} is already in use. Kill the existing process and retry.`,
+ err,
+ {
+ operation: "https_server_port_conflict",
+ port: sslConfig.port,
+ },
+ );
+ return;
+ }
+ databaseLogger.error("HTTPS server error", err, {
+ operation: "https_server_error",
+ });
+ });
+
+ httpsServer.listen(sslConfig.port, () => {
+ databaseLogger.success(
+ `Backend is now also listening for HTTPS directly`,
+ {
+ operation: "https_server_started",
+ port: sslConfig.port,
+ },
+ );
+ });
+ } catch (error) {
+ databaseLogger.error(
+ "Failed to start HTTPS server with configured SSL certificate",
+ error,
+ {
+ operation: "https_server_start_failed",
+ cert_path: sslConfig.certPath,
+ key_path: sslConfig.keyPath,
+ },
+ );
+ }
}
diff --git a/src/backend/database/db/connect.ts b/src/backend/database/db/connect.ts
new file mode 100644
index 0000000..4507040
--- /dev/null
+++ b/src/backend/database/db/connect.ts
@@ -0,0 +1,131 @@
+import type { DatabaseDialect } from "./dialect.js";
+import type { PortableDatabase } from "../repositories/database-context.js";
+
+export const DATABASE_URL_ENV = "DATABASE_URL";
+export const DATABASE_POOL_MAX_ENV = "DATABASE_POOL_MAX";
+export const DATABASE_SSL_ENV = "DATABASE_SSL";
+
+const DEFAULT_POOL_MAX = 10;
+
+/**
+ * Pool size. Both drivers default to 10; this exists so an install that runs
+ * several replicas against one server can keep the total connection count under
+ * the server's own limit, which is the usual thing to hit first.
+ */
+export function poolMax(env: NodeJS.ProcessEnv = process.env): number {
+ const raw = env[DATABASE_POOL_MAX_ENV]?.trim();
+ if (!raw) return DEFAULT_POOL_MAX;
+
+ const parsed = Number(raw);
+ if (!Number.isInteger(parsed) || parsed < 1) {
+ throw new Error(
+ `${DATABASE_POOL_MAX_ENV} must be a positive integer, got "${raw}".`,
+ );
+ }
+ return parsed;
+}
+
+/**
+ * TLS mode.
+ *
+ * "require" verifies the server certificate; "no-verify" encrypts without
+ * checking it, which is what a self-signed certificate on a private network
+ * needs. Unset means no TLS, preserving the behaviour of every install that
+ * predates this setting.
+ */
+export function sslOption(
+ env: NodeJS.ProcessEnv = process.env,
+): false | { rejectUnauthorized: boolean } {
+ const raw = env[DATABASE_SSL_ENV]?.trim().toLowerCase();
+ if (!raw || raw === "false" || raw === "disable") return false;
+
+ if (raw === "true" || raw === "require") return { rejectUnauthorized: true };
+ if (raw === "no-verify") return { rejectUnauthorized: false };
+
+ throw new Error(
+ `Unsupported ${DATABASE_SSL_ENV}: "${raw}". Expected require, no-verify, or disable.`,
+ );
+}
+
+/**
+ * Opens a connection to a client-server engine.
+ *
+ * SQLite is not handled here โ it has its own lifecycle in db/index.ts, where
+ * the database is decrypted into memory and serialised back to a file. This
+ * covers the engines that connect to something already running.
+ *
+ * The returned handle is typed as PortableDatabase; see the note there on why
+ * that is an approximation and what guarantees it.
+ */
+export function databaseUrl(env: NodeJS.ProcessEnv = process.env): string | null {
+ const url = env[DATABASE_URL_ENV]?.trim();
+ return url ? url : null;
+}
+
+/**
+ * Checks the connection string suits the configured engine before trying to
+ * open it, so a mismatch fails with something readable rather than a driver
+ * error thirty frames down.
+ */
+export function assertUrlMatchesDialect(
+ url: string,
+ dialect: DatabaseDialect,
+): void {
+ const scheme = url.split("://", 1)[0].toLowerCase();
+
+ const expected: Record = {
+ postgres: ["postgres", "postgresql"],
+ mysql: ["mysql", "mariadb"],
+ };
+
+ const allowed = expected[dialect];
+ if (!allowed) {
+ throw new Error(`${dialect} does not use ${DATABASE_URL_ENV}`);
+ }
+
+ if (!allowed.includes(scheme)) {
+ throw new Error(
+ `${DATABASE_URL_ENV} is a "${scheme}://" URL but DATABASE_DIALECT is "${dialect}". ` +
+ `Expected one of ${allowed.map((s) => `${s}://`).join(", ")}.`,
+ );
+ }
+}
+
+export async function connectRemoteDatabase(
+ dialect: DatabaseDialect,
+ env: NodeJS.ProcessEnv = process.env,
+): Promise {
+ const url = databaseUrl(env);
+ if (!url) {
+ throw new Error(
+ `${DATABASE_URL_ENV} must be set when DATABASE_DIALECT is "${dialect}".`,
+ );
+ }
+
+ assertUrlMatchesDialect(url, dialect);
+
+ const max = poolMax(env);
+ const ssl = sslOption(env);
+
+ // No `schema` option: it only feeds drizzle's relational query API
+ // (`db.query.*`), which nothing here uses. The query builder takes its table
+ // names and value encoders from the table objects the repositories import โ
+ // see the note in schema.pg.ts on why the generated schemas are DDL-only.
+ if (dialect === "postgres") {
+ const { drizzle } = await import("drizzle-orm/node-postgres");
+ return drizzle({
+ connection: { connectionString: url, max, ...(ssl ? { ssl } : {}) },
+ }) as unknown as PortableDatabase;
+ }
+
+ // mysql2 names the pool limit differently and wants no `ssl` key at all when
+ // TLS is off โ passing false is not the same as omitting it.
+ const { drizzle } = await import("drizzle-orm/mysql2");
+ return drizzle({
+ connection: {
+ uri: url,
+ connectionLimit: max,
+ ...(ssl ? { ssl } : {}),
+ },
+ }) as unknown as PortableDatabase;
+}
diff --git a/src/backend/database/db/dialect.ts b/src/backend/database/db/dialect.ts
new file mode 100644
index 0000000..171017b
--- /dev/null
+++ b/src/backend/database/db/dialect.ts
@@ -0,0 +1,50 @@
+/**
+ * Which engine the schema and repositories are built against.
+ *
+ * SQLite is not going away: the desktop app embeds its backend and cannot ship
+ * a database server, so it will always run on SQLite. Postgres and MySQL are
+ * for self-hosted deployments that need more than one process to reach the
+ * data. This is a multi-backend story, not a migration off SQLite.
+ */
+export type DatabaseDialect = "sqlite" | "postgres" | "mysql";
+
+export const DATABASE_DIALECT_ENV = "DATABASE_DIALECT";
+
+const SUPPORTED: readonly DatabaseDialect[] = ["sqlite", "postgres", "mysql"];
+
+export function isDatabaseDialect(value: unknown): value is DatabaseDialect {
+ return (
+ typeof value === "string" &&
+ (SUPPORTED as readonly string[]).includes(value)
+ );
+}
+
+/**
+ * Resolves the configured dialect, defaulting to SQLite so existing
+ * deployments and the desktop build are unaffected by this being added.
+ */
+export function resolveDatabaseDialect(
+ env: NodeJS.ProcessEnv = process.env,
+): DatabaseDialect {
+ const raw = env[DATABASE_DIALECT_ENV]?.trim().toLowerCase();
+ if (!raw) return "sqlite";
+
+ if (!isDatabaseDialect(raw)) {
+ throw new Error(
+ `Unsupported ${DATABASE_DIALECT_ENV}: "${raw}". Expected one of ${SUPPORTED.join(", ")}.`,
+ );
+ }
+ return raw;
+}
+
+/**
+ * Whether a write has to be explicitly persisted after it commits.
+ *
+ * SQLite here is an in-memory database serialised back to an encrypted file, so
+ * every write needs a trigger to flush it. Client-server engines have already
+ * durably committed by the time the query returns โ there is no file to write
+ * and nothing to schedule.
+ */
+export function needsExplicitPersist(dialect: DatabaseDialect): boolean {
+ return dialect === "sqlite";
+}
diff --git a/src/backend/database/db/index.ts b/src/backend/database/db/index.ts
index f9f519c..f015182 100644
--- a/src/backend/database/db/index.ts
+++ b/src/backend/database/db/index.ts
@@ -1,3 +1,4 @@
+import { getErrorMessage } from "../../utils/error-message.js";
import { drizzle } from "drizzle-orm/better-sqlite3";
import Database from "better-sqlite3";
import * as schema from "./schema.js";
@@ -7,8 +8,22 @@ import { databaseLogger } from "../../utils/logger.js";
import { DatabaseFileEncryption } from "../../utils/database-file-encryption.js";
import { SystemCrypto } from "../../utils/system-crypto.js";
import { DatabaseMigration } from "../../utils/database-migration.js";
+import {
+ ensureSharedHostAuthOverrideProtocolSchema,
+ migrateLegacySharedHostAuthOverrides,
+} from "../../utils/shared-host-auth-override-migration.js";
import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
+import { migrateAuditRetention } from "../../utils/audit-retention-migration.js";
+import { createPerformanceIndexes } from "./performance-indexes.js";
+import {
+ assertDataDirIsNotMisconfigured,
+ DataDirMisconfiguredError,
+} from "../../utils/data-dir-guard.js";
import { getDefaultGuacdUrl } from "../../utils/guacd-config.js";
+import { resolveDatabaseDialect, type DatabaseDialect } from "./dialect.js";
+import { connectRemoteDatabase } from "./connect.js";
+import { runRemoteMigrations } from "./migrate.js";
+import type { PortableDatabase } from "../repositories/database-context.js";
const dataDir = process.env.DATA_DIR || "./db/data";
const dbDir = path.resolve(dataDir);
@@ -168,18 +183,25 @@ async function initializeDatabaseAsync(): Promise {
);
}
} else {
+ assertDataDirIsNotMisconfigured(dataDir);
memoryDatabase = new Database(":memory:");
isNewDatabase = true;
}
}
} catch (error) {
+ // Already a precise diagnosis of an intact-but-unusable file. The
+ // generic decryption error below would only obscure it.
if (error instanceof UnreadableDatabaseFileError) {
throw error;
}
+ // Not a decryption problem: the database is fine, we are pointed at the
+ // wrong directory. Surface that message as-is.
+ if (error instanceof DataDirMisconfiguredError) throw error;
+
databaseLogger.error("Failed to initialize memory database", error, {
operation: "db_memory_init_failed",
- errorMessage: error instanceof Error ? error.message : "Unknown error",
+ errorMessage: getErrorMessage(error),
errorStack: error instanceof Error ? error.stack : undefined,
encryptedDbExists:
DatabaseFileEncryption.isEncryptedDatabaseFile(encryptedDbPath),
@@ -203,18 +225,45 @@ async function initializeDatabaseAsync(): Promise {
databaseLogger.warn("Failed to generate diagnostic information", {
operation: "db_diagnostic_failed",
error:
- diagError instanceof Error ? diagError.message : "Unknown error",
+ getErrorMessage(diagError),
});
}
throw new Error(
- `Database decryption failed: ${error instanceof Error ? error.message : "Unknown error"}. This prevents data loss.`,
+ `Database decryption failed: ${getErrorMessage(error)}. This prevents data loss.`,
{ cause: error },
);
}
} else {
- memoryDatabase = new Database(":memory:");
- isNewDatabase = true;
+ assertDataDirIsNotMisconfigured(dataDir);
+
+ // The database still lives in memory and is serialised out on every write;
+ // turning encryption off only changes whether that file is ciphertext. It
+ // has to be read back, or each restart starts empty and silently discards
+ // everything the previous run saved.
+ const existing = readPlainDatabaseFile();
+ if (existing) {
+ memoryDatabase = new Database(existing);
+ databaseLogger.info("Loaded unencrypted database from disk", {
+ operation: "db_load_plain",
+ path: dbPath,
+ bytes: existing.length,
+ });
+ } else {
+ memoryDatabase = new Database(":memory:");
+ isNewDatabase = true;
+ }
+ }
+}
+
+/** The plain database file, or null when there is nothing to restore. */
+function readPlainDatabaseFile(): Buffer | null {
+ try {
+ const contents = fs.readFileSync(dbPath);
+ return contents.length > 0 ? contents : null;
+ } catch (error) {
+ if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+ throw error;
}
}
@@ -315,6 +364,7 @@ async function initializeCompleteDatabase(): Promise {
folder TEXT,
tags TEXT,
pin INTEGER NOT NULL DEFAULT 0,
+ sort_order INTEGER,
auth_type TEXT NOT NULL,
password TEXT,
key TEXT,
@@ -458,9 +508,12 @@ async function initializeCompleteDatabase(): Promise {
name TEXT NOT NULL,
color TEXT,
icon TEXT,
+ credential_id INTEGER,
+ sort_order INTEGER,
created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+ FOREIGN KEY (credential_id) REFERENCES ssh_credentials (id) ON DELETE SET NULL
);
CREATE TABLE IF NOT EXISTS recent_activity (
@@ -526,7 +579,7 @@ async function initializeCompleteDatabase(): Promise {
CREATE TABLE IF NOT EXISTS audit_logs (
id INTEGER PRIMARY KEY AUTOINCREMENT,
- user_id TEXT NOT NULL,
+ user_id TEXT,
username TEXT NOT NULL,
action TEXT NOT NULL,
resource_type TEXT NOT NULL,
@@ -538,13 +591,14 @@ async function initializeCompleteDatabase(): Promise {
success INTEGER NOT NULL,
error_message TEXT,
timestamp TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE SET NULL
);
CREATE TABLE IF NOT EXISTS session_recordings (
id INTEGER PRIMARY KEY AUTOINCREMENT,
host_id INTEGER NOT NULL,
- user_id TEXT NOT NULL,
+ user_id TEXT,
+ username TEXT,
access_id INTEGER,
started_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
ended_at TEXT,
@@ -557,10 +611,42 @@ async function initializeCompleteDatabase(): Promise {
terminated_by_owner INTEGER DEFAULT 0,
termination_reason TEXT,
FOREIGN KEY (host_id) REFERENCES ssh_data (id) ON DELETE CASCADE,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE SET NULL,
FOREIGN KEY (access_id) REFERENCES host_access (id) ON DELETE SET NULL
);
+ CREATE TABLE IF NOT EXISTS session_shares (
+ id TEXT PRIMARY KEY,
+ host_id INTEGER NOT NULL,
+ owner_user_id TEXT NOT NULL,
+ protocol TEXT NOT NULL,
+ session_id TEXT NOT NULL,
+ tab_instance_id TEXT,
+ share_type TEXT NOT NULL,
+ target_user_id TEXT,
+ link_token TEXT UNIQUE,
+ permission_level TEXT NOT NULL DEFAULT 'read-only',
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ expires_at TEXT NOT NULL,
+ revoked_at TEXT,
+ last_joined_at TEXT,
+ join_count INTEGER NOT NULL DEFAULT 0,
+ FOREIGN KEY (host_id) REFERENCES ssh_data (id) ON DELETE CASCADE,
+ FOREIGN KEY (owner_user_id) REFERENCES users (id) ON DELETE CASCADE,
+ FOREIGN KEY (target_user_id) REFERENCES users (id) ON DELETE CASCADE
+ );
+
+ CREATE TABLE IF NOT EXISTS session_share_participants (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ share_id TEXT NOT NULL,
+ user_id TEXT,
+ guest_label TEXT,
+ joined_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ left_at TEXT,
+ FOREIGN KEY (share_id) REFERENCES session_shares (id) ON DELETE CASCADE,
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+ );
+
CREATE TABLE IF NOT EXISTS api_keys (
id TEXT PRIMARY KEY,
user_id TEXT NOT NULL,
@@ -613,6 +699,41 @@ async function initializeCompleteDatabase(): Promise {
CREATE UNIQUE INDEX IF NOT EXISTS idx_host_metrics_prefs_user_host
ON host_metrics_preferences (user_id, host_id);
+ CREATE TABLE IF NOT EXISTS proxmox_stats_preferences (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT NOT NULL,
+ host_id INTEGER NOT NULL,
+ layout TEXT NOT NULL,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+ FOREIGN KEY (host_id) REFERENCES ssh_data (id) ON DELETE CASCADE
+ );
+
+ CREATE UNIQUE INDEX IF NOT EXISTS idx_proxmox_stats_prefs_user_host
+ ON proxmox_stats_preferences (user_id, host_id);
+
+ CREATE TABLE IF NOT EXISTS host_sidebar_preferences (
+ user_id TEXT PRIMARY KEY,
+ data TEXT NOT NULL,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+ );
+
+ CREATE TABLE IF NOT EXISTS credential_sidebar_preferences (
+ user_id TEXT PRIMARY KEY,
+ data TEXT NOT NULL,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+ );
+
+ CREATE TABLE IF NOT EXISTS ui_preferences (
+ user_id TEXT PRIMARY KEY,
+ data TEXT NOT NULL,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+ );
+
CREATE TABLE IF NOT EXISTS host_health_checks (
id INTEGER PRIMARY KEY AUTOINCREMENT,
user_id TEXT NOT NULL,
@@ -705,6 +826,7 @@ async function initializeCompleteDatabase(): Promise {
}
migrateSchema();
+ vacuumIfFreelistBloated();
try {
ensureRawSettingDefault("allow_registration", "true");
@@ -760,12 +882,16 @@ const addColumnIfNotExists = (
sqlite.exec(`ALTER TABLE ${table}
ADD COLUMN "${column}" ${definition};`);
} catch (alterError) {
- databaseLogger.warn(`Failed to add column ${column} to ${table}`, {
- operation: "schema_migration",
- table,
- column,
- error: alterError,
- });
+ const message =
+ alterError instanceof Error ? alterError.message : String(alterError);
+ databaseLogger.warn(
+ `Failed to add column ${column} to ${table}: ${message}`,
+ {
+ operation: "schema_migration",
+ table,
+ column,
+ },
+ );
}
}
};
@@ -802,8 +928,15 @@ const migrateSchema = () => {
addColumnIfNotExists("user_preferences", "disable_update_check", "INTEGER");
addColumnIfNotExists("user_preferences", "confirm_tab_close", "INTEGER");
addColumnIfNotExists("user_preferences", "hidden_rail_tabs", "TEXT");
+ addColumnIfNotExists("user_preferences", "ai_assistant_enabled", "INTEGER");
+ addColumnIfNotExists("user_preferences", "ai_read_only_commands", "INTEGER");
addColumnIfNotExists("user_preferences", "compact_host_view", "INTEGER");
addColumnIfNotExists("user_preferences", "status_color_scheme", "TEXT");
+ addColumnIfNotExists("user_preferences", "custom_themes", "TEXT");
+ addColumnIfNotExists("user_preferences", "custom_keybindings", "TEXT");
+ addColumnIfNotExists("user_preferences", "terminal_defaults", "TEXT");
+ addColumnIfNotExists("user_preferences", "rdp_defaults", "TEXT");
+ addColumnIfNotExists("user_preferences", "terminal_macros", "TEXT");
sqlite.exec(`
CREATE TABLE IF NOT EXISTS dashboard_service_links (
@@ -857,9 +990,7 @@ const migrateSchema = () => {
databaseLogger.warn("Failed to backfill users.registered_at", {
operation: "schema_migration",
error:
- backfillError instanceof Error
- ? backfillError.message
- : String(backfillError),
+ getErrorMessage(backfillError, String(backfillError)),
});
}
} else {
@@ -873,9 +1004,7 @@ const migrateSchema = () => {
{
operation: "schema_migration",
error:
- backfillError instanceof Error
- ? backfillError.message
- : String(backfillError),
+ getErrorMessage(backfillError, String(backfillError)),
},
);
}
@@ -912,6 +1041,8 @@ const migrateSchema = () => {
addColumnIfNotExists("ssh_data", "folder", "TEXT");
addColumnIfNotExists("ssh_data", "tags", "TEXT");
addColumnIfNotExists("ssh_data", "pin", "INTEGER NOT NULL DEFAULT 0");
+ addColumnIfNotExists("ssh_data", "sort_order", "INTEGER");
+ addColumnIfNotExists("ssh_folders", "sort_order", "INTEGER");
addColumnIfNotExists(
"ssh_data",
"auth_type",
@@ -1002,11 +1133,22 @@ const migrateSchema = () => {
"INTEGER NOT NULL DEFAULT 0",
);
addColumnIfNotExists("ssh_data", "proxmox_config", "TEXT");
+ addColumnIfNotExists(
+ "ssh_data",
+ "enable_proxmox_stats",
+ "INTEGER NOT NULL DEFAULT 0",
+ );
+ addColumnIfNotExists("ssh_data", "proxmox_stats_config", "TEXT");
addColumnIfNotExists(
"ssh_data",
"enable_tmux_monitor",
"INTEGER NOT NULL DEFAULT 0",
);
+ addColumnIfNotExists(
+ "ssh_data",
+ "enable_terminal_toolbar",
+ "INTEGER NOT NULL DEFAULT 1",
+ );
addColumnIfNotExists("ssh_data", "connection_type", 'TEXT NOT NULL DEFAULT "ssh"');
addColumnIfNotExists("ssh_data", "domain", "TEXT");
@@ -1061,6 +1203,13 @@ const migrateSchema = () => {
addColumnIfNotExists("ssh_credentials", "cert_public_key", "TEXT");
+ addColumnIfNotExists(
+ "ssh_credentials",
+ "pin",
+ "INTEGER NOT NULL DEFAULT 0",
+ );
+ addColumnIfNotExists("ssh_credentials", "sort_order", "INTEGER");
+
try {
const tableInfo = sqlite.prepare("PRAGMA table_info(ssh_credentials)").all() as Array<{
cid: number;
@@ -1074,43 +1223,57 @@ const migrateSchema = () => {
if (usernameCol && usernameCol.notnull === 1) {
const tempTableName = "ssh_credentials_temp_migration";
- const allColumns = tableInfo.map((col) => col.name).join(", ");
+ const allColumns = tableInfo.map((col) => `"${col.name}"`).join(", ");
+
+ // Derive the replacement table from the live definition instead of
+ // restating it here. The table keeps gaining columns (cert_public_key,
+ // pin, sort_order, sync_id, ...), and a second copy of the column list
+ // falls behind every time one is added โ leaving the copy narrower than
+ // the table, so the INSERT below fails and the constraint stays put.
+ const createSql = sqlite
+ .prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'ssh_credentials'")
+ .pluck()
+ .get() as string | undefined;
+
+ if (!createSql) {
+ throw new Error("ssh_credentials has no stored table definition");
+ }
+
+ // Only the table name is rewritten; replace() stops at the first match,
+ // and in a CREATE TABLE statement that is the table being defined.
+ const renamedSql = createSql.replace("ssh_credentials", tempTableName);
+ const tempCreateSql = renamedSql.replace(/(["`[]?username["`\]]?\s+TEXT)\s+NOT\s+NULL/i, "$1");
+
+ if (tempCreateSql === renamedSql) {
+ throw new Error("could not derive a nullable-username definition for ssh_credentials");
+ }
+
+ // DROP TABLE takes the table's indexes with it, so replay them afterwards.
+ const indexDefs = sqlite
+ .prepare(
+ "SELECT sql FROM sqlite_master WHERE type = 'index' AND tbl_name = 'ssh_credentials' AND sql IS NOT NULL",
+ )
+ .pluck()
+ .all() as string[];
sqlite.exec(`PRAGMA foreign_keys = OFF`);
sqlite.exec(`
- CREATE TABLE ${tempTableName} (
- id INTEGER PRIMARY KEY AUTOINCREMENT,
- user_id TEXT NOT NULL,
- name TEXT NOT NULL,
- description TEXT,
- folder TEXT,
- tags TEXT,
- auth_type TEXT NOT NULL,
- username TEXT,
- password TEXT,
- key TEXT,
- key_password TEXT,
- key_type TEXT,
- usage_count INTEGER NOT NULL DEFAULT 0,
- last_used TEXT,
- created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- private_key TEXT,
- public_key TEXT,
- detected_key_type TEXT,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
- );
+ ${tempCreateSql};
- INSERT INTO ${tempTableName} SELECT ${allColumns} FROM ssh_credentials;
+ INSERT INTO ${tempTableName} (${allColumns}) SELECT ${allColumns} FROM ssh_credentials;
DROP TABLE ssh_credentials;
ALTER TABLE ${tempTableName} RENAME TO ssh_credentials;
`);
+ for (const indexSql of indexDefs) {
+ sqlite.exec(indexSql);
+ }
sqlite.exec(`PRAGMA foreign_keys = ON`);
databaseLogger.info("Successfully migrated ssh_credentials table to remove username NOT NULL constraint", {
operation: "schema_migration_username_nullable",
+ restoredIndexes: indexDefs.length,
});
}
} catch (migrationError) {
@@ -1120,6 +1283,69 @@ const migrateSchema = () => {
});
}
+ try {
+ const auditLogColumns = sqlite.prepare("PRAGMA table_info(audit_logs)").all() as Array<{
+ name: string;
+ notnull: number;
+ }>;
+ const auditUserIdCol = auditLogColumns.find((col) => col.name === "user_id");
+
+ if (auditUserIdCol && auditUserIdCol.notnull === 1) {
+ const tempTableName = "audit_logs_temp_migration";
+ const columns = [
+ "id",
+ "user_id",
+ "username",
+ "action",
+ "resource_type",
+ "resource_id",
+ "resource_name",
+ "details",
+ "ip_address",
+ "user_agent",
+ "success",
+ "error_message",
+ "timestamp",
+ ].join(", ");
+
+ sqlite.exec(`PRAGMA foreign_keys = OFF`);
+ sqlite.exec(`
+ CREATE TABLE ${tempTableName} (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT,
+ username TEXT NOT NULL,
+ action TEXT NOT NULL,
+ resource_type TEXT NOT NULL,
+ resource_id TEXT,
+ resource_name TEXT,
+ details TEXT,
+ ip_address TEXT,
+ user_agent TEXT,
+ success INTEGER NOT NULL,
+ error_message TEXT,
+ timestamp TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE SET NULL
+ );
+
+ INSERT INTO ${tempTableName} (${columns}) SELECT ${columns} FROM audit_logs;
+
+ DROP TABLE audit_logs;
+
+ ALTER TABLE ${tempTableName} RENAME TO audit_logs;
+ `);
+ sqlite.exec(`PRAGMA foreign_keys = ON`);
+
+ databaseLogger.info("Successfully migrated audit_logs table to remove user_id NOT NULL constraint", {
+ operation: "schema_migration_audit_user_id_nullable",
+ });
+ }
+ } catch (migrationError) {
+ databaseLogger.warn("Failed to migrate audit_logs user_id column", {
+ operation: "schema_migration",
+ error: migrationError,
+ });
+ }
+
addColumnIfNotExists("file_manager_recent", "host_id", "INTEGER NOT NULL");
addColumnIfNotExists("file_manager_pinned", "host_id", "INTEGER NOT NULL");
addColumnIfNotExists("file_manager_shortcuts", "host_id", "INTEGER NOT NULL");
@@ -1127,6 +1353,7 @@ const migrateSchema = () => {
addColumnIfNotExists("snippets", "folder", "TEXT");
addColumnIfNotExists("snippets", "order", "INTEGER NOT NULL DEFAULT 0");
addColumnIfNotExists("snippets", "host_filter", "TEXT");
+ addColumnIfNotExists("snippets", "is_note", "INTEGER NOT NULL DEFAULT 0");
try {
sqlite
@@ -1287,85 +1514,6 @@ const migrateSchema = () => {
}
}
- try {
- sqlite.prepare("SELECT id FROM c2s_tunnel_presets LIMIT 1").get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS c2s_tunnel_presets (
- id INTEGER PRIMARY KEY AUTOINCREMENT,
- user_id TEXT NOT NULL,
- name TEXT NOT NULL,
- config TEXT NOT NULL,
- platform TEXT,
- computer_name TEXT,
- created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create c2s_tunnel_presets table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
- try {
- sqlite
- .prepare("SELECT id FROM sessions LIMIT 1")
- .get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS sessions (
- id TEXT PRIMARY KEY,
- user_id TEXT NOT NULL,
- jwt_token TEXT NOT NULL,
- device_type TEXT NOT NULL,
- device_info TEXT NOT NULL,
- created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- expires_at TEXT NOT NULL,
- last_active_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- FOREIGN KEY (user_id) REFERENCES users (id)
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create sessions table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
- try {
- sqlite
- .prepare("SELECT id FROM trusted_devices LIMIT 1")
- .get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS trusted_devices (
- id TEXT PRIMARY KEY,
- user_id TEXT NOT NULL,
- device_fingerprint TEXT NOT NULL,
- device_type TEXT NOT NULL,
- device_info TEXT NOT NULL,
- created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- expires_at TEXT NOT NULL,
- last_used_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create trusted_devices table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
try {
sqlite
.prepare("SELECT id FROM network_topology LIMIT 1")
@@ -1390,36 +1538,6 @@ const migrateSchema = () => {
}
}
- try {
- sqlite.prepare("SELECT id FROM host_access LIMIT 1").get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS host_access (
- id INTEGER PRIMARY KEY AUTOINCREMENT,
- host_id INTEGER NOT NULL,
- user_id TEXT,
- role_id INTEGER,
- granted_by TEXT NOT NULL,
- permission_level TEXT NOT NULL DEFAULT 'use',
- expires_at TEXT,
- created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- last_accessed_at TEXT,
- access_count INTEGER NOT NULL DEFAULT 0,
- FOREIGN KEY (host_id) REFERENCES ssh_data (id) ON DELETE CASCADE,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
- FOREIGN KEY (role_id) REFERENCES roles (id) ON DELETE CASCADE,
- FOREIGN KEY (granted_by) REFERENCES users (id) ON DELETE CASCADE
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create host_access table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
try {
sqlite.prepare("SELECT role_id FROM host_access LIMIT 1").get();
} catch {
@@ -1446,6 +1564,41 @@ const migrateSchema = () => {
}
}
+ try {
+ ensureSharedHostAuthOverrideProtocolSchema(sqlite);
+ } catch (schemaError) {
+ databaseLogger.warn("Failed to prepare shared_host_auth_overrides table", {
+ operation: "schema_migration",
+ error: schemaError,
+ });
+ }
+
+ try {
+ migrateLegacySharedHostAuthOverrides(
+ sqlite,
+ getRawSettingValue,
+ setRawSettingValue,
+ );
+ } catch (migrateError) {
+ databaseLogger.warn("Failed to migrate shared host auth overrides", {
+ operation: "schema_migration",
+ error: migrateError,
+ });
+ }
+
+ try {
+ sqlite.prepare("SELECT credential_id FROM ssh_folders LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec("ALTER TABLE ssh_folders ADD COLUMN credential_id INTEGER REFERENCES ssh_credentials(id) ON DELETE SET NULL");
+ } catch (alterError) {
+ databaseLogger.warn("Failed to add credential_id column to ssh_folders", {
+ operation: "schema_migration",
+ error: alterError,
+ });
+ }
+ }
+
try {
sqlite.prepare("SELECT sudo_password FROM ssh_data LIMIT 1").get();
} catch {
@@ -1463,6 +1616,7 @@ const migrateSchema = () => {
{ column: "connection_type", sql: "ALTER TABLE ssh_data ADD COLUMN connection_type TEXT NOT NULL DEFAULT 'ssh'" },
{ column: "credential_id", sql: "ALTER TABLE ssh_data ADD COLUMN credential_id INTEGER" },
{ column: "override_credential_username", sql: "ALTER TABLE ssh_data ADD COLUMN override_credential_username INTEGER" },
+ { column: "share_ssh_auth", sql: "ALTER TABLE ssh_data ADD COLUMN share_ssh_auth INTEGER NOT NULL DEFAULT 0" },
{ column: "jump_hosts", sql: "ALTER TABLE ssh_data ADD COLUMN jump_hosts TEXT" },
{ column: "show_terminal_in_sidebar", sql: "ALTER TABLE ssh_data ADD COLUMN show_terminal_in_sidebar INTEGER NOT NULL DEFAULT 1" },
{ column: "show_file_manager_in_sidebar", sql: "ALTER TABLE ssh_data ADD COLUMN show_file_manager_in_sidebar INTEGER NOT NULL DEFAULT 0" },
@@ -1508,6 +1662,9 @@ const migrateSchema = () => {
{ column: "rdp_auth_type", sql: "ALTER TABLE ssh_data ADD COLUMN rdp_auth_type TEXT" },
{ column: "vnc_auth_type", sql: "ALTER TABLE ssh_data ADD COLUMN vnc_auth_type TEXT" },
{ column: "telnet_auth_type", sql: "ALTER TABLE ssh_data ADD COLUMN telnet_auth_type TEXT" },
+ { column: "allow_session_sharing", sql: "ALTER TABLE ssh_data ADD COLUMN allow_session_sharing INTEGER NOT NULL DEFAULT 1" },
+ { column: "connection_origin", sql: "ALTER TABLE ssh_data ADD COLUMN connection_origin TEXT" },
+ { column: "parent_host_id", sql: "ALTER TABLE ssh_data ADD COLUMN parent_host_id INTEGER REFERENCES ssh_data(id) ON DELETE SET NULL" },
];
for (const migration of sshDataMigrations) {
@@ -1525,6 +1682,40 @@ const migrateSchema = () => {
}
}
+ // share_ssh_auth arrived with 2.6.1 and defaults to 0, but sharing a host
+ // used to pass the owner's SSH authentication along unconditionally. Every
+ // host shared before the upgrade therefore stopped supplying credentials to
+ // its recipients the moment the column appeared, and they were left with
+ // "No valid authentication method provided".
+ //
+ // Turn it on for hosts that are already shared, which is where the previous
+ // behaviour was in effect and consented to. Hosts nobody has shared keep the
+ // new default; the owner decides when they share one.
+ try {
+ if (getRawSettingValue("share_ssh_auth_backfill_v1") === null) {
+ const backfilled = sqlite
+ .prepare(
+ `UPDATE ssh_data SET share_ssh_auth = 1
+ WHERE share_ssh_auth = 0
+ AND id IN (SELECT DISTINCT host_id FROM host_access)`,
+ )
+ .run();
+
+ if (backfilled.changes > 0) {
+ databaseLogger.info(
+ `Restored shared SSH authentication for ${backfilled.changes} already-shared host(s)`,
+ { operation: "share_ssh_auth_backfill_v1" },
+ );
+ }
+ setRawSettingValue("share_ssh_auth_backfill_v1", "true");
+ }
+ } catch (e) {
+ databaseLogger.warn("Failed to backfill share_ssh_auth", {
+ operation: "share_ssh_auth_backfill_v1",
+ error: e,
+ });
+ }
+
// Migrate legacy authType="warpgate" hosts to useWarpgate=1 with authType="none"
try {
const result = sqlite
@@ -1594,118 +1785,6 @@ const migrateSchema = () => {
// user_open_tabs table not present yet; nothing to migrate.
}
- try {
- sqlite.prepare("SELECT id FROM roles LIMIT 1").get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS roles (
- id INTEGER PRIMARY KEY AUTOINCREMENT,
- name TEXT NOT NULL UNIQUE,
- display_name TEXT NOT NULL,
- description TEXT,
- is_system INTEGER NOT NULL DEFAULT 0,
- permissions TEXT,
- created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create roles table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
- try {
- sqlite.prepare("SELECT id FROM user_roles LIMIT 1").get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS user_roles (
- id INTEGER PRIMARY KEY AUTOINCREMENT,
- user_id TEXT NOT NULL,
- role_id INTEGER NOT NULL,
- granted_by TEXT,
- granted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- UNIQUE(user_id, role_id),
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
- FOREIGN KEY (role_id) REFERENCES roles (id) ON DELETE CASCADE,
- FOREIGN KEY (granted_by) REFERENCES users (id) ON DELETE SET NULL
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create user_roles table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
- try {
- sqlite.prepare("SELECT id FROM audit_logs LIMIT 1").get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS audit_logs (
- id INTEGER PRIMARY KEY AUTOINCREMENT,
- user_id TEXT NOT NULL,
- username TEXT NOT NULL,
- action TEXT NOT NULL,
- resource_type TEXT NOT NULL,
- resource_id TEXT,
- resource_name TEXT,
- details TEXT,
- ip_address TEXT,
- user_agent TEXT,
- success INTEGER NOT NULL,
- error_message TEXT,
- timestamp TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create audit_logs table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
- try {
- sqlite.prepare("SELECT id FROM session_recordings LIMIT 1").get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS session_recordings (
- id INTEGER PRIMARY KEY AUTOINCREMENT,
- host_id INTEGER NOT NULL,
- user_id TEXT NOT NULL,
- access_id INTEGER,
- started_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- ended_at TEXT,
- duration INTEGER,
- commands TEXT,
- dangerous_actions TEXT,
- recording_path TEXT,
- protocol TEXT NOT NULL DEFAULT 'ssh',
- format TEXT NOT NULL DEFAULT 'text',
- terminated_by_owner INTEGER DEFAULT 0,
- termination_reason TEXT,
- FOREIGN KEY (host_id) REFERENCES ssh_data (id) ON DELETE CASCADE,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
- FOREIGN KEY (access_id) REFERENCES host_access (id) ON DELETE SET NULL
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create session_recordings table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
try {
sqlite.prepare("SELECT id FROM shared_host_secrets LIMIT 1").get();
} catch {
@@ -1847,32 +1926,6 @@ const migrateSchema = () => {
}
}
- try {
- sqlite.prepare("SELECT id FROM api_keys LIMIT 1").get();
- } catch {
- try {
- sqlite.exec(`
- CREATE TABLE IF NOT EXISTS api_keys (
- id TEXT PRIMARY KEY,
- user_id TEXT NOT NULL,
- name TEXT NOT NULL,
- token_hash TEXT NOT NULL,
- token_prefix TEXT NOT NULL,
- created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
- expires_at TEXT,
- last_used_at TEXT,
- is_active INTEGER NOT NULL DEFAULT 1,
- FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
- );
- `);
- } catch (createError) {
- databaseLogger.warn("Failed to create api_keys table", {
- operation: "schema_migration",
- error: createError,
- });
- }
- }
-
// --- tmux-monitor begin ---
try {
sqlite.prepare("SELECT id FROM tmux_session_tags LIMIT 1").get();
@@ -2053,6 +2106,74 @@ const migrateSchema = () => {
addColumnIfNotExists("users", "sso_provider_id", "INTEGER");
+ try {
+ const usersTableInfo = sqlite.prepare("PRAGMA table_info(users)").all() as Array<{
+ cid: number;
+ name: string;
+ type: string;
+ notnull: number;
+ dflt_value: string | null;
+ pk: number;
+ }>;
+ const legacyNotNullColumns = new Set([
+ "client_id",
+ "client_secret",
+ "issuer_url",
+ "authorization_url",
+ "token_url",
+ "identifier_path",
+ "name_path",
+ "scopes",
+ ]);
+ const hasStaleNotNull = usersTableInfo.some(
+ (col) => legacyNotNullColumns.has(col.name) && col.notnull === 1,
+ );
+
+ if (hasStaleNotNull) {
+ const tempTableName = "users_temp_migration";
+ const columnDefs = usersTableInfo
+ .map((col) => {
+ const parts = [`"${col.name}"`, col.type || "TEXT"];
+ if (col.pk === 1) parts.push("PRIMARY KEY");
+ if (col.notnull === 1 && !legacyNotNullColumns.has(col.name)) {
+ parts.push("NOT NULL");
+ }
+ if (col.dflt_value !== null) {
+ parts.push(`DEFAULT ${col.dflt_value}`);
+ }
+ return parts.join(" ");
+ })
+ .join(",\n ");
+ const allColumns = usersTableInfo.map((col) => `"${col.name}"`).join(", ");
+
+ sqlite.exec(`PRAGMA foreign_keys = OFF`);
+ sqlite.exec(`
+ CREATE TABLE ${tempTableName} (
+ ${columnDefs}
+ );
+
+ INSERT INTO ${tempTableName} SELECT ${allColumns} FROM users;
+
+ DROP TABLE users;
+
+ ALTER TABLE ${tempTableName} RENAME TO users;
+ `);
+ sqlite.exec(`PRAGMA foreign_keys = ON`);
+
+ databaseLogger.info(
+ "Successfully migrated users table to remove legacy OIDC NOT NULL constraints",
+ {
+ operation: "schema_migration_users_oidc_nullable",
+ },
+ );
+ }
+ } catch (migrationError) {
+ databaseLogger.warn("Failed to migrate users table legacy OIDC columns", {
+ operation: "schema_migration",
+ error: migrationError,
+ });
+ }
+
// Migrate legacy single oidc_config settings blob into sso_providers table
try {
const migrationDone = getRawSettingValue("sso_migration_v1");
@@ -2115,6 +2236,34 @@ const migrateSchema = () => {
}
// --- metrics-history end ---
+ // --- proxmox-node-history begin ---
+ try {
+ sqlite.prepare("SELECT id FROM proxmox_node_history LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS proxmox_node_history (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ host_id INTEGER NOT NULL REFERENCES ssh_data(id) ON DELETE CASCADE,
+ ts TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ cpu_percent REAL,
+ mem_percent REAL,
+ disk_percent REAL,
+ net_rx_bytes INTEGER,
+ net_tx_bytes INTEGER
+ );
+ CREATE INDEX IF NOT EXISTS idx_proxmox_node_history_host_ts
+ ON proxmox_node_history (host_id, ts DESC);
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create proxmox_node_history table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+ // --- proxmox-node-history end ---
+
// --- alerts begin ---
try {
sqlite.prepare("SELECT id FROM alert_rules LIMIT 1").get();
@@ -2215,6 +2364,159 @@ const migrateSchema = () => {
}
// --- alerts end ---
+ // --- automations begin ---
+ try {
+ sqlite.prepare("SELECT id FROM automations LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS automations (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ name TEXT NOT NULL,
+ description TEXT,
+ enabled INTEGER NOT NULL DEFAULT 1,
+ definition TEXT NOT NULL,
+ definition_version INTEGER NOT NULL DEFAULT 1,
+ concurrency_policy TEXT NOT NULL DEFAULT 'skip',
+ max_run_seconds INTEGER NOT NULL DEFAULT 300,
+ dry_run INTEGER NOT NULL DEFAULT 0,
+ last_run_at TEXT,
+ last_run_status TEXT,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create automations table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM automation_trigger_state LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS automation_trigger_state (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ automation_id INTEGER NOT NULL REFERENCES automations(id) ON DELETE CASCADE,
+ state_key TEXT NOT NULL,
+ breach_started_at TEXT,
+ last_fired_at TEXT,
+ last_value REAL,
+ last_observed_state TEXT,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create automation_trigger_state table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM automation_schedules LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS automation_schedules (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ automation_id INTEGER NOT NULL REFERENCES automations(id) ON DELETE CASCADE,
+ cron TEXT,
+ interval_seconds INTEGER,
+ timezone TEXT,
+ next_due_at TEXT,
+ last_tick_at TEXT
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create automation_schedules table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM automation_runs LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS automation_runs (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ automation_id INTEGER NOT NULL REFERENCES automations(id) ON DELETE CASCADE,
+ user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ trigger_type TEXT NOT NULL,
+ trigger_context TEXT,
+ status TEXT NOT NULL,
+ started_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ finished_at TEXT,
+ duration_ms INTEGER,
+ error TEXT,
+ dry_run INTEGER NOT NULL DEFAULT 0,
+ parent_run_id INTEGER
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create automation_runs table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM automation_run_steps LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS automation_run_steps (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ run_id INTEGER NOT NULL REFERENCES automation_runs(id) ON DELETE CASCADE,
+ step_index INTEGER NOT NULL,
+ step_id TEXT NOT NULL,
+ step_type TEXT NOT NULL,
+ status TEXT NOT NULL,
+ started_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ finished_at TEXT,
+ output TEXT,
+ error TEXT,
+ truncated INTEGER NOT NULL DEFAULT 0
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create automation_run_steps table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM automation_channels LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS automation_channels (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ automation_id INTEGER NOT NULL REFERENCES automations(id) ON DELETE CASCADE,
+ channel_id INTEGER NOT NULL REFERENCES notification_channels(id) ON DELETE CASCADE
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create automation_channels table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+ // --- automations end ---
+
// Seed default metrics history retention setting
try {
ensureRawSettingDefault("metrics_history_retention_days", "7");
@@ -2274,11 +2576,368 @@ const migrateSchema = () => {
}
// --- homepage end ---
+ // --- fleets begin ---
+ try {
+ sqlite.prepare("SELECT id FROM fleets LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS fleets (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ name TEXT NOT NULL,
+ description TEXT,
+ color TEXT,
+ icon TEXT,
+ tag_rules TEXT,
+ sync_id TEXT UNIQUE,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create fleets table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM fleet_members LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS fleet_members (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ fleet_id INTEGER NOT NULL REFERENCES fleets(id) ON DELETE CASCADE,
+ host_id INTEGER NOT NULL REFERENCES ssh_data(id) ON DELETE CASCADE,
+ added_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+ );
+ `);
+ sqlite.exec(
+ "CREATE UNIQUE INDEX IF NOT EXISTS idx_fleet_members_fleet_host ON fleet_members(fleet_id, host_id)",
+ );
+ } catch (createError) {
+ databaseLogger.warn("Failed to create fleet_members table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM fleet_inventory LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS fleet_inventory (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ host_id INTEGER NOT NULL REFERENCES ssh_data(id) ON DELETE CASCADE,
+ user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ os_pretty_name TEXT,
+ kernel TEXT,
+ architecture TEXT,
+ hostname TEXT,
+ uptime_seconds INTEGER,
+ ip TEXT,
+ package_manager TEXT,
+ collected_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+ );
+ `);
+ sqlite.exec(
+ "CREATE UNIQUE INDEX IF NOT EXISTS idx_fleet_inventory_host ON fleet_inventory(host_id, user_id)",
+ );
+ } catch (createError) {
+ databaseLogger.warn("Failed to create fleet_inventory table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+ // --- fleets end ---
+
+ // --- workspaces begin ---
+ try {
+ sqlite.prepare("SELECT id FROM user_workspaces LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS user_workspaces (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ name TEXT NOT NULL,
+ color TEXT,
+ icon TEXT,
+ kind TEXT NOT NULL DEFAULT 'manual',
+ is_default INTEGER NOT NULL DEFAULT 0,
+ payload TEXT NOT NULL DEFAULT '{}',
+ sync_id TEXT UNIQUE,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ last_used_at TEXT
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create user_workspaces table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+ // --- workspaces end ---
+
+ // --- sync begin ---
+ // Stable per-row identity used to match rows across two independently-
+ // seeded databases (the embedded desktop backend and a connected remote
+ // server) during sync. Local autoincrement ids collide across instances,
+ // so a randomly-generated id is the join key instead. SQLite refuses a
+ // non-constant DEFAULT (e.g. randomblob()) on ALTER TABLE ADD COLUMN for
+ // tables with existing constraints ("Cannot add a column with
+ // non-constant default"), so the column is added as plain nullable TEXT;
+ // repositories set syncId explicitly on insert going forward, and
+ // existing rows are backfilled by the UPDATE loop below.
+ addColumnIfNotExists("ssh_data", "sync_id", "TEXT");
+ addColumnIfNotExists("ssh_credentials", "sync_id", "TEXT");
+ addColumnIfNotExists("ssh_folders", "sync_id", "TEXT");
+ addColumnIfNotExists("snippets", "sync_id", "TEXT");
+ addColumnIfNotExists("snippet_folders", "sync_id", "TEXT");
+ addColumnIfNotExists("vault_profiles", "sync_id", "TEXT");
+ addColumnIfNotExists("dashboard_service_links", "sync_id", "TEXT");
+ // SQLite also rejects NOT NULL DEFAULT CURRENT_TIMESTAMP here for the same
+ // "non-constant default" reason -- add nullable, then backfill from
+ // created_at below and rely on the repository layer to keep it current.
+ addColumnIfNotExists("dashboard_service_links", "updated_at", "TEXT");
+ try {
+ sqlite.exec(
+ "UPDATE dashboard_service_links SET updated_at = created_at WHERE updated_at IS NULL",
+ );
+ } catch (e) {
+ const message = e instanceof Error ? e.message : String(e);
+ databaseLogger.warn(
+ `Failed to backfill dashboard_service_links.updated_at: ${message}`,
+ { operation: "schema_migration", table: "dashboard_service_links" },
+ );
+ }
+ addColumnIfNotExists("homepage_items", "sync_id", "TEXT");
+
+ const syncIdTables = [
+ "ssh_data",
+ "ssh_credentials",
+ "ssh_folders",
+ "snippets",
+ "snippet_folders",
+ "vault_profiles",
+ "dashboard_service_links",
+ "homepage_items",
+ ];
+
+ for (const table of syncIdTables) {
+ try {
+ const result = sqlite
+ .prepare(
+ `UPDATE ${table} SET sync_id = lower(hex(randomblob(16))) WHERE sync_id IS NULL`,
+ )
+ .run();
+ if (result.changes > 0) {
+ databaseLogger.info(
+ `Backfilled sync_id for ${result.changes} row(s) in ${table}`,
+ { operation: "sync_id_backfill", table },
+ );
+ }
+ sqlite.exec(
+ `CREATE UNIQUE INDEX IF NOT EXISTS idx_${table}_sync_id ON ${table}(sync_id)`,
+ );
+ } catch (e) {
+ const message = e instanceof Error ? e.message : String(e);
+ databaseLogger.warn(
+ `Failed to backfill sync_id for ${table}: ${message}`,
+ {
+ operation: "sync_id_backfill",
+ table,
+ },
+ );
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM sync_tombstones LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS sync_tombstones (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ entity_type TEXT NOT NULL,
+ sync_id TEXT NOT NULL,
+ deleted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+ );
+ `);
+ sqlite.exec(
+ "CREATE INDEX IF NOT EXISTS idx_sync_tombstones_user_entity ON sync_tombstones(user_id, entity_type)",
+ );
+ } catch (createError) {
+ databaseLogger.warn("Failed to create sync_tombstones table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+ // --- sync end ---
+
+ // --- ai begin ---
+ try {
+ sqlite.prepare("SELECT id FROM ai_providers LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS ai_providers (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ provider_type TEXT NOT NULL,
+ label TEXT NOT NULL,
+ base_url TEXT,
+ api_key TEXT,
+ api_key_prefix TEXT,
+ default_model TEXT,
+ enabled INTEGER NOT NULL DEFAULT 1,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ UNIQUE(user_id, label)
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create ai_providers table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM ai_conversations LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS ai_conversations (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ title TEXT,
+ provider_id INTEGER,
+ model TEXT,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+ updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create ai_conversations table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM ai_messages LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS ai_messages (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ conversation_id INTEGER NOT NULL REFERENCES ai_conversations(id) ON DELETE CASCADE,
+ role TEXT NOT NULL,
+ content TEXT NOT NULL DEFAULT '',
+ tool_calls TEXT,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create ai_messages table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ try {
+ sqlite.prepare("SELECT id FROM ai_proposals LIMIT 1").get();
+ } catch {
+ try {
+ sqlite.exec(`
+ CREATE TABLE IF NOT EXISTS ai_proposals (
+ id INTEGER PRIMARY KEY AUTOINCREMENT,
+ conversation_id INTEGER NOT NULL REFERENCES ai_conversations(id) ON DELETE CASCADE,
+ user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+ kind TEXT NOT NULL,
+ summary TEXT,
+ payload TEXT NOT NULL DEFAULT '{}',
+ status TEXT NOT NULL DEFAULT 'pending',
+ applied_at TEXT,
+ result_summary TEXT,
+ created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+ );
+ `);
+ } catch (createError) {
+ databaseLogger.warn("Failed to create ai_proposals table", {
+ operation: "schema_migration",
+ error: createError,
+ });
+ }
+ }
+
+ // --- ai end ---
+
+ // Audit trails and session recordings used to be deleted along with the user
+ // they referenced, which defeats the point of keeping them.
+ migrateAuditRetention(sqlite);
+
+ // Runs last so every table and column added above already exists.
+ createPerformanceIndexes(sqlite);
+
databaseLogger.success("Schema migration completed", {
operation: "schema_migration",
});
};
+// A trivial telemetry write forces `serialize()` to rewrite every free page
+// along with the live ones, so a database that has accumulated a large
+// freelist (from years of unbounded metrics/audit growth before retention
+// pruning existed) turns every future save into a multi-megabyte rewrite.
+// Reclaiming that space once at startup keeps steady-state saves cheap.
+const VACUUM_FREELIST_COUNT_THRESHOLD = 2000;
+const VACUUM_FREELIST_RATIO_THRESHOLD = 0.5;
+
+function vacuumIfFreelistBloated(): void {
+ try {
+ const pageCount = sqlite.pragma("page_count", { simple: true }) as number;
+ const freelistCount = sqlite.pragma("freelist_count", {
+ simple: true,
+ }) as number;
+ if (pageCount <= 0) return;
+
+ const freelistRatio = freelistCount / pageCount;
+ if (
+ freelistCount < VACUUM_FREELIST_COUNT_THRESHOLD ||
+ freelistRatio < VACUUM_FREELIST_RATIO_THRESHOLD
+ ) {
+ return;
+ }
+
+ databaseLogger.info("Reclaiming bloated SQLite freelist on startup", {
+ operation: "db_startup_vacuum",
+ pageCount,
+ freelistCount,
+ freelistRatio,
+ });
+ sqlite.exec("VACUUM");
+ } catch (error) {
+ databaseLogger.warn("Failed to vacuum database on startup", {
+ operation: "db_startup_vacuum_failed",
+ error: error instanceof Error ? error.message : String(error),
+ });
+ }
+}
+
// Callers here do not coordinate with each other, and only DatabaseSaveTrigger
// tracks whether a save is already running. Overlapping saves can write an
// older snapshot last, so run them in order.
@@ -2350,9 +3009,7 @@ async function handlePostInitFileEncryption() {
databaseLogger.warn("Failed to cleanup old migration files", {
operation: "migration_cleanup_startup_failed",
error:
- cleanupError instanceof Error
- ? cleanupError.message
- : "Unknown error",
+ getErrorMessage(cleanupError),
});
}
} catch (error) {
@@ -2367,10 +3024,54 @@ async function handlePostInitFileEncryption() {
}
async function initializeDatabase(): Promise {
+ const dialect = resolveDatabaseDialect();
+
+ if (dialect !== "sqlite") {
+ await initializeRemoteDatabase(dialect);
+ return;
+ }
+
await initializeCompleteDatabase();
await handlePostInitFileEncryption();
}
+/**
+ * Startup against Postgres or MySQL.
+ *
+ * Shorter than the SQLite path because most of what that one does has no
+ * counterpart here: there is no file to decrypt, no in-memory copy to keep in
+ * step with disk, and the schema comes from drizzle-kit migrations instead of
+ * the inline DDL below.
+ *
+ * What does carry over is the settings cache. 27 call sites read settings
+ * synchronously, which better-sqlite3 allows and no remote driver does, so the
+ * table is loaded once here before anything asks for it.
+ */
+async function initializeRemoteDatabase(
+ dialect: Exclude,
+): Promise {
+ databaseLogger.info(`Connecting to ${dialect} database`, {
+ operation: "db_init",
+ dialect,
+ });
+
+ db = await connectRemoteDatabase(dialect);
+ await runRemoteMigrations(dialect, db);
+
+ // Imported here rather than at the top: factory.ts imports getDb from this
+ // module, and a static import would close the cycle at module-load time.
+ const { primeCurrentSettingsCache, startSettingsCacheRefresh } = await import(
+ "../repositories/factory.js"
+ );
+ await primeCurrentSettingsCache();
+ startSettingsCacheRefresh();
+
+ databaseLogger.info(`${dialect} database ready`, {
+ operation: "db_init_complete",
+ dialect,
+ });
+}
+
export { initializeDatabase };
async function cleanupDatabase() {
@@ -2395,7 +3096,7 @@ async function cleanupDatabase() {
} catch (error) {
databaseLogger.warn("Error closing database connection", {
operation: "db_close_error",
- error: error instanceof Error ? error.message : "Unknown error",
+ error: getErrorMessage(error),
});
}
@@ -2448,9 +3149,9 @@ process.on("SIGTERM", async () => {
process.exit(0);
});
-let db: ReturnType>;
+let db: PortableDatabase;
-export function getDb(): ReturnType> {
+export function getDb(): PortableDatabase {
if (!db) {
throw new Error(
"Database not initialized. Ensure initializeDatabase() is called before accessing db.",
@@ -2461,6 +3162,13 @@ export function getDb(): ReturnType> {
export function getSqlite(): Database.Database {
if (!sqlite) {
+ const dialect = resolveDatabaseDialect();
+ if (dialect !== "sqlite") {
+ throw new Error(
+ `No SQLite handle: DATABASE_DIALECT is "${dialect}". This caller needs a ` +
+ `synchronous query, which only SQLite offers โ give it an async path instead.`,
+ );
+ }
throw new Error(
"SQLite not initialized. Ensure initializeDatabase() is called before accessing sqlite.",
);
diff --git a/src/backend/database/db/migrate.ts b/src/backend/database/db/migrate.ts
new file mode 100644
index 0000000..57d9991
--- /dev/null
+++ b/src/backend/database/db/migrate.ts
@@ -0,0 +1,51 @@
+import path from "path";
+import type { DatabaseDialect } from "./dialect.js";
+import type { PortableDatabase } from "../repositories/database-context.js";
+
+export const MIGRATIONS_DIR_ENV = "DRIZZLE_MIGRATIONS_DIR";
+
+/**
+ * Where the generated migrations live.
+ *
+ * SQLite does not appear here: it builds its schema from the DDL in index.ts
+ * and patches it forward with migrateSchema(). Only the client-server engines
+ * use drizzle-kit migrations, and each has its own folder because the
+ * generated SQL differs per dialect.
+ */
+export function migrationsFolder(
+ dialect: DatabaseDialect,
+ env: NodeJS.ProcessEnv = process.env,
+): string {
+ const override = env[MIGRATIONS_DIR_ENV]?.trim();
+ const root = override || path.resolve(process.cwd(), "drizzle");
+ return path.join(root, dialect);
+}
+
+/**
+ * Brings a remote database up to the current schema.
+ *
+ * drizzle's migrator records what it has applied in its own table, so this is
+ * safe to run on every start โ including against a database another instance
+ * already migrated.
+ */
+export async function runRemoteMigrations(
+ dialect: DatabaseDialect,
+ db: PortableDatabase,
+ env: NodeJS.ProcessEnv = process.env,
+): Promise {
+ if (dialect === "sqlite") {
+ throw new Error("SQLite builds its schema in index.ts, not from drizzle/");
+ }
+
+ const folder = migrationsFolder(dialect, env);
+
+ const { migrate } =
+ dialect === "postgres"
+ ? await import("drizzle-orm/node-postgres/migrator")
+ : await import("drizzle-orm/mysql2/migrator");
+
+ await (migrate as (db: unknown, config: { migrationsFolder: string }) => Promise)(
+ db,
+ { migrationsFolder: folder },
+ );
+}
diff --git a/src/backend/database/db/performance-indexes.ts b/src/backend/database/db/performance-indexes.ts
new file mode 100644
index 0000000..2e1ca83
--- /dev/null
+++ b/src/backend/database/db/performance-indexes.ts
@@ -0,0 +1,352 @@
+import { databaseLogger } from "../../utils/logger.js";
+
+/**
+ * Indexes for the columns the app filters, joins and sorts on.
+ *
+ * Most tables here are scoped per user or per host and were previously reached
+ * with a full table scan on every read: the foreign keys existed, but SQLite
+ * does not index the child side of a foreign key on its own. That is fine for a
+ * home install with a handful of hosts and invisible in testing; on an install
+ * with thousands of hosts and a large audit trail it is the dominant cost of a
+ * request.
+ *
+ * Ordering within a composite matters: the equality column comes first and the
+ * range/sort column second, so the same index serves both the filter and the
+ * ORDER BY.
+ */
+export interface PerformanceIndex {
+ name: string;
+ table: string;
+ columns: string;
+ /** Enforces a constraint as well as serving reads, e.g. one row per key. */
+ unique?: boolean;
+}
+
+export const PERFORMANCE_INDEXES: PerformanceIndex[] = [
+ // Host list: the single hottest read in the app.
+ { name: "idx_ssh_data_user_id", table: "ssh_data", columns: "user_id" },
+ {
+ name: "idx_ssh_data_parent_host",
+ table: "ssh_data",
+ columns: "parent_host_id",
+ },
+ {
+ name: "idx_ssh_data_credential",
+ table: "ssh_data",
+ columns: "credential_id",
+ },
+
+ // Sharing: resolved for every host list request and every permission check.
+ { name: "idx_host_access_user_id", table: "host_access", columns: "user_id" },
+ { name: "idx_host_access_role_id", table: "host_access", columns: "role_id" },
+ { name: "idx_host_access_host_id", table: "host_access", columns: "host_id" },
+ {
+ name: "idx_host_access_expires_at",
+ table: "host_access",
+ columns: "expires_at",
+ },
+
+ // Audit log: grows without bound and is always read newest-first.
+ {
+ name: "idx_audit_logs_timestamp",
+ table: "audit_logs",
+ columns: "timestamp",
+ },
+ {
+ name: "idx_audit_logs_user_ts",
+ table: "audit_logs",
+ columns: "user_id, timestamp",
+ },
+ {
+ name: "idx_audit_logs_action_ts",
+ table: "audit_logs",
+ columns: "action, timestamp",
+ },
+ {
+ name: "idx_audit_logs_resource_ts",
+ table: "audit_logs",
+ columns: "resource_type, timestamp",
+ },
+
+ // Auth hot path: touched on every authenticated request.
+ { name: "idx_sessions_user_id", table: "sessions", columns: "user_id" },
+ { name: "idx_sessions_expires_at", table: "sessions", columns: "expires_at" },
+ { name: "idx_user_roles_user_id", table: "user_roles", columns: "user_id" },
+ { name: "idx_user_roles_role_id", table: "user_roles", columns: "role_id" },
+ {
+ name: "idx_trusted_devices_user_id",
+ table: "trusted_devices",
+ columns: "user_id",
+ },
+ { name: "idx_api_keys_user_id", table: "api_keys", columns: "user_id" },
+
+ // Credentials and folders.
+ {
+ name: "idx_ssh_credentials_user_id",
+ table: "ssh_credentials",
+ columns: "user_id",
+ },
+ { name: "idx_ssh_folders_user_id", table: "ssh_folders", columns: "user_id" },
+ {
+ name: "idx_ssh_credential_usage_credential",
+ table: "ssh_credential_usage",
+ columns: "credential_id",
+ },
+ {
+ name: "idx_ssh_credential_usage_user",
+ table: "ssh_credential_usage",
+ columns: "user_id",
+ },
+
+ // Snippets.
+ { name: "idx_snippets_user_id", table: "snippets", columns: "user_id" },
+ {
+ name: "idx_snippet_access_user_id",
+ table: "snippet_access",
+ columns: "user_id",
+ },
+ {
+ name: "idx_snippet_access_snippet_id",
+ table: "snippet_access",
+ columns: "snippet_id",
+ },
+ {
+ name: "idx_snippet_access_role_id",
+ table: "snippet_access",
+ columns: "role_id",
+ },
+
+ // Per-user history and file manager surfaces.
+ {
+ name: "idx_recent_activity_user_ts",
+ table: "recent_activity",
+ columns: "user_id, timestamp",
+ },
+ {
+ name: "idx_command_history_user_host",
+ table: "command_history",
+ columns: "user_id, host_id",
+ },
+ {
+ name: "idx_file_manager_recent_user",
+ table: "file_manager_recent",
+ columns: "user_id, host_id",
+ },
+ {
+ name: "idx_file_manager_pinned_user",
+ table: "file_manager_pinned",
+ columns: "user_id, host_id",
+ },
+ {
+ name: "idx_file_manager_shortcuts_user",
+ table: "file_manager_shortcuts",
+ columns: "user_id, host_id",
+ },
+ {
+ name: "idx_transfer_recent_user",
+ table: "transfer_recent",
+ columns: "user_id",
+ },
+ {
+ name: "idx_user_open_tabs_user_id",
+ table: "user_open_tabs",
+ columns: "user_id",
+ },
+ {
+ name: "idx_user_workspaces_user_id",
+ table: "user_workspaces",
+ columns: "user_id",
+ },
+ {
+ name: "idx_homepage_items_user_id",
+ table: "homepage_items",
+ columns: "user_id",
+ },
+ {
+ name: "idx_dismissed_alerts_user_id",
+ table: "dismissed_alerts",
+ columns: "user_id",
+ },
+
+ // Recordings and live session sharing.
+ {
+ name: "idx_session_recordings_user_started",
+ table: "session_recordings",
+ columns: "user_id, started_at",
+ },
+ {
+ name: "idx_session_recordings_host",
+ table: "session_recordings",
+ columns: "host_id",
+ },
+ {
+ name: "idx_session_shares_session_id",
+ table: "session_shares",
+ columns: "session_id",
+ },
+ {
+ name: "idx_session_shares_host_id",
+ table: "session_shares",
+ columns: "host_id",
+ },
+
+ // Fleets.
+ {
+ name: "idx_fleet_members_fleet",
+ table: "fleet_members",
+ columns: "fleet_id",
+ },
+ {
+ name: "idx_fleet_members_host",
+ table: "fleet_members",
+ columns: "host_id",
+ },
+ {
+ name: "idx_fleet_inventory_user",
+ table: "fleet_inventory",
+ columns: "user_id",
+ },
+
+ // Alerting.
+ {
+ name: "idx_alert_firings_rule",
+ table: "alert_firings",
+ columns: "rule_id, fired_at",
+ },
+ {
+ name: "idx_alert_firings_host",
+ table: "alert_firings",
+ columns: "host_id",
+ },
+
+ // Automations.
+ {
+ name: "idx_automations_user",
+ table: "automations",
+ columns: "user_id, enabled",
+ },
+ {
+ name: "idx_automation_trigger_state_key",
+ table: "automation_trigger_state",
+ columns: "automation_id, state_key",
+ unique: true,
+ },
+ {
+ name: "idx_automation_schedules_automation",
+ table: "automation_schedules",
+ columns: "automation_id",
+ unique: true,
+ },
+ {
+ name: "idx_automation_schedules_due",
+ table: "automation_schedules",
+ columns: "next_due_at",
+ },
+ {
+ name: "idx_automation_runs_automation",
+ table: "automation_runs",
+ columns: "automation_id, started_at",
+ },
+ {
+ name: "idx_automation_runs_user",
+ table: "automation_runs",
+ columns: "user_id, started_at",
+ },
+ {
+ name: "idx_automation_run_steps_run",
+ table: "automation_run_steps",
+ columns: "run_id, step_index",
+ },
+ {
+ name: "idx_automation_channels_pair",
+ table: "automation_channels",
+ columns: "automation_id, channel_id",
+ unique: true,
+ },
+
+ // AI assistant.
+ {
+ name: "idx_ai_providers_user_label",
+ table: "ai_providers",
+ columns: "user_id, label",
+ unique: true,
+ },
+ {
+ name: "idx_ai_conversations_user",
+ table: "ai_conversations",
+ columns: "user_id, updated_at",
+ },
+ {
+ name: "idx_ai_messages_conversation",
+ table: "ai_messages",
+ columns: "conversation_id, created_at",
+ },
+ {
+ name: "idx_ai_proposals_user",
+ table: "ai_proposals",
+ columns: "user_id, status",
+ },
+ {
+ name: "idx_ai_proposals_conversation",
+ table: "ai_proposals",
+ columns: "conversation_id",
+ },
+];
+
+interface IndexableDatabase {
+ exec(sql: string): unknown;
+}
+
+export interface IndexCreationSummary {
+ created: number;
+ skipped: number;
+ failed: number;
+}
+
+/**
+ * Creates any missing index, leaving existing ones untouched.
+ *
+ * A failure here is logged and skipped rather than thrown: an index is a pure
+ * optimisation, and a table that a given install has not created yet (or a
+ * column an older schema is missing) must not stop the server from booting.
+ */
+export function createPerformanceIndexes(
+ db: IndexableDatabase,
+ indexes: PerformanceIndex[] = PERFORMANCE_INDEXES,
+): IndexCreationSummary {
+ const summary: IndexCreationSummary = { created: 0, skipped: 0, failed: 0 };
+ const startedAt = Date.now();
+
+ for (const index of indexes) {
+ try {
+ db.exec(
+ `CREATE ${index.unique ? "UNIQUE " : ""}INDEX IF NOT EXISTS ${index.name} ON ${index.table}(${index.columns})`,
+ );
+ summary.created++;
+ } catch (error) {
+ const message = error instanceof Error ? error.message : String(error);
+ // A missing table or column means this install does not have that
+ // feature's schema; nothing to index and nothing to warn loudly about.
+ if (/no such table|no such column/i.test(message)) {
+ summary.skipped++;
+ continue;
+ }
+ summary.failed++;
+ databaseLogger.warn(`Could not create index ${index.name}: ${message}`, {
+ operation: "performance_index_create",
+ index: index.name,
+ table: index.table,
+ });
+ }
+ }
+
+ databaseLogger.info(
+ `Performance indexes ready in ${Date.now() - startedAt}ms`,
+ {
+ operation: "performance_index_create",
+ ...summary,
+ },
+ );
+
+ return summary;
+}
diff --git a/src/backend/database/db/schema.mysql.ts b/src/backend/database/db/schema.mysql.ts
new file mode 100644
index 0000000..97253eb
--- /dev/null
+++ b/src/backend/database/db/schema.mysql.ts
@@ -0,0 +1,1941 @@
+// GENERATED FILE โ do not edit.
+//
+// Produced from schema.ts by scripts/generate-dialect-schema.cjs.
+// Edit the sqlite schema and re-run `node scripts/generate-dialect-schema.cjs`.
+// Target dialect: mysql.
+//
+// DDL source for drizzle-kit. NOT imported to run queries โ repositories use
+// schema.ts on every dialect. See the generator header for why that is correct.
+
+import {
+ mysqlTable,
+ text,
+ varchar,
+ int,
+ boolean,
+ double,
+ index,
+ uniqueIndex,
+ type AnyMySqlColumn,
+} from "drizzle-orm/mysql-core";
+import { sql } from "drizzle-orm";
+
+export const users = mysqlTable("users", {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ username: text("username").notNull(),
+ passwordHash: text("password_hash").notNull(),
+ isAdmin: boolean("is_admin").notNull().default(false),
+
+ isOidc: boolean("is_oidc").notNull().default(false),
+ oidcIdentifier: text("oidc_identifier"),
+ ssoProviderId: int("sso_provider_id"),
+ clientId: text("client_id"),
+ clientSecret: text("client_secret"),
+ issuerUrl: text("issuer_url"),
+ authorizationUrl: text("authorization_url"),
+ tokenUrl: text("token_url"),
+ identifierPath: text("identifier_path"),
+ namePath: text("name_path"),
+ scopes: text().default("openid email profile"),
+
+ totpSecret: text("totp_secret"),
+ totpEnabled: boolean("totp_enabled")
+ .notNull()
+ .default(false),
+ totpBackupCodes: text("totp_backup_codes"),
+
+ registeredAt: text("registered_at").notNull().default(sql`(CURRENT_TIMESTAMP)`),
+ donationModalDismissed: boolean("donation_modal_dismissed")
+ .notNull()
+ .default(false),
+});
+
+export const settings = mysqlTable("settings", {
+ key: varchar("key", { length: 255 }).primaryKey(),
+ value: text("value").notNull(),
+});
+
+export const ssoProviders = mysqlTable("sso_providers", {
+ id: int("id").autoincrement().primaryKey(),
+ name: varchar("name", { length: 255 }).notNull(),
+ type: text("type").notNull(),
+ enabled: boolean("enabled").notNull().default(true),
+ displayOrder: int("display_order").notNull().default(0),
+ config: text("config").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const sessions = mysqlTable(
+ "sessions",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ jwtToken: text("jwt_token").notNull(),
+ deviceType: text("device_type").notNull(),
+ deviceInfo: text("device_info").notNull(),
+ oidcSub: text("oidc_sub"),
+ oidcSid: text("oidc_sid"),
+ ssoProviderId: int("sso_provider_id"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ lastActiveAt: text("last_active_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // Listing a user's devices, and the startup sweep of expired rows.
+ (table) => [
+ index("idx_sessions_user_id").on(table.userId),
+ index("idx_sessions_expires_at").on(table.expiresAt),
+ ],
+);
+
+export const trustedDevices = mysqlTable(
+ "trusted_devices",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ deviceFingerprint: text("device_fingerprint").notNull(),
+ deviceType: text("device_type").notNull(),
+ deviceInfo: text("device_info").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ lastUsedAt: text("last_used_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [index("idx_trusted_devices_user_id").on(table.userId)],
+);
+
+export const webauthnCredentials = mysqlTable("webauthn_credentials", {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ credentialId: varchar("credential_id", { length: 255 }).notNull(),
+ publicKey: text("public_key").notNull(),
+ counter: int("counter").notNull().default(0),
+ deviceType: text("device_type"),
+ backedUp: boolean("backed_up").notNull().default(false),
+ transports: text("transports"),
+ userVerification: text("user_verification").notNull().default("preferred"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ lastUsedAt: text("last_used_at"),
+});
+
+export const hosts = mysqlTable(
+ "ssh_data",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ connectionType: text("connection_type").notNull().default("ssh"),
+ name: varchar("name", { length: 255 }),
+ ip: text("ip").notNull(),
+ port: int("port").notNull(),
+ username: text("username").notNull(),
+ folder: text("folder"),
+ // Sub-host nesting: a host acting as an organizational parent for other
+ // hosts, mutually exclusive with folder (see host route validation).
+ parentHostId: int("parent_host_id").references(
+ (): AnyMySqlColumn => hosts.id,
+ { onDelete: "set null" },
+ ),
+ tags: text("tags"),
+ pin: boolean("pin").notNull().default(false),
+ // Manual drag-to-reorder position within a folder. Null means the host has
+ // never been manually reordered; falls back to name sort in that case.
+ sortOrder: int("sort_order"),
+ authType: text("auth_type").notNull(),
+ useWarpgate: boolean("use_warpgate").notNull().default(false),
+ shareSshAuth: boolean("share_ssh_auth")
+ .notNull()
+ .default(false),
+ forceKeyboardInteractive: text("force_keyboard_interactive"),
+
+ password: text("password"),
+ key: text("key"),
+ keyPassword: text("key_password"),
+ keyType: text("key_type"),
+ sudoPassword: text("sudo_password"),
+
+ autostartPassword: text("autostart_password"),
+ autostartKey: text("autostart_key"),
+ autostartKeyPassword: text("autostart_key_password"),
+
+ credentialId: int("credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ overrideCredentialUsername: boolean("override_credential_username"),
+ // When authType is "vault", the host authenticates via a Vault SSH signer
+ // profile (shared settings, no secrets). The signing certificate is obtained
+ // per-user at connect time via an interactive Vault OIDC flow.
+ vaultProfileId: int("vault_profile_id").references(
+ () => vaultProfiles.id,
+ { onDelete: "set null" },
+ ),
+ enableTerminal: boolean("enable_terminal")
+ .notNull()
+ .default(true),
+ enableSessionLogging: boolean("enable_session_logging")
+ .notNull()
+ .default(true),
+ allowSessionSharing: boolean("allow_session_sharing")
+ .notNull()
+ .default(true),
+ enableCommandHistory: boolean("enable_command_history")
+ .notNull()
+ .default(true),
+ enableTunnel: boolean("enable_tunnel")
+ .notNull()
+ .default(true),
+ tunnelConnections: text("tunnel_connections"),
+ jumpHosts: text("jump_hosts"),
+ enableFileManager: boolean("enable_file_manager")
+ .notNull()
+ .default(true),
+ scpLegacy: boolean("scp_legacy").notNull().default(false),
+ enableDocker: boolean("enable_docker")
+ .notNull()
+ .default(false),
+ enableTmuxMonitor: boolean("enable_tmux_monitor")
+ .notNull()
+ .default(false),
+ enableTerminalToolbar: boolean("enable_terminal_toolbar")
+ .notNull()
+ .default(true),
+ showTerminalInSidebar: boolean("show_terminal_in_sidebar")
+ .notNull()
+ .default(true),
+ showFileManagerInSidebar: boolean("show_file_manager_in_sidebar")
+ .notNull()
+ .default(false),
+ showTunnelInSidebar: boolean("show_tunnel_in_sidebar")
+ .notNull()
+ .default(false),
+ showDockerInSidebar: boolean("show_docker_in_sidebar")
+ .notNull()
+ .default(false),
+ showServerStatsInSidebar: boolean("show_server_stats_in_sidebar")
+ .notNull()
+ .default(false),
+ defaultPath: text("default_path"),
+ statsConfig: text("stats_config"),
+ dockerConfig: text("docker_config"),
+ enableProxmox: boolean("enable_proxmox")
+ .notNull()
+ .default(false),
+ proxmoxConfig: text("proxmox_config"),
+ enableProxmoxStats: boolean("enable_proxmox_stats")
+ .notNull()
+ .default(false),
+ proxmoxStatsConfig: text("proxmox_stats_config"),
+ terminalConfig: text("terminal_config"),
+ quickActions: text("quick_actions"),
+ notes: text("notes"),
+ enableSsh: boolean("enable_ssh").notNull().default(true),
+ enableRdp: boolean("enable_rdp").notNull().default(false),
+ enableVnc: boolean("enable_vnc").notNull().default(false),
+ enableTelnet: boolean("enable_telnet").notNull().default(false),
+
+ sshPort: int("ssh_port").default(22),
+ rdpPort: int("rdp_port").default(3389),
+ vncPort: int("vnc_port").default(5900),
+ telnetPort: int("telnet_port").default(23),
+
+ rdpCredentialId: int("rdp_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ rdpUser: text("rdp_user"),
+ rdpPassword: text("rdp_password"),
+ rdpDomain: text("rdp_domain"),
+ rdpSecurity: text("rdp_security"),
+ rdpIgnoreCert: boolean("rdp_ignore_cert").default(false),
+
+ vncCredentialId: int("vnc_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ vncPassword: text("vnc_password"),
+ vncUser: text("vnc_user"),
+
+ telnetUser: text("telnet_user"),
+ telnetPassword: text("telnet_password"),
+ telnetCredentialId: int("telnet_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+
+ rdpAuthType: text("rdp_auth_type"),
+ vncAuthType: text("vnc_auth_type"),
+ telnetAuthType: text("telnet_auth_type"),
+
+ domain: text("domain"),
+ security: text("security"),
+ ignoreCert: boolean("ignore_cert").default(false),
+ guacamoleConfig: text("guacamole_config"),
+
+ useSocks5: boolean("use_socks5"),
+ socks5Host: text("socks5_host"),
+ socks5Port: int("socks5_port"),
+ socks5Username: text("socks5_username"),
+ socks5Password: text("socks5_password"),
+ socks5ProxyChain: text("socks5_proxy_chain"),
+
+ // null = use the desktop app's global default; "local" | "remote" pins
+ // this specific host's SSH/Docker-console/Serial connections to originate
+ // from the embedded local backend or a connected remote sync server.
+ // Ignored for rdp/vnc/telnet, which always require the remote server.
+ connectionOrigin: text("connection_origin"),
+
+ macAddress: text("mac_address"),
+ wolBroadcastAddress: text("wol_broadcast_address"),
+ portKnockSequence: text("port_knock_sequence"),
+
+ hostKeyFingerprint: text("host_key_fingerprint"),
+ hostKeyType: text("host_key_type"),
+ hostKeyAlgorithm: text("host_key_algorithm").default("sha256"),
+ hostKeyFirstSeen: text("host_key_first_seen"),
+ hostKeyLastVerified: text("host_key_last_verified"),
+ hostKeyChangedCount: int("host_key_changed_count").default(0),
+
+ // Stable identity used to match this row across two independently-seeded
+ // databases (the embedded backend and a connected remote server) during
+ // sync -- local autoincrement ids collide across instances.
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // Every host read is scoped by owner, so user_id carries the host list.
+ //
+ // `folder` is deliberately not indexed: on Postgres/MySQL an indexed text
+ // column is generated as varchar(255), and folder holds a joined nested path
+ // with no length cap, so indexing it would truncate deep hierarchies.
+ (table) => [
+ index("idx_ssh_data_user_id").on(table.userId),
+ index("idx_ssh_data_parent_host").on(table.parentHostId),
+ index("idx_ssh_data_credential").on(table.credentialId),
+ ],
+);
+
+export const fileManagerRecent = mysqlTable(
+ "file_manager_recent",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ path: text("path").notNull(),
+ lastOpened: text("last_opened")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // Every file manager surface is read for one user on one host at a time.
+ (table) => [
+ index("idx_file_manager_recent_user").on(table.userId, table.hostId),
+ ],
+);
+
+export const fileManagerPinned = mysqlTable(
+ "file_manager_pinned",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ path: text("path").notNull(),
+ pinnedAt: text("pinned_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ index("idx_file_manager_pinned_user").on(table.userId, table.hostId),
+ ],
+);
+
+export const fileManagerShortcuts = mysqlTable(
+ "file_manager_shortcuts",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ path: text("path").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ index("idx_file_manager_shortcuts_user").on(table.userId, table.hostId),
+ ],
+);
+
+export const transferRecent = mysqlTable(
+ "transfer_recent",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ sourceHostId: int("source_host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ destHostId: int("dest_host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ destPath: text("dest_path").notNull(),
+ destPathLabel: text("dest_path_label").notNull(),
+ lastUsed: text("last_used")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [index("idx_transfer_recent_user").on(table.userId)],
+);
+
+export const dismissedAlerts = mysqlTable(
+ "dismissed_alerts",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ alertId: text("alert_id").notNull(),
+ dismissedAt: text("dismissed_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [index("idx_dismissed_alerts_user_id").on(table.userId)],
+);
+
+export const sshCredentials = mysqlTable(
+ "ssh_credentials",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ description: text("description"),
+ folder: text("folder"),
+ tags: text("tags"),
+ pin: boolean("pin").notNull().default(false),
+ // Manual drag-to-reorder position within a folder. Null means the
+ // credential has never been manually reordered; falls back to name sort
+ // in that case, same convention as hosts.sortOrder.
+ sortOrder: int("sort_order"),
+ authType: text("auth_type").notNull(),
+ username: text("username"),
+ password: text("password"),
+ key: text("key"),
+ privateKey: text("private_key"),
+ publicKey: text("public_key"),
+ keyPassword: text("key_password"),
+ keyType: text("key_type"),
+ detectedKeyType: text("detected_key_type"),
+
+ certPublicKey: text("cert_public_key"),
+
+
+ usageCount: int("usage_count").notNull().default(0),
+ lastUsed: text("last_used"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [index("idx_ssh_credentials_user_id").on(table.userId)],
+);
+
+export const sshCredentialUsage = mysqlTable(
+ "ssh_credential_usage",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ credentialId: int("credential_id")
+ .notNull()
+ .references(() => sshCredentials.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ usedAt: text("used_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ index("idx_ssh_credential_usage_credential").on(table.credentialId),
+ index("idx_ssh_credential_usage_user").on(table.userId),
+ ],
+);
+
+export const snippets = mysqlTable(
+ "snippets",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ content: text("content").notNull(),
+ description: text("description"),
+ folder: text("folder"),
+ order: int("order").notNull().default(0),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ hostFilter: text("host_filter"),
+ isNote: boolean("is_note").notNull().default(false),
+ },
+ (table) => [index("idx_snippets_user_id").on(table.userId)],
+);
+
+export const snippetFolders = mysqlTable("snippet_folders", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ color: text("color"),
+ icon: text("icon"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const c2sTunnelPresets = mysqlTable("c2s_tunnel_presets", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ config: text("config").notNull(),
+ platform: text("platform"),
+ computerName: text("computer_name"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const snippetAccess = mysqlTable(
+ "snippet_access",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ snippetId: int("snippet_id")
+ .notNull()
+ .references(() => snippets.id, { onDelete: "cascade" }),
+
+ userId: varchar("user_id", { length: 255 }).references(() => users.id, { onDelete: "cascade" }),
+ roleId: int("role_id").references(() => roles.id, {
+ onDelete: "cascade",
+ }),
+
+ grantedBy: varchar("granted_by", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+
+ permissionLevel: text("permission_level").notNull().default("view"),
+
+ expiresAt: varchar("expires_at", { length: 255 }),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // Same three lookup shapes as host_access: by grantee, by role, by snippet.
+ (table) => [
+ index("idx_snippet_access_user_id").on(table.userId),
+ index("idx_snippet_access_snippet_id").on(table.snippetId),
+ index("idx_snippet_access_role_id").on(table.roleId),
+ ],
+);
+
+export const sshFolders = mysqlTable(
+ "ssh_folders",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ color: text("color"),
+ icon: text("icon"),
+ credentialId: int("credential_id").references(() => sshCredentials.id, {
+ onDelete: "set null",
+ }),
+ // Manual drag-to-reorder position among sibling folders. Null falls back
+ // to name sort, same convention as hosts.sortOrder.
+ sortOrder: int("sort_order"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [index("idx_ssh_folders_user_id").on(table.userId)],
+);
+
+export const recentActivity = mysqlTable(
+ "recent_activity",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ type: text("type").notNull(),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ hostName: text("host_name"),
+ timestamp: varchar("timestamp", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // Always read newest-first for one user, so timestamp follows user_id.
+ (table) => [
+ index("idx_recent_activity_user_ts").on(table.userId, table.timestamp),
+ ],
+);
+
+export const commandHistory = mysqlTable(
+ "command_history",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ command: text("command").notNull(),
+ executedAt: text("executed_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ index("idx_command_history_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const networkTopology = mysqlTable("network_topology", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ topology: text("topology"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const hostAccess = mysqlTable(
+ "host_access",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+
+ userId: varchar("user_id", { length: 255 })
+ .references(() => users.id, { onDelete: "cascade" }),
+ roleId: int("role_id")
+ .references(() => roles.id, { onDelete: "cascade" }),
+
+ grantedBy: varchar("granted_by", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+
+ permissionLevel: text("permission_level")
+ .notNull()
+ .default("connect"),
+
+ expiresAt: varchar("expires_at", { length: 255 }),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ lastAccessedAt: text("last_accessed_at"),
+ accessCount: int("access_count").notNull().default(0),
+ },
+ // Resolved on every host list request and every permission check, so all
+ // three lookup shapes (by grantee, by role, by host) need to be indexed.
+ (table) => [
+ index("idx_host_access_user_id").on(table.userId),
+ index("idx_host_access_role_id").on(table.roleId),
+ index("idx_host_access_host_id").on(table.hostId),
+ index("idx_host_access_expires_at").on(table.expiresAt),
+ ],
+);
+
+export const sharedHostAuthOverrides = mysqlTable(
+ "shared_host_auth_overrides",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ protocol: varchar("protocol", { length: 255 }).notNull().default("ssh"),
+ credentialId: int("credential_id")
+ .notNull()
+ .references(() => sshCredentials.id, { onDelete: "cascade" }),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ uniqueIndex("shared_host_auth_overrides_host_user_protocol_unique").on(
+ table.hostId,
+ table.userId,
+ table.protocol,
+ ),
+ ],
+);
+
+export const sharedHostSecrets = mysqlTable(
+ "shared_host_secrets",
+ {
+ id: int("id").autoincrement().primaryKey(),
+
+ hostAccessId: int("host_access_id")
+ .notNull()
+ .references(() => hostAccess.id, { onDelete: "cascade" }),
+
+ targetUserId: varchar("target_user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+
+ protocol: varchar("protocol", { length: 255 }).notNull().default("ssh"),
+ sourceType: text("source_type").notNull().default("credential"),
+
+ originalCredentialId: int("original_credential_id").references(
+ () => sshCredentials.id,
+ { onDelete: "cascade" },
+ ),
+
+ encryptedUsername: text("encrypted_username"),
+ encryptedAuthType: text("encrypted_auth_type"),
+ encryptedPassword: text("encrypted_password"),
+ encryptedKey: text("encrypted_key"),
+ encryptedKeyPassword: text("encrypted_key_password"),
+ encryptedKeyType: text("encrypted_key_type"),
+ encryptedDomain: text("encrypted_domain"),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ (table) => [
+ uniqueIndex("idx_shared_host_secrets_scope").on(
+ table.hostAccessId,
+ table.targetUserId,
+ table.protocol,
+ ),
+ ],
+);
+
+export const roles = mysqlTable("roles", {
+ id: int("id").autoincrement().primaryKey(),
+ name: varchar("name", { length: 255 }).notNull().unique(),
+ displayName: text("display_name").notNull(),
+ description: text("description"),
+
+ isSystem: boolean("is_system")
+ .notNull()
+ .default(false),
+
+ permissions: text("permissions"),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const userRoles = mysqlTable(
+ "user_roles",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ roleId: int("role_id")
+ .notNull()
+ .references(() => roles.id, { onDelete: "cascade" }),
+
+ grantedBy: varchar("granted_by", { length: 255 }).references(() => users.id, {
+ onDelete: "set null",
+ }),
+ grantedAt: text("granted_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ //
+ // The unique pair already serves lookups by user, since user_id leads it.
+ // Listing a role's members starts from role_id, which it cannot serve.
+ (table) => [
+ uniqueIndex("idx_user_roles_user_role").on(table.userId, table.roleId),
+ index("idx_user_roles_role_id").on(table.roleId),
+ ],
+);
+
+export const auditLogs = mysqlTable(
+ "audit_logs",
+ {
+ id: int("id").autoincrement().primaryKey(),
+
+ // Nullable on purpose: the trail outlives the account, and username keeps the
+ // entry attributable once the reference is gone.
+ userId: varchar("user_id", { length: 255 }).references(() => users.id, { onDelete: "set null" }),
+ username: text("username").notNull(),
+
+ action: varchar("action", { length: 255 }).notNull(),
+ resourceType: varchar("resource_type", { length: 255 }).notNull(),
+ resourceId: text("resource_id"),
+ resourceName: text("resource_name"),
+
+ details: text("details"),
+ ipAddress: text("ip_address"),
+ userAgent: text("user_agent"),
+
+ success: boolean("success").notNull(),
+ errorMessage: text("error_message"),
+
+ timestamp: varchar("timestamp", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // This table only grows, and is always read newest-first with an optional
+ // filter. Each composite leads with the filtered column so the same index
+ // also satisfies the ORDER BY.
+ (table) => [
+ index("idx_audit_logs_timestamp").on(table.timestamp),
+ index("idx_audit_logs_user_ts").on(table.userId, table.timestamp),
+ index("idx_audit_logs_action_ts").on(table.action, table.timestamp),
+ index("idx_audit_logs_resource_ts").on(table.resourceType, table.timestamp),
+ ],
+);
+
+export const sessionRecordings = mysqlTable(
+ "session_recordings",
+ {
+ id: int("id").autoincrement().primaryKey(),
+
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ // Nullable on purpose: a recording is evidence about the host as much as the
+ // person, so it outlives the account. username keeps it attributable.
+ userId: varchar("user_id", { length: 255 }).references(() => users.id, { onDelete: "set null" }),
+ username: text("username"),
+ accessId: int("access_id").references(() => hostAccess.id, {
+ onDelete: "set null",
+ }),
+
+ startedAt: varchar("started_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ endedAt: text("ended_at"),
+ duration: int("duration"),
+
+ commands: text("commands"),
+ dangerousActions: text("dangerous_actions"),
+
+ recordingPath: text("recording_path"),
+ protocol: varchar("protocol", { length: 255 }).notNull().default("ssh"),
+ format: text("format").notNull().default("text"),
+
+ terminatedByOwner: boolean("terminated_by_owner").default(false),
+ terminationReason: text("termination_reason"),
+ },
+ // Listed newest-first per user, and audited per host.
+ (table) => [
+ index("idx_session_recordings_user_started").on(
+ table.userId,
+ table.startedAt,
+ ),
+ index("idx_session_recordings_host").on(table.hostId),
+ ],
+);
+
+export const sessionShares = mysqlTable(
+ "session_shares",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ ownerUserId: varchar("owner_user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+
+ protocol: varchar("protocol", { length: 255 }).notNull(),
+
+ // Live-session binding: TerminalSessionManager's session.id for SSH, or
+ // guacd's own guacamoleConnectionId for rdp/vnc/telnet. Neither is a DB
+ // row (process-local, in-memory) so this intentionally has no FK.
+ sessionId: varchar("session_id", { length: 255 }).notNull(),
+ tabInstanceId: text("tab_instance_id"),
+
+ shareType: text("share_type").notNull(), // "link" | "user"
+ targetUserId: varchar("target_user_id", { length: 255 }).references(() => users.id, {
+ onDelete: "cascade",
+ }),
+ linkToken: varchar("link_token", { length: 255 }).unique(),
+
+ permissionLevel: text("permission_level").notNull().default("read-only"),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ revokedAt: text("revoked_at"),
+
+ lastJoinedAt: text("last_joined_at"),
+ joinCount: int("join_count").notNull().default(0),
+ },
+ // Resolved from the live session on join, and listed per host.
+ (table) => [
+ index("idx_session_shares_session_id").on(table.sessionId),
+ index("idx_session_shares_host_id").on(table.hostId),
+ ],
+);
+
+export const sessionShareParticipants = mysqlTable(
+ "session_share_participants",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ shareId: varchar("share_id", { length: 255 })
+ .notNull()
+ .references(() => sessionShares.id, { onDelete: "cascade" }),
+
+ userId: varchar("user_id", { length: 255 }).references(() => users.id, {
+ onDelete: "cascade",
+ }),
+ guestLabel: text("guest_label"),
+
+ joinedAt: text("joined_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ leftAt: text("left_at"),
+ },
+);
+
+export const opksshTokens = mysqlTable(
+ "opkssh_tokens",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+
+ sshCert: text("ssh_cert").notNull(),
+ privateKey: text("private_key").notNull(),
+
+ email: text("email"),
+ sub: text("sub"),
+ issuer: text("issuer"),
+ audience: text("audience"),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ lastUsed: text("last_used"),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ (table) => [uniqueIndex("idx_opkssh_tokens_user_host").on(table.userId, table.hostId)],
+);
+
+// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
+// are intended to be shared across users (shared === true makes a profile
+// visible to every user on the server). Each user authenticates to Vault via an
+// interactive OIDC flow at connect time; no tokens or keys are stored here.
+export const vaultProfiles = mysqlTable("vault_profiles", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ description: text("description"),
+ folder: text("folder"),
+ tags: text("tags"),
+ // Vault server connection (non-secret)
+ vaultAddr: text("vault_addr").notNull(),
+ vaultNamespace: text("vault_namespace"),
+ // OIDC auth method mount + role used to obtain a Vault token interactively
+ oidcMount: text("oidc_mount"),
+ oidcRole: text("oidc_role"),
+ // SSH secrets engine mount + signer role used to sign the ephemeral key
+ sshMount: text("ssh_mount"),
+ sshRole: text("ssh_role").notNull(),
+ validPrincipals: text("valid_principals"),
+ // Ephemeral keypair algorithm to generate per connection
+ keyType: text("key_type"),
+ // When true the profile is visible/usable by all users on the server
+ shared: boolean("shared").notNull().default(false),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
+// Transient: rows live only until the certificate expires. Secret fields are
+// encrypted under the user's data-encryption key (see field-crypto.ts).
+export const vaultTokens = mysqlTable(
+ "vault_tokens",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ profileId: int("profile_id")
+ .notNull()
+ .references(() => vaultProfiles.id, { onDelete: "cascade" }),
+
+ sshCert: text("ssh_cert").notNull(),
+ privateKey: text("private_key").notNull(),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ lastUsed: text("last_used"),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ (table) => [uniqueIndex("idx_vault_tokens_user_profile").on(table.userId, table.profileId)],
+);
+
+export const apiKeys = mysqlTable(
+ "api_keys",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ tokenHash: text("token_hash").notNull(),
+ tokenPrefix: text("token_prefix").notNull(),
+ createdAt: varchar("created_at", { length: 255 }).notNull().default(sql`(CURRENT_TIMESTAMP)`),
+ expiresAt: varchar("expires_at", { length: 255 }),
+ lastUsedAt: text("last_used_at"),
+ isActive: boolean("is_active").notNull().default(true),
+ },
+ (table) => [index("idx_api_keys_user_id").on(table.userId)],
+);
+
+export const userOpenTabs = mysqlTable(
+ "user_open_tabs",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ tabType: text("tab_type").notNull(),
+ hostId: int("host_id").references(() => hosts.id, {
+ onDelete: "cascade",
+ }),
+ label: varchar("label", { length: 255 }).notNull(),
+ tabOrder: int("tab_order").notNull().default(0),
+ backendSessionId: text("backend_session_id"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [index("idx_user_open_tabs_user_id").on(table.userId)],
+);
+
+export const userPreferences = mysqlTable("user_preferences", {
+ userId: varchar("user_id", { length: 255 })
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ reopenTabsOnLogin: boolean("reopen_tabs_on_login")
+ .notNull()
+ .default(false),
+ theme: text("theme"),
+ fontSize: text("font_size"),
+ accentColor: text("accent_color"),
+ language: text("language"),
+ storageMode: text("storage_mode"),
+ commandAutocomplete: boolean("command_autocomplete"),
+ commandPaletteEnabled: boolean("command_palette_enabled"),
+ showHostTags: boolean("show_host_tags"),
+ hostTrayOnClick: boolean("host_tray_on_click"),
+ pinAppRail: boolean("pin_app_rail"),
+ expandAppRailOnHover: boolean("expand_app_rail_on_hover"),
+ foldersCollapsed: boolean("folders_collapsed"),
+ confirmSnippetExecution: boolean("confirm_snippet_execution"),
+ disableUpdateCheck: boolean("disable_update_check"),
+ confirmTabClose: boolean("confirm_tab_close"),
+ hiddenRailTabs: text("hidden_rail_tabs"),
+ // null means the user has not been asked yet; the assistant stays hidden
+ // until this is explicitly true and the admin global is on.
+ aiAssistantEnabled: boolean("ai_assistant_enabled"),
+ // Opt-in to letting the assistant run allowlisted read-only diagnostics
+ // without a per-command approval click.
+ aiReadOnlyCommands: boolean("ai_read_only_commands"),
+ compactHostView: boolean("compact_host_view"),
+ statusColorScheme: text("status_color_scheme"),
+ customThemes: text("custom_themes"),
+ customKeybindings: text("custom_keybindings"),
+ terminalDefaults: text("terminal_defaults"),
+ rdpDefaults: text("rdp_defaults"),
+ terminalMacros: text("terminal_macros"),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const hostMetricsPreferences = mysqlTable(
+ "host_metrics_preferences",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ // JSON-encoded HostMetricsLayout. Layout has no secrets, so it is stored as
+ // plain JSON (no field-level encryption).
+ layout: text("layout").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // One layout per user per host. Enforced in production since the inline DDL
+ // creates it, but it was never declared here, so the generated Postgres and
+ // MySQL schemas lacked it โ and the upsert has nothing to conflict on.
+ (table) => [
+ uniqueIndex("idx_host_metrics_prefs_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const proxmoxStatsPreferences = mysqlTable(
+ "proxmox_stats_preferences",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 }).notNull().references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id").notNull().references(() => hosts.id, { onDelete: "cascade" }),
+ // JSON-encoded ProxmoxStatsLayout. Layout has no secrets, so it is stored as
+ // plain JSON (no field-level encryption), same convention as hostMetricsPreferences.layout.
+ layout: text("layout").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ uniqueIndex("idx_proxmox_stats_prefs_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const hostSidebarPreferences = mysqlTable("host_sidebar_preferences", {
+ userId: varchar("user_id", { length: 255 })
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON-encoded HostSidebarPreferences. No secrets in this blob, stored as
+ // plain JSON like hostMetricsPreferences.layout.
+ data: text("data").notNull(),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const credentialSidebarPreferences = mysqlTable(
+ "credential_sidebar_preferences",
+ {
+ userId: varchar("user_id", { length: 255 })
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON-encoded CredentialSidebarPreferences. No secrets in this blob,
+ // same convention as hostSidebarPreferences.data.
+ data: text("data").notNull(),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+);
+
+export const uiPreferences = mysqlTable("ui_preferences", {
+ userId: varchar("user_id", { length: 255 })
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON-encoded UiPreferences (preset + per-area overrides + onboarding
+ // state). No secrets in this blob, same convention as
+ // hostSidebarPreferences.data.
+ data: text("data").notNull(),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const hostHealthChecks = mysqlTable(
+ "host_health_checks",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ // JSON array of { id, name, type: "tcp"|"http", target, port, path }
+ checks: text("checks").notNull(),
+ intervalSeconds: int("interval_seconds").notNull().default(300),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // Same as above: one set of checks per user per host.
+ (table) => [
+ uniqueIndex("idx_host_health_checks_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const hostHealthHistory = mysqlTable("host_health_history", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ checkId: text("check_id").notNull(),
+ ts: text("ts").notNull().default(sql`(CURRENT_TIMESTAMP)`),
+ ok: boolean("ok").notNull(),
+ latencyMs: int("latency_ms"),
+ detail: text("detail"),
+});
+
+export const dashboardServiceLinks = mysqlTable("dashboard_service_links", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ label: varchar("label", { length: 255 }).notNull(),
+ url: text("url").notNull(),
+ order: int("order").notNull().default(0),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+// --- termix-id begin ---
+// A user claims a unique public handle. Their published SSH public keys are
+// served at an unauthenticated resolver endpoint in authorized_keys format,
+// so any server can be provisioned with `curl /termix-id/u/ >> ~/.ssh/authorized_keys`.
+export const termixIdentities = mysqlTable("termix_identities", {
+ id: int("id").autoincrement().primaryKey(),
+ // One Termix ID per user โ enforced in schema, not just in code.
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .unique()
+ .references(() => users.id, { onDelete: "cascade" }),
+ handle: varchar("handle", { length: 255 }).notNull().unique(),
+ description: text("description"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const termixIdentityKeys = mysqlTable("termix_identity_keys", {
+ id: int("id").autoincrement().primaryKey(),
+ identityId: int("identity_id")
+ .notNull()
+ .references(() => termixIdentities.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // Public keys are non-secret, so they are stored in plaintext (no field-level
+ // encryption). This is what lets the unauthenticated resolver serve them.
+ publicKey: text("public_key").notNull(),
+ // Raw algorithm token (e.g. "ssh-ed25519"), and a normalized group used for
+ // the / resolver filter (RSA / ED25519 / ECDSA / ...).
+ keyType: text("key_type").notNull(),
+ algorithm: text("algorithm").notNull(),
+ label: varchar("label", { length: 255 }),
+ comment: text("comment"),
+ // "manual" (pasted) or "credential" (imported from an ssh_credentials entry).
+ source: text("source").notNull().default("manual"),
+ credentialId: int("credential_id").references(() => sshCredentials.id, {
+ onDelete: "set null",
+ }),
+ enabled: boolean("enabled").notNull().default(true),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+// Per-identity certificate authority. Servers that trust this CA (via
+// TrustedUserCAKeys / @cert-authority) accept any user certificate it signs,
+// giving central revocation (rotate the CA) and expiry (cert validity).
+export const termixIdentityCa = mysqlTable("termix_identity_ca", {
+ id: int("id").autoincrement().primaryKey(),
+ identityId: int("identity_id")
+ .notNull()
+ .unique()
+ .references(() => termixIdentities.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // CA public key (plaintext โ it is published); CA private key is field-encrypted.
+ publicKey: text("public_key").notNull(),
+ privateKey: text("private_key").notNull(),
+ validityDays: int("validity_days").notNull().default(90),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+// --- termix-id end ---
+
+// --- tmux-monitor begin ---
+export const tmuxSessionTags = mysqlTable("tmux_session_tags", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ sessionName: text("session_name").notNull(),
+ tag: text("tag").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+// --- tmux-monitor end ---
+
+// --- metrics-history begin ---
+export const hostMetricsHistory = mysqlTable("host_metrics_history", {
+ id: int("id").autoincrement().primaryKey(),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ ts: text("ts")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ cpuPercent: double("cpu_percent"),
+ memPercent: double("mem_percent"),
+ diskPercent: double("disk_percent"),
+ netRxBytes: int("net_rx_bytes"),
+ netTxBytes: int("net_tx_bytes"),
+});
+// --- metrics-history end ---
+
+// --- proxmox-node-history begin ---
+export const proxmoxNodeHistory = mysqlTable("proxmox_node_history", {
+ id: int("id").autoincrement().primaryKey(),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ ts: text("ts")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ cpuPercent: double("cpu_percent"),
+ memPercent: double("mem_percent"),
+ diskPercent: double("disk_percent"),
+ netRxBytes: int("net_rx_bytes"),
+ netTxBytes: int("net_tx_bytes"),
+});
+// --- proxmox-node-history end ---
+
+// --- alerts begin ---
+export const alertRules = mysqlTable("alert_rules", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: int("host_id").references(() => hosts.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ enabled: boolean("enabled").notNull().default(true),
+ triggerType: text("trigger_type").notNull(),
+ thresholdValue: double("threshold_value"),
+ thresholdDurationSeconds: int("threshold_duration_seconds"),
+ cooldownMinutes: int("cooldown_minutes").notNull().default(15),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const notificationChannels = mysqlTable("notification_channels", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ type: text("type").notNull(),
+ config: text("config").notNull(),
+ enabled: boolean("enabled").notNull().default(true),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const alertRuleChannels = mysqlTable("alert_rule_channels", {
+ id: int("id").autoincrement().primaryKey(),
+ ruleId: int("rule_id")
+ .notNull()
+ .references(() => alertRules.id, { onDelete: "cascade" }),
+ channelId: int("channel_id")
+ .notNull()
+ .references(() => notificationChannels.id, { onDelete: "cascade" }),
+});
+
+export const alertFirings = mysqlTable(
+ "alert_firings",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ ruleId: int("rule_id")
+ .notNull()
+ .references(() => alertRules.id, { onDelete: "cascade" }),
+ hostId: int("host_id").notNull(),
+ hostName: text("host_name").notNull(),
+ firedAt: varchar("fired_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ resolvedAt: text("resolved_at"),
+ value: double("value"),
+ message: text("message").notNull(),
+ severity: text("severity").notNull().default("warning"),
+ acknowledged: boolean("acknowledged")
+ .notNull()
+ .default(false),
+ },
+ // A rule's history is read newest-first; host_id is filtered on its own.
+ (table) => [
+ index("idx_alert_firings_rule").on(table.ruleId, table.firedAt),
+ index("idx_alert_firings_host").on(table.hostId),
+ ],
+);
+// --- alerts end ---
+
+// --- automations begin ---
+export const automations = mysqlTable(
+ "automations",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ description: text("description"),
+ enabled: boolean("enabled").notNull().default(true),
+ // The whole trigger + steps graph, shaped by AutomationDefinition. Read and
+ // written as a unit, never queried by its inner structure.
+ definition: text("definition").notNull(),
+ definitionVersion: int("definition_version").notNull().default(1),
+ concurrencyPolicy: text("concurrency_policy").notNull().default("skip"),
+ maxRunSeconds: int("max_run_seconds").notNull().default(300),
+ dryRun: boolean("dry_run").notNull().default(false),
+ lastRunAt: text("last_run_at"),
+ lastRunStatus: text("last_run_status"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // The scheduler sweeps enabled automations for one user at a time.
+ (table) => [index("idx_automations_user").on(table.userId, table.enabled)],
+);
+
+/**
+ * Durable per-target trigger state. state_key scopes a trigger to what it is
+ * actually watching ("", ":/data", ":"), so
+ * a sustained-breach window can track one filesystem rather than a whole host.
+ * Living in the database rather than memory means cooldowns and dwell windows
+ * survive a restart.
+ */
+export const automationTriggerState = mysqlTable(
+ "automation_trigger_state",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ automationId: int("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ stateKey: varchar("state_key", { length: 255 }).notNull(),
+ breachStartedAt: text("breach_started_at"),
+ lastFiredAt: text("last_fired_at"),
+ lastValue: double("last_value"),
+ lastObservedState: text("last_observed_state"),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ uniqueIndex("idx_automation_trigger_state_key").on(
+ table.automationId,
+ table.stateKey,
+ ),
+ ],
+);
+
+export const automationSchedules = mysqlTable(
+ "automation_schedules",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ automationId: int("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ cron: text("cron"),
+ intervalSeconds: int("interval_seconds"),
+ timezone: text("timezone"),
+ nextDueAt: varchar("next_due_at", { length: 255 }),
+ lastTickAt: text("last_tick_at"),
+ },
+ (table) => [
+ uniqueIndex("idx_automation_schedules_automation").on(table.automationId),
+ index("idx_automation_schedules_due").on(table.nextDueAt),
+ ],
+);
+
+export const automationRuns = mysqlTable(
+ "automation_runs",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ automationId: int("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ triggerType: text("trigger_type").notNull(),
+ triggerContext: text("trigger_context"),
+ status: varchar("status", { length: 255 }).notNull(),
+ startedAt: varchar("started_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ finishedAt: text("finished_at"),
+ durationMs: int("duration_ms"),
+ error: text("error"),
+ dryRun: boolean("dry_run").notNull().default(false),
+ // Set when one automation invoked another, so a chain can be traced.
+ parentRunId: int("parent_run_id"),
+ },
+ (table) => [
+ index("idx_automation_runs_automation").on(
+ table.automationId,
+ table.startedAt,
+ ),
+ index("idx_automation_runs_user").on(table.userId, table.startedAt),
+ ],
+);
+
+export const automationRunSteps = mysqlTable(
+ "automation_run_steps",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ runId: int("run_id")
+ .notNull()
+ .references(() => automationRuns.id, { onDelete: "cascade" }),
+ stepIndex: int("step_index").notNull(),
+ stepId: text("step_id").notNull(),
+ stepType: text("step_type").notNull(),
+ status: varchar("status", { length: 255 }).notNull(),
+ startedAt: varchar("started_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ finishedAt: text("finished_at"),
+ output: text("output"),
+ error: text("error"),
+ truncated: boolean("truncated")
+ .notNull()
+ .default(false),
+ },
+ (table) => [
+ index("idx_automation_run_steps_run").on(table.runId, table.stepIndex),
+ ],
+);
+
+export const automationChannels = mysqlTable(
+ "automation_channels",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ automationId: int("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ channelId: int("channel_id")
+ .notNull()
+ .references(() => notificationChannels.id, { onDelete: "cascade" }),
+ },
+ (table) => [
+ uniqueIndex("idx_automation_channels_pair").on(
+ table.automationId,
+ table.channelId,
+ ),
+ ],
+);
+// --- automations end ---
+
+// --- homepage begin ---
+export const homepageItems = mysqlTable(
+ "homepage_items",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ typeId: text("type_id").notNull(),
+ title: text("title"),
+ config: text("config").notNull().default("{}"),
+ folderId: int("folder_id"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [index("idx_homepage_items_user_id").on(table.userId)],
+);
+
+export const homepageLayouts = mysqlTable("homepage_layouts", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .unique()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON: { entries: HomepageLayoutEntry[], pan: {x,y}, zoom: number }
+ layout: text("layout").notNull().default("{}"),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+// --- homepage end ---
+
+// --- fleets begin ---
+export const fleets = mysqlTable("fleets", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ description: text("description"),
+ color: text("color"),
+ icon: text("icon"),
+ // JSON array of { tag: string } rules, unioned with static fleetMembers at
+ // resolution time. Kept to tag-equality matching for v1.
+ tagRules: text("tag_rules"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+
+export const fleetMembers = mysqlTable(
+ "fleet_members",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ fleetId: int("fleet_id")
+ .notNull()
+ .references(() => fleets.id, { onDelete: "cascade" }),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ addedAt: text("added_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // fleet_id leads the unique pair, so listing a fleet's hosts is already
+ // served. Finding the fleets a host belongs to starts from host_id.
+ (table) => [
+ uniqueIndex("idx_fleet_members_fleet_host").on(table.fleetId, table.hostId),
+ index("idx_fleet_members_host").on(table.hostId),
+ ],
+);
+
+// Latest-only inventory snapshot per host, overwritten on each refresh - no
+// historical log, matching the "latest snapshot only" scope decision.
+export const fleetInventory = mysqlTable(
+ "fleet_inventory",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ hostId: int("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ osPrettyName: text("os_pretty_name"),
+ kernel: text("kernel"),
+ architecture: text("architecture"),
+ hostname: text("hostname"),
+ uptimeSeconds: int("uptime_seconds"),
+ ip: text("ip"),
+ packageManager: text("package_manager"),
+ collectedAt: text("collected_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ // host_id leads the unique pair; a user's whole inventory is read by user_id.
+ (table) => [
+ uniqueIndex("idx_fleet_inventory_host").on(table.hostId, table.userId),
+ index("idx_fleet_inventory_user").on(table.userId),
+ ],
+);
+// --- fleets end ---
+
+// --- workspaces begin ---
+export const userWorkspaces = mysqlTable(
+ "user_workspaces",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ color: text("color"),
+ icon: text("icon"),
+ // "manual" | "last_session" - exactly one last_session row per user.
+ kind: text("kind").notNull().default("manual"),
+ isDefault: boolean("is_default")
+ .notNull()
+ .default(false),
+ // JSON-encoded WorkspacePayload: tabs, splitMode, paneTabIds, rowSizes, rowColSizes
+ payload: text("payload").notNull().default("{}"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ lastUsedAt: text("last_used_at"),
+ },
+ (table) => [index("idx_user_workspaces_user_id").on(table.userId)],
+);
+// --- workspaces end ---
+
+// --- sync begin ---
+// Records a delete for a synced entity type so the other side of a sync
+// pair (embedded desktop backend <-> connected remote server) learns about
+// the deletion instead of re-creating the row on its next pull.
+export const syncTombstones = mysqlTable("sync_tombstones", {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ entityType: text("entity_type").notNull(),
+ syncId: varchar("sync_id", { length: 255 }).notNull(),
+ deletedAt: text("deleted_at")
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+});
+// --- sync end ---
+
+// --- ai begin ---
+/**
+ * A user's connection to one AI provider. api_key is encrypted at rest via
+ * FieldCrypto; it is never returned to the frontend, which only ever sees
+ * api_key_prefix for display.
+ */
+export const aiProviders = mysqlTable(
+ "ai_providers",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // ollama | anthropic | openai | gemini | openai_compatible
+ providerType: text("provider_type").notNull(),
+ label: varchar("label", { length: 255 }).notNull(),
+ // Required for ollama and openai_compatible, optional elsewhere.
+ baseUrl: text("base_url"),
+ apiKey: text("api_key"),
+ // First few characters, kept in the clear so the UI can identify a key.
+ apiKeyPrefix: text("api_key_prefix"),
+ defaultModel: text("default_model"),
+ enabled: boolean("enabled").notNull().default(true),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ uniqueIndex("idx_ai_providers_user_label").on(table.userId, table.label),
+ ],
+);
+
+export const aiConversations = mysqlTable(
+ "ai_conversations",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ title: text("title"),
+ providerId: int("provider_id"),
+ model: text("model"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ index("idx_ai_conversations_user").on(table.userId, table.updatedAt),
+ ],
+);
+
+export const aiMessages = mysqlTable(
+ "ai_messages",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ conversationId: int("conversation_id")
+ .notNull()
+ .references(() => aiConversations.id, { onDelete: "cascade" }),
+ // user | assistant | tool
+ role: text("role").notNull(),
+ content: text("content").notNull().default(""),
+ // Serialized tool calls and their results for this turn.
+ toolCalls: text("tool_calls"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ index("idx_ai_messages_conversation").on(
+ table.conversationId,
+ table.createdAt,
+ ),
+ ],
+);
+
+/**
+ * A change the assistant wants to make. Nothing here has been applied: the
+ * payload is re-validated against the tool schema at apply time and only then
+ * dispatched through the same repository logic a human action uses.
+ */
+export const aiProposals = mysqlTable(
+ "ai_proposals",
+ {
+ id: int("id").autoincrement().primaryKey(),
+ conversationId: int("conversation_id")
+ .notNull()
+ .references(() => aiConversations.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // The propose_* tool name that produced this.
+ kind: text("kind").notNull(),
+ summary: text("summary"),
+ payload: text("payload").notNull().default("{}"),
+ // pending | applied | rejected | expired
+ status: varchar("status", { length: 255 }).notNull().default("pending"),
+ appliedAt: text("applied_at"),
+ resultSummary: text("result_summary"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`(CURRENT_TIMESTAMP)`),
+ },
+ (table) => [
+ index("idx_ai_proposals_user").on(table.userId, table.status),
+ index("idx_ai_proposals_conversation").on(table.conversationId),
+ ],
+);
+// --- ai end ---
diff --git a/src/backend/database/db/schema.pg.ts b/src/backend/database/db/schema.pg.ts
new file mode 100644
index 0000000..c5d0327
--- /dev/null
+++ b/src/backend/database/db/schema.pg.ts
@@ -0,0 +1,1942 @@
+// GENERATED FILE โ do not edit.
+//
+// Produced from schema.ts by scripts/generate-dialect-schema.cjs.
+// Edit the sqlite schema and re-run `node scripts/generate-dialect-schema.cjs`.
+// Target dialect: postgres.
+//
+// DDL source for drizzle-kit. NOT imported to run queries โ repositories use
+// schema.ts on every dialect. See the generator header for why that is correct.
+
+import {
+ pgTable,
+ text,
+ varchar,
+ integer,
+ serial,
+ boolean,
+ doublePrecision,
+ index,
+ uniqueIndex,
+ type AnyPgColumn,
+} from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+
+export const users = pgTable("users", {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ username: text("username").notNull(),
+ passwordHash: text("password_hash").notNull(),
+ isAdmin: boolean("is_admin").notNull().default(false),
+
+ isOidc: boolean("is_oidc").notNull().default(false),
+ oidcIdentifier: text("oidc_identifier"),
+ ssoProviderId: integer("sso_provider_id"),
+ clientId: text("client_id"),
+ clientSecret: text("client_secret"),
+ issuerUrl: text("issuer_url"),
+ authorizationUrl: text("authorization_url"),
+ tokenUrl: text("token_url"),
+ identifierPath: text("identifier_path"),
+ namePath: text("name_path"),
+ scopes: text().default("openid email profile"),
+
+ totpSecret: text("totp_secret"),
+ totpEnabled: boolean("totp_enabled")
+ .notNull()
+ .default(false),
+ totpBackupCodes: text("totp_backup_codes"),
+
+ registeredAt: text("registered_at").notNull().default(sql`CURRENT_TIMESTAMP`),
+ donationModalDismissed: boolean("donation_modal_dismissed")
+ .notNull()
+ .default(false),
+});
+
+export const settings = pgTable("settings", {
+ key: varchar("key", { length: 255 }).primaryKey(),
+ value: text("value").notNull(),
+});
+
+export const ssoProviders = pgTable("sso_providers", {
+ id: serial("id").primaryKey(),
+ name: varchar("name", { length: 255 }).notNull(),
+ type: text("type").notNull(),
+ enabled: boolean("enabled").notNull().default(true),
+ displayOrder: integer("display_order").notNull().default(0),
+ config: text("config").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const sessions = pgTable(
+ "sessions",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ jwtToken: text("jwt_token").notNull(),
+ deviceType: text("device_type").notNull(),
+ deviceInfo: text("device_info").notNull(),
+ oidcSub: text("oidc_sub"),
+ oidcSid: text("oidc_sid"),
+ ssoProviderId: integer("sso_provider_id"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ lastActiveAt: text("last_active_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Listing a user's devices, and the startup sweep of expired rows.
+ (table) => [
+ index("idx_sessions_user_id").on(table.userId),
+ index("idx_sessions_expires_at").on(table.expiresAt),
+ ],
+);
+
+export const trustedDevices = pgTable(
+ "trusted_devices",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ deviceFingerprint: text("device_fingerprint").notNull(),
+ deviceType: text("device_type").notNull(),
+ deviceInfo: text("device_info").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ lastUsedAt: text("last_used_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_trusted_devices_user_id").on(table.userId)],
+);
+
+export const webauthnCredentials = pgTable("webauthn_credentials", {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ credentialId: varchar("credential_id", { length: 255 }).notNull(),
+ publicKey: text("public_key").notNull(),
+ counter: integer("counter").notNull().default(0),
+ deviceType: text("device_type"),
+ backedUp: boolean("backed_up").notNull().default(false),
+ transports: text("transports"),
+ userVerification: text("user_verification").notNull().default("preferred"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ lastUsedAt: text("last_used_at"),
+});
+
+export const hosts = pgTable(
+ "ssh_data",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ connectionType: text("connection_type").notNull().default("ssh"),
+ name: varchar("name", { length: 255 }),
+ ip: text("ip").notNull(),
+ port: integer("port").notNull(),
+ username: text("username").notNull(),
+ folder: text("folder"),
+ // Sub-host nesting: a host acting as an organizational parent for other
+ // hosts, mutually exclusive with folder (see host route validation).
+ parentHostId: integer("parent_host_id").references(
+ (): AnyPgColumn => hosts.id,
+ { onDelete: "set null" },
+ ),
+ tags: text("tags"),
+ pin: boolean("pin").notNull().default(false),
+ // Manual drag-to-reorder position within a folder. Null means the host has
+ // never been manually reordered; falls back to name sort in that case.
+ sortOrder: integer("sort_order"),
+ authType: text("auth_type").notNull(),
+ useWarpgate: boolean("use_warpgate").notNull().default(false),
+ shareSshAuth: boolean("share_ssh_auth")
+ .notNull()
+ .default(false),
+ forceKeyboardInteractive: text("force_keyboard_interactive"),
+
+ password: text("password"),
+ key: text("key"),
+ keyPassword: text("key_password"),
+ keyType: text("key_type"),
+ sudoPassword: text("sudo_password"),
+
+ autostartPassword: text("autostart_password"),
+ autostartKey: text("autostart_key"),
+ autostartKeyPassword: text("autostart_key_password"),
+
+ credentialId: integer("credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ overrideCredentialUsername: boolean("override_credential_username"),
+ // When authType is "vault", the host authenticates via a Vault SSH signer
+ // profile (shared settings, no secrets). The signing certificate is obtained
+ // per-user at connect time via an interactive Vault OIDC flow.
+ vaultProfileId: integer("vault_profile_id").references(
+ () => vaultProfiles.id,
+ { onDelete: "set null" },
+ ),
+ enableTerminal: boolean("enable_terminal")
+ .notNull()
+ .default(true),
+ enableSessionLogging: boolean("enable_session_logging")
+ .notNull()
+ .default(true),
+ allowSessionSharing: boolean("allow_session_sharing")
+ .notNull()
+ .default(true),
+ enableCommandHistory: boolean("enable_command_history")
+ .notNull()
+ .default(true),
+ enableTunnel: boolean("enable_tunnel")
+ .notNull()
+ .default(true),
+ tunnelConnections: text("tunnel_connections"),
+ jumpHosts: text("jump_hosts"),
+ enableFileManager: boolean("enable_file_manager")
+ .notNull()
+ .default(true),
+ scpLegacy: boolean("scp_legacy").notNull().default(false),
+ enableDocker: boolean("enable_docker")
+ .notNull()
+ .default(false),
+ enableTmuxMonitor: boolean("enable_tmux_monitor")
+ .notNull()
+ .default(false),
+ enableTerminalToolbar: boolean("enable_terminal_toolbar")
+ .notNull()
+ .default(true),
+ showTerminalInSidebar: boolean("show_terminal_in_sidebar")
+ .notNull()
+ .default(true),
+ showFileManagerInSidebar: boolean("show_file_manager_in_sidebar")
+ .notNull()
+ .default(false),
+ showTunnelInSidebar: boolean("show_tunnel_in_sidebar")
+ .notNull()
+ .default(false),
+ showDockerInSidebar: boolean("show_docker_in_sidebar")
+ .notNull()
+ .default(false),
+ showServerStatsInSidebar: boolean("show_server_stats_in_sidebar")
+ .notNull()
+ .default(false),
+ defaultPath: text("default_path"),
+ statsConfig: text("stats_config"),
+ dockerConfig: text("docker_config"),
+ enableProxmox: boolean("enable_proxmox")
+ .notNull()
+ .default(false),
+ proxmoxConfig: text("proxmox_config"),
+ enableProxmoxStats: boolean("enable_proxmox_stats")
+ .notNull()
+ .default(false),
+ proxmoxStatsConfig: text("proxmox_stats_config"),
+ terminalConfig: text("terminal_config"),
+ quickActions: text("quick_actions"),
+ notes: text("notes"),
+ enableSsh: boolean("enable_ssh").notNull().default(true),
+ enableRdp: boolean("enable_rdp").notNull().default(false),
+ enableVnc: boolean("enable_vnc").notNull().default(false),
+ enableTelnet: boolean("enable_telnet").notNull().default(false),
+
+ sshPort: integer("ssh_port").default(22),
+ rdpPort: integer("rdp_port").default(3389),
+ vncPort: integer("vnc_port").default(5900),
+ telnetPort: integer("telnet_port").default(23),
+
+ rdpCredentialId: integer("rdp_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ rdpUser: text("rdp_user"),
+ rdpPassword: text("rdp_password"),
+ rdpDomain: text("rdp_domain"),
+ rdpSecurity: text("rdp_security"),
+ rdpIgnoreCert: boolean("rdp_ignore_cert").default(false),
+
+ vncCredentialId: integer("vnc_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ vncPassword: text("vnc_password"),
+ vncUser: text("vnc_user"),
+
+ telnetUser: text("telnet_user"),
+ telnetPassword: text("telnet_password"),
+ telnetCredentialId: integer("telnet_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+
+ rdpAuthType: text("rdp_auth_type"),
+ vncAuthType: text("vnc_auth_type"),
+ telnetAuthType: text("telnet_auth_type"),
+
+ domain: text("domain"),
+ security: text("security"),
+ ignoreCert: boolean("ignore_cert").default(false),
+ guacamoleConfig: text("guacamole_config"),
+
+ useSocks5: boolean("use_socks5"),
+ socks5Host: text("socks5_host"),
+ socks5Port: integer("socks5_port"),
+ socks5Username: text("socks5_username"),
+ socks5Password: text("socks5_password"),
+ socks5ProxyChain: text("socks5_proxy_chain"),
+
+ // null = use the desktop app's global default; "local" | "remote" pins
+ // this specific host's SSH/Docker-console/Serial connections to originate
+ // from the embedded local backend or a connected remote sync server.
+ // Ignored for rdp/vnc/telnet, which always require the remote server.
+ connectionOrigin: text("connection_origin"),
+
+ macAddress: text("mac_address"),
+ wolBroadcastAddress: text("wol_broadcast_address"),
+ portKnockSequence: text("port_knock_sequence"),
+
+ hostKeyFingerprint: text("host_key_fingerprint"),
+ hostKeyType: text("host_key_type"),
+ hostKeyAlgorithm: text("host_key_algorithm").default("sha256"),
+ hostKeyFirstSeen: text("host_key_first_seen"),
+ hostKeyLastVerified: text("host_key_last_verified"),
+ hostKeyChangedCount: integer("host_key_changed_count").default(0),
+
+ // Stable identity used to match this row across two independently-seeded
+ // databases (the embedded backend and a connected remote server) during
+ // sync -- local autoincrement ids collide across instances.
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Every host read is scoped by owner, so user_id carries the host list.
+ //
+ // `folder` is deliberately not indexed: on Postgres/MySQL an indexed text
+ // column is generated as varchar(255), and folder holds a joined nested path
+ // with no length cap, so indexing it would truncate deep hierarchies.
+ (table) => [
+ index("idx_ssh_data_user_id").on(table.userId),
+ index("idx_ssh_data_parent_host").on(table.parentHostId),
+ index("idx_ssh_data_credential").on(table.credentialId),
+ ],
+);
+
+export const fileManagerRecent = pgTable(
+ "file_manager_recent",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ path: text("path").notNull(),
+ lastOpened: text("last_opened")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Every file manager surface is read for one user on one host at a time.
+ (table) => [
+ index("idx_file_manager_recent_user").on(table.userId, table.hostId),
+ ],
+);
+
+export const fileManagerPinned = pgTable(
+ "file_manager_pinned",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ path: text("path").notNull(),
+ pinnedAt: text("pinned_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_file_manager_pinned_user").on(table.userId, table.hostId),
+ ],
+);
+
+export const fileManagerShortcuts = pgTable(
+ "file_manager_shortcuts",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ path: text("path").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_file_manager_shortcuts_user").on(table.userId, table.hostId),
+ ],
+);
+
+export const transferRecent = pgTable(
+ "transfer_recent",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ sourceHostId: integer("source_host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ destHostId: integer("dest_host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ destPath: text("dest_path").notNull(),
+ destPathLabel: text("dest_path_label").notNull(),
+ lastUsed: text("last_used")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_transfer_recent_user").on(table.userId)],
+);
+
+export const dismissedAlerts = pgTable(
+ "dismissed_alerts",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ alertId: text("alert_id").notNull(),
+ dismissedAt: text("dismissed_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_dismissed_alerts_user_id").on(table.userId)],
+);
+
+export const sshCredentials = pgTable(
+ "ssh_credentials",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ description: text("description"),
+ folder: text("folder"),
+ tags: text("tags"),
+ pin: boolean("pin").notNull().default(false),
+ // Manual drag-to-reorder position within a folder. Null means the
+ // credential has never been manually reordered; falls back to name sort
+ // in that case, same convention as hosts.sortOrder.
+ sortOrder: integer("sort_order"),
+ authType: text("auth_type").notNull(),
+ username: text("username"),
+ password: text("password"),
+ key: text("key"),
+ privateKey: text("private_key"),
+ publicKey: text("public_key"),
+ keyPassword: text("key_password"),
+ keyType: text("key_type"),
+ detectedKeyType: text("detected_key_type"),
+
+ certPublicKey: text("cert_public_key"),
+
+
+ usageCount: integer("usage_count").notNull().default(0),
+ lastUsed: text("last_used"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_ssh_credentials_user_id").on(table.userId)],
+);
+
+export const sshCredentialUsage = pgTable(
+ "ssh_credential_usage",
+ {
+ id: serial("id").primaryKey(),
+ credentialId: integer("credential_id")
+ .notNull()
+ .references(() => sshCredentials.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ usedAt: text("used_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_ssh_credential_usage_credential").on(table.credentialId),
+ index("idx_ssh_credential_usage_user").on(table.userId),
+ ],
+);
+
+export const snippets = pgTable(
+ "snippets",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ content: text("content").notNull(),
+ description: text("description"),
+ folder: text("folder"),
+ order: integer("order").notNull().default(0),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ hostFilter: text("host_filter"),
+ isNote: boolean("is_note").notNull().default(false),
+ },
+ (table) => [index("idx_snippets_user_id").on(table.userId)],
+);
+
+export const snippetFolders = pgTable("snippet_folders", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ color: text("color"),
+ icon: text("icon"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const c2sTunnelPresets = pgTable("c2s_tunnel_presets", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ config: text("config").notNull(),
+ platform: text("platform"),
+ computerName: text("computer_name"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const snippetAccess = pgTable(
+ "snippet_access",
+ {
+ id: serial("id").primaryKey(),
+ snippetId: integer("snippet_id")
+ .notNull()
+ .references(() => snippets.id, { onDelete: "cascade" }),
+
+ userId: varchar("user_id", { length: 255 }).references(() => users.id, { onDelete: "cascade" }),
+ roleId: integer("role_id").references(() => roles.id, {
+ onDelete: "cascade",
+ }),
+
+ grantedBy: varchar("granted_by", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+
+ permissionLevel: text("permission_level").notNull().default("view"),
+
+ expiresAt: varchar("expires_at", { length: 255 }),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Same three lookup shapes as host_access: by grantee, by role, by snippet.
+ (table) => [
+ index("idx_snippet_access_user_id").on(table.userId),
+ index("idx_snippet_access_snippet_id").on(table.snippetId),
+ index("idx_snippet_access_role_id").on(table.roleId),
+ ],
+);
+
+export const sshFolders = pgTable(
+ "ssh_folders",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ color: text("color"),
+ icon: text("icon"),
+ credentialId: integer("credential_id").references(() => sshCredentials.id, {
+ onDelete: "set null",
+ }),
+ // Manual drag-to-reorder position among sibling folders. Null falls back
+ // to name sort, same convention as hosts.sortOrder.
+ sortOrder: integer("sort_order"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_ssh_folders_user_id").on(table.userId)],
+);
+
+export const recentActivity = pgTable(
+ "recent_activity",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ type: text("type").notNull(),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ hostName: text("host_name"),
+ timestamp: varchar("timestamp", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Always read newest-first for one user, so timestamp follows user_id.
+ (table) => [
+ index("idx_recent_activity_user_ts").on(table.userId, table.timestamp),
+ ],
+);
+
+export const commandHistory = pgTable(
+ "command_history",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ command: text("command").notNull(),
+ executedAt: text("executed_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_command_history_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const networkTopology = pgTable("network_topology", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ topology: text("topology"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const hostAccess = pgTable(
+ "host_access",
+ {
+ id: serial("id").primaryKey(),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+
+ userId: varchar("user_id", { length: 255 })
+ .references(() => users.id, { onDelete: "cascade" }),
+ roleId: integer("role_id")
+ .references(() => roles.id, { onDelete: "cascade" }),
+
+ grantedBy: varchar("granted_by", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+
+ permissionLevel: text("permission_level")
+ .notNull()
+ .default("connect"),
+
+ expiresAt: varchar("expires_at", { length: 255 }),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ lastAccessedAt: text("last_accessed_at"),
+ accessCount: integer("access_count").notNull().default(0),
+ },
+ // Resolved on every host list request and every permission check, so all
+ // three lookup shapes (by grantee, by role, by host) need to be indexed.
+ (table) => [
+ index("idx_host_access_user_id").on(table.userId),
+ index("idx_host_access_role_id").on(table.roleId),
+ index("idx_host_access_host_id").on(table.hostId),
+ index("idx_host_access_expires_at").on(table.expiresAt),
+ ],
+);
+
+export const sharedHostAuthOverrides = pgTable(
+ "shared_host_auth_overrides",
+ {
+ id: serial("id").primaryKey(),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ protocol: varchar("protocol", { length: 255 }).notNull().default("ssh"),
+ credentialId: integer("credential_id")
+ .notNull()
+ .references(() => sshCredentials.id, { onDelete: "cascade" }),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ uniqueIndex("shared_host_auth_overrides_host_user_protocol_unique").on(
+ table.hostId,
+ table.userId,
+ table.protocol,
+ ),
+ ],
+);
+
+export const sharedHostSecrets = pgTable(
+ "shared_host_secrets",
+ {
+ id: serial("id").primaryKey(),
+
+ hostAccessId: integer("host_access_id")
+ .notNull()
+ .references(() => hostAccess.id, { onDelete: "cascade" }),
+
+ targetUserId: varchar("target_user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+
+ protocol: varchar("protocol", { length: 255 }).notNull().default("ssh"),
+ sourceType: text("source_type").notNull().default("credential"),
+
+ originalCredentialId: integer("original_credential_id").references(
+ () => sshCredentials.id,
+ { onDelete: "cascade" },
+ ),
+
+ encryptedUsername: text("encrypted_username"),
+ encryptedAuthType: text("encrypted_auth_type"),
+ encryptedPassword: text("encrypted_password"),
+ encryptedKey: text("encrypted_key"),
+ encryptedKeyPassword: text("encrypted_key_password"),
+ encryptedKeyType: text("encrypted_key_type"),
+ encryptedDomain: text("encrypted_domain"),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ (table) => [
+ uniqueIndex("idx_shared_host_secrets_scope").on(
+ table.hostAccessId,
+ table.targetUserId,
+ table.protocol,
+ ),
+ ],
+);
+
+export const roles = pgTable("roles", {
+ id: serial("id").primaryKey(),
+ name: varchar("name", { length: 255 }).notNull().unique(),
+ displayName: text("display_name").notNull(),
+ description: text("description"),
+
+ isSystem: boolean("is_system")
+ .notNull()
+ .default(false),
+
+ permissions: text("permissions"),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const userRoles = pgTable(
+ "user_roles",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ roleId: integer("role_id")
+ .notNull()
+ .references(() => roles.id, { onDelete: "cascade" }),
+
+ grantedBy: varchar("granted_by", { length: 255 }).references(() => users.id, {
+ onDelete: "set null",
+ }),
+ grantedAt: text("granted_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ //
+ // The unique pair already serves lookups by user, since user_id leads it.
+ // Listing a role's members starts from role_id, which it cannot serve.
+ (table) => [
+ uniqueIndex("idx_user_roles_user_role").on(table.userId, table.roleId),
+ index("idx_user_roles_role_id").on(table.roleId),
+ ],
+);
+
+export const auditLogs = pgTable(
+ "audit_logs",
+ {
+ id: serial("id").primaryKey(),
+
+ // Nullable on purpose: the trail outlives the account, and username keeps the
+ // entry attributable once the reference is gone.
+ userId: varchar("user_id", { length: 255 }).references(() => users.id, { onDelete: "set null" }),
+ username: text("username").notNull(),
+
+ action: varchar("action", { length: 255 }).notNull(),
+ resourceType: varchar("resource_type", { length: 255 }).notNull(),
+ resourceId: text("resource_id"),
+ resourceName: text("resource_name"),
+
+ details: text("details"),
+ ipAddress: text("ip_address"),
+ userAgent: text("user_agent"),
+
+ success: boolean("success").notNull(),
+ errorMessage: text("error_message"),
+
+ timestamp: varchar("timestamp", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // This table only grows, and is always read newest-first with an optional
+ // filter. Each composite leads with the filtered column so the same index
+ // also satisfies the ORDER BY.
+ (table) => [
+ index("idx_audit_logs_timestamp").on(table.timestamp),
+ index("idx_audit_logs_user_ts").on(table.userId, table.timestamp),
+ index("idx_audit_logs_action_ts").on(table.action, table.timestamp),
+ index("idx_audit_logs_resource_ts").on(table.resourceType, table.timestamp),
+ ],
+);
+
+export const sessionRecordings = pgTable(
+ "session_recordings",
+ {
+ id: serial("id").primaryKey(),
+
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ // Nullable on purpose: a recording is evidence about the host as much as the
+ // person, so it outlives the account. username keeps it attributable.
+ userId: varchar("user_id", { length: 255 }).references(() => users.id, { onDelete: "set null" }),
+ username: text("username"),
+ accessId: integer("access_id").references(() => hostAccess.id, {
+ onDelete: "set null",
+ }),
+
+ startedAt: varchar("started_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ endedAt: text("ended_at"),
+ duration: integer("duration"),
+
+ commands: text("commands"),
+ dangerousActions: text("dangerous_actions"),
+
+ recordingPath: text("recording_path"),
+ protocol: varchar("protocol", { length: 255 }).notNull().default("ssh"),
+ format: text("format").notNull().default("text"),
+
+ terminatedByOwner: boolean("terminated_by_owner").default(false),
+ terminationReason: text("termination_reason"),
+ },
+ // Listed newest-first per user, and audited per host.
+ (table) => [
+ index("idx_session_recordings_user_started").on(
+ table.userId,
+ table.startedAt,
+ ),
+ index("idx_session_recordings_host").on(table.hostId),
+ ],
+);
+
+export const sessionShares = pgTable(
+ "session_shares",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ ownerUserId: varchar("owner_user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+
+ protocol: varchar("protocol", { length: 255 }).notNull(),
+
+ // Live-session binding: TerminalSessionManager's session.id for SSH, or
+ // guacd's own guacamoleConnectionId for rdp/vnc/telnet. Neither is a DB
+ // row (process-local, in-memory) so this intentionally has no FK.
+ sessionId: varchar("session_id", { length: 255 }).notNull(),
+ tabInstanceId: text("tab_instance_id"),
+
+ shareType: text("share_type").notNull(), // "link" | "user"
+ targetUserId: varchar("target_user_id", { length: 255 }).references(() => users.id, {
+ onDelete: "cascade",
+ }),
+ linkToken: varchar("link_token", { length: 255 }).unique(),
+
+ permissionLevel: text("permission_level").notNull().default("read-only"),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ revokedAt: text("revoked_at"),
+
+ lastJoinedAt: text("last_joined_at"),
+ joinCount: integer("join_count").notNull().default(0),
+ },
+ // Resolved from the live session on join, and listed per host.
+ (table) => [
+ index("idx_session_shares_session_id").on(table.sessionId),
+ index("idx_session_shares_host_id").on(table.hostId),
+ ],
+);
+
+export const sessionShareParticipants = pgTable(
+ "session_share_participants",
+ {
+ id: serial("id").primaryKey(),
+ shareId: varchar("share_id", { length: 255 })
+ .notNull()
+ .references(() => sessionShares.id, { onDelete: "cascade" }),
+
+ userId: varchar("user_id", { length: 255 }).references(() => users.id, {
+ onDelete: "cascade",
+ }),
+ guestLabel: text("guest_label"),
+
+ joinedAt: text("joined_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ leftAt: text("left_at"),
+ },
+);
+
+export const opksshTokens = pgTable(
+ "opkssh_tokens",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+
+ sshCert: text("ssh_cert").notNull(),
+ privateKey: text("private_key").notNull(),
+
+ email: text("email"),
+ sub: text("sub"),
+ issuer: text("issuer"),
+ audience: text("audience"),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ lastUsed: text("last_used"),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ (table) => [uniqueIndex("idx_opkssh_tokens_user_host").on(table.userId, table.hostId)],
+);
+
+// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
+// are intended to be shared across users (shared === true makes a profile
+// visible to every user on the server). Each user authenticates to Vault via an
+// interactive OIDC flow at connect time; no tokens or keys are stored here.
+export const vaultProfiles = pgTable("vault_profiles", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ description: text("description"),
+ folder: text("folder"),
+ tags: text("tags"),
+ // Vault server connection (non-secret)
+ vaultAddr: text("vault_addr").notNull(),
+ vaultNamespace: text("vault_namespace"),
+ // OIDC auth method mount + role used to obtain a Vault token interactively
+ oidcMount: text("oidc_mount"),
+ oidcRole: text("oidc_role"),
+ // SSH secrets engine mount + signer role used to sign the ephemeral key
+ sshMount: text("ssh_mount"),
+ sshRole: text("ssh_role").notNull(),
+ validPrincipals: text("valid_principals"),
+ // Ephemeral keypair algorithm to generate per connection
+ keyType: text("key_type"),
+ // When true the profile is visible/usable by all users on the server
+ shared: boolean("shared").notNull().default(false),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
+// Transient: rows live only until the certificate expires. Secret fields are
+// encrypted under the user's data-encryption key (see field-crypto.ts).
+export const vaultTokens = pgTable(
+ "vault_tokens",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ profileId: integer("profile_id")
+ .notNull()
+ .references(() => vaultProfiles.id, { onDelete: "cascade" }),
+
+ sshCert: text("ssh_cert").notNull(),
+ privateKey: text("private_key").notNull(),
+
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: varchar("expires_at", { length: 255 }).notNull(),
+ lastUsed: text("last_used"),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ (table) => [uniqueIndex("idx_vault_tokens_user_profile").on(table.userId, table.profileId)],
+);
+
+export const apiKeys = pgTable(
+ "api_keys",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ tokenHash: text("token_hash").notNull(),
+ tokenPrefix: text("token_prefix").notNull(),
+ createdAt: varchar("created_at", { length: 255 }).notNull().default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: varchar("expires_at", { length: 255 }),
+ lastUsedAt: text("last_used_at"),
+ isActive: boolean("is_active").notNull().default(true),
+ },
+ (table) => [index("idx_api_keys_user_id").on(table.userId)],
+);
+
+export const userOpenTabs = pgTable(
+ "user_open_tabs",
+ {
+ id: varchar("id", { length: 255 }).primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ tabType: text("tab_type").notNull(),
+ hostId: integer("host_id").references(() => hosts.id, {
+ onDelete: "cascade",
+ }),
+ label: varchar("label", { length: 255 }).notNull(),
+ tabOrder: integer("tab_order").notNull().default(0),
+ backendSessionId: text("backend_session_id"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_user_open_tabs_user_id").on(table.userId)],
+);
+
+export const userPreferences = pgTable("user_preferences", {
+ userId: varchar("user_id", { length: 255 })
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ reopenTabsOnLogin: boolean("reopen_tabs_on_login")
+ .notNull()
+ .default(false),
+ theme: text("theme"),
+ fontSize: text("font_size"),
+ accentColor: text("accent_color"),
+ language: text("language"),
+ storageMode: text("storage_mode"),
+ commandAutocomplete: boolean("command_autocomplete"),
+ commandPaletteEnabled: boolean("command_palette_enabled"),
+ showHostTags: boolean("show_host_tags"),
+ hostTrayOnClick: boolean("host_tray_on_click"),
+ pinAppRail: boolean("pin_app_rail"),
+ expandAppRailOnHover: boolean("expand_app_rail_on_hover"),
+ foldersCollapsed: boolean("folders_collapsed"),
+ confirmSnippetExecution: boolean("confirm_snippet_execution"),
+ disableUpdateCheck: boolean("disable_update_check"),
+ confirmTabClose: boolean("confirm_tab_close"),
+ hiddenRailTabs: text("hidden_rail_tabs"),
+ // null means the user has not been asked yet; the assistant stays hidden
+ // until this is explicitly true and the admin global is on.
+ aiAssistantEnabled: boolean("ai_assistant_enabled"),
+ // Opt-in to letting the assistant run allowlisted read-only diagnostics
+ // without a per-command approval click.
+ aiReadOnlyCommands: boolean("ai_read_only_commands"),
+ compactHostView: boolean("compact_host_view"),
+ statusColorScheme: text("status_color_scheme"),
+ customThemes: text("custom_themes"),
+ customKeybindings: text("custom_keybindings"),
+ terminalDefaults: text("terminal_defaults"),
+ rdpDefaults: text("rdp_defaults"),
+ terminalMacros: text("terminal_macros"),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const hostMetricsPreferences = pgTable(
+ "host_metrics_preferences",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ // JSON-encoded HostMetricsLayout. Layout has no secrets, so it is stored as
+ // plain JSON (no field-level encryption).
+ layout: text("layout").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // One layout per user per host. Enforced in production since the inline DDL
+ // creates it, but it was never declared here, so the generated Postgres and
+ // MySQL schemas lacked it โ and the upsert has nothing to conflict on.
+ (table) => [
+ uniqueIndex("idx_host_metrics_prefs_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const proxmoxStatsPreferences = pgTable(
+ "proxmox_stats_preferences",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 }).notNull().references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id").notNull().references(() => hosts.id, { onDelete: "cascade" }),
+ // JSON-encoded ProxmoxStatsLayout. Layout has no secrets, so it is stored as
+ // plain JSON (no field-level encryption), same convention as hostMetricsPreferences.layout.
+ layout: text("layout").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ uniqueIndex("idx_proxmox_stats_prefs_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const hostSidebarPreferences = pgTable("host_sidebar_preferences", {
+ userId: varchar("user_id", { length: 255 })
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON-encoded HostSidebarPreferences. No secrets in this blob, stored as
+ // plain JSON like hostMetricsPreferences.layout.
+ data: text("data").notNull(),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const credentialSidebarPreferences = pgTable(
+ "credential_sidebar_preferences",
+ {
+ userId: varchar("user_id", { length: 255 })
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON-encoded CredentialSidebarPreferences. No secrets in this blob,
+ // same convention as hostSidebarPreferences.data.
+ data: text("data").notNull(),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+);
+
+export const uiPreferences = pgTable("ui_preferences", {
+ userId: varchar("user_id", { length: 255 })
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON-encoded UiPreferences (preset + per-area overrides + onboarding
+ // state). No secrets in this blob, same convention as
+ // hostSidebarPreferences.data.
+ data: text("data").notNull(),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const hostHealthChecks = pgTable(
+ "host_health_checks",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ // JSON array of { id, name, type: "tcp"|"http", target, port, path }
+ checks: text("checks").notNull(),
+ intervalSeconds: integer("interval_seconds").notNull().default(300),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Same as above: one set of checks per user per host.
+ (table) => [
+ uniqueIndex("idx_host_health_checks_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const hostHealthHistory = pgTable("host_health_history", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ checkId: text("check_id").notNull(),
+ ts: text("ts").notNull().default(sql`CURRENT_TIMESTAMP`),
+ ok: boolean("ok").notNull(),
+ latencyMs: integer("latency_ms"),
+ detail: text("detail"),
+});
+
+export const dashboardServiceLinks = pgTable("dashboard_service_links", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ label: varchar("label", { length: 255 }).notNull(),
+ url: text("url").notNull(),
+ order: integer("order").notNull().default(0),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+// --- termix-id begin ---
+// A user claims a unique public handle. Their published SSH public keys are
+// served at an unauthenticated resolver endpoint in authorized_keys format,
+// so any server can be provisioned with `curl /termix-id/u/ >> ~/.ssh/authorized_keys`.
+export const termixIdentities = pgTable("termix_identities", {
+ id: serial("id").primaryKey(),
+ // One Termix ID per user โ enforced in schema, not just in code.
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .unique()
+ .references(() => users.id, { onDelete: "cascade" }),
+ handle: varchar("handle", { length: 255 }).notNull().unique(),
+ description: text("description"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const termixIdentityKeys = pgTable("termix_identity_keys", {
+ id: serial("id").primaryKey(),
+ identityId: integer("identity_id")
+ .notNull()
+ .references(() => termixIdentities.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // Public keys are non-secret, so they are stored in plaintext (no field-level
+ // encryption). This is what lets the unauthenticated resolver serve them.
+ publicKey: text("public_key").notNull(),
+ // Raw algorithm token (e.g. "ssh-ed25519"), and a normalized group used for
+ // the / resolver filter (RSA / ED25519 / ECDSA / ...).
+ keyType: text("key_type").notNull(),
+ algorithm: text("algorithm").notNull(),
+ label: varchar("label", { length: 255 }),
+ comment: text("comment"),
+ // "manual" (pasted) or "credential" (imported from an ssh_credentials entry).
+ source: text("source").notNull().default("manual"),
+ credentialId: integer("credential_id").references(() => sshCredentials.id, {
+ onDelete: "set null",
+ }),
+ enabled: boolean("enabled").notNull().default(true),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+// Per-identity certificate authority. Servers that trust this CA (via
+// TrustedUserCAKeys / @cert-authority) accept any user certificate it signs,
+// giving central revocation (rotate the CA) and expiry (cert validity).
+export const termixIdentityCa = pgTable("termix_identity_ca", {
+ id: serial("id").primaryKey(),
+ identityId: integer("identity_id")
+ .notNull()
+ .unique()
+ .references(() => termixIdentities.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // CA public key (plaintext โ it is published); CA private key is field-encrypted.
+ publicKey: text("public_key").notNull(),
+ privateKey: text("private_key").notNull(),
+ validityDays: integer("validity_days").notNull().default(90),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+// --- termix-id end ---
+
+// --- tmux-monitor begin ---
+export const tmuxSessionTags = pgTable("tmux_session_tags", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ sessionName: text("session_name").notNull(),
+ tag: text("tag").notNull(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+// --- tmux-monitor end ---
+
+// --- metrics-history begin ---
+export const hostMetricsHistory = pgTable("host_metrics_history", {
+ id: serial("id").primaryKey(),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ ts: text("ts")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ cpuPercent: doublePrecision("cpu_percent"),
+ memPercent: doublePrecision("mem_percent"),
+ diskPercent: doublePrecision("disk_percent"),
+ netRxBytes: integer("net_rx_bytes"),
+ netTxBytes: integer("net_tx_bytes"),
+});
+// --- metrics-history end ---
+
+// --- proxmox-node-history begin ---
+export const proxmoxNodeHistory = pgTable("proxmox_node_history", {
+ id: serial("id").primaryKey(),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ ts: text("ts")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ cpuPercent: doublePrecision("cpu_percent"),
+ memPercent: doublePrecision("mem_percent"),
+ diskPercent: doublePrecision("disk_percent"),
+ netRxBytes: integer("net_rx_bytes"),
+ netTxBytes: integer("net_tx_bytes"),
+});
+// --- proxmox-node-history end ---
+
+// --- alerts begin ---
+export const alertRules = pgTable("alert_rules", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id").references(() => hosts.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ enabled: boolean("enabled").notNull().default(true),
+ triggerType: text("trigger_type").notNull(),
+ thresholdValue: doublePrecision("threshold_value"),
+ thresholdDurationSeconds: integer("threshold_duration_seconds"),
+ cooldownMinutes: integer("cooldown_minutes").notNull().default(15),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const notificationChannels = pgTable("notification_channels", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ type: text("type").notNull(),
+ config: text("config").notNull(),
+ enabled: boolean("enabled").notNull().default(true),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const alertRuleChannels = pgTable("alert_rule_channels", {
+ id: serial("id").primaryKey(),
+ ruleId: integer("rule_id")
+ .notNull()
+ .references(() => alertRules.id, { onDelete: "cascade" }),
+ channelId: integer("channel_id")
+ .notNull()
+ .references(() => notificationChannels.id, { onDelete: "cascade" }),
+});
+
+export const alertFirings = pgTable(
+ "alert_firings",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ ruleId: integer("rule_id")
+ .notNull()
+ .references(() => alertRules.id, { onDelete: "cascade" }),
+ hostId: integer("host_id").notNull(),
+ hostName: text("host_name").notNull(),
+ firedAt: varchar("fired_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ resolvedAt: text("resolved_at"),
+ value: doublePrecision("value"),
+ message: text("message").notNull(),
+ severity: text("severity").notNull().default("warning"),
+ acknowledged: boolean("acknowledged")
+ .notNull()
+ .default(false),
+ },
+ // A rule's history is read newest-first; host_id is filtered on its own.
+ (table) => [
+ index("idx_alert_firings_rule").on(table.ruleId, table.firedAt),
+ index("idx_alert_firings_host").on(table.hostId),
+ ],
+);
+// --- alerts end ---
+
+// --- automations begin ---
+export const automations = pgTable(
+ "automations",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ description: text("description"),
+ enabled: boolean("enabled").notNull().default(true),
+ // The whole trigger + steps graph, shaped by AutomationDefinition. Read and
+ // written as a unit, never queried by its inner structure.
+ definition: text("definition").notNull(),
+ definitionVersion: integer("definition_version").notNull().default(1),
+ concurrencyPolicy: text("concurrency_policy").notNull().default("skip"),
+ maxRunSeconds: integer("max_run_seconds").notNull().default(300),
+ dryRun: boolean("dry_run").notNull().default(false),
+ lastRunAt: text("last_run_at"),
+ lastRunStatus: text("last_run_status"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // The scheduler sweeps enabled automations for one user at a time.
+ (table) => [index("idx_automations_user").on(table.userId, table.enabled)],
+);
+
+/**
+ * Durable per-target trigger state. state_key scopes a trigger to what it is
+ * actually watching ("", ":/data", ":"), so
+ * a sustained-breach window can track one filesystem rather than a whole host.
+ * Living in the database rather than memory means cooldowns and dwell windows
+ * survive a restart.
+ */
+export const automationTriggerState = pgTable(
+ "automation_trigger_state",
+ {
+ id: serial("id").primaryKey(),
+ automationId: integer("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ stateKey: varchar("state_key", { length: 255 }).notNull(),
+ breachStartedAt: text("breach_started_at"),
+ lastFiredAt: text("last_fired_at"),
+ lastValue: doublePrecision("last_value"),
+ lastObservedState: text("last_observed_state"),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ uniqueIndex("idx_automation_trigger_state_key").on(
+ table.automationId,
+ table.stateKey,
+ ),
+ ],
+);
+
+export const automationSchedules = pgTable(
+ "automation_schedules",
+ {
+ id: serial("id").primaryKey(),
+ automationId: integer("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ cron: text("cron"),
+ intervalSeconds: integer("interval_seconds"),
+ timezone: text("timezone"),
+ nextDueAt: varchar("next_due_at", { length: 255 }),
+ lastTickAt: text("last_tick_at"),
+ },
+ (table) => [
+ uniqueIndex("idx_automation_schedules_automation").on(table.automationId),
+ index("idx_automation_schedules_due").on(table.nextDueAt),
+ ],
+);
+
+export const automationRuns = pgTable(
+ "automation_runs",
+ {
+ id: serial("id").primaryKey(),
+ automationId: integer("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ triggerType: text("trigger_type").notNull(),
+ triggerContext: text("trigger_context"),
+ status: varchar("status", { length: 255 }).notNull(),
+ startedAt: varchar("started_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ finishedAt: text("finished_at"),
+ durationMs: integer("duration_ms"),
+ error: text("error"),
+ dryRun: boolean("dry_run").notNull().default(false),
+ // Set when one automation invoked another, so a chain can be traced.
+ parentRunId: integer("parent_run_id"),
+ },
+ (table) => [
+ index("idx_automation_runs_automation").on(
+ table.automationId,
+ table.startedAt,
+ ),
+ index("idx_automation_runs_user").on(table.userId, table.startedAt),
+ ],
+);
+
+export const automationRunSteps = pgTable(
+ "automation_run_steps",
+ {
+ id: serial("id").primaryKey(),
+ runId: integer("run_id")
+ .notNull()
+ .references(() => automationRuns.id, { onDelete: "cascade" }),
+ stepIndex: integer("step_index").notNull(),
+ stepId: text("step_id").notNull(),
+ stepType: text("step_type").notNull(),
+ status: varchar("status", { length: 255 }).notNull(),
+ startedAt: varchar("started_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ finishedAt: text("finished_at"),
+ output: text("output"),
+ error: text("error"),
+ truncated: boolean("truncated")
+ .notNull()
+ .default(false),
+ },
+ (table) => [
+ index("idx_automation_run_steps_run").on(table.runId, table.stepIndex),
+ ],
+);
+
+export const automationChannels = pgTable(
+ "automation_channels",
+ {
+ id: serial("id").primaryKey(),
+ automationId: integer("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ channelId: integer("channel_id")
+ .notNull()
+ .references(() => notificationChannels.id, { onDelete: "cascade" }),
+ },
+ (table) => [
+ uniqueIndex("idx_automation_channels_pair").on(
+ table.automationId,
+ table.channelId,
+ ),
+ ],
+);
+// --- automations end ---
+
+// --- homepage begin ---
+export const homepageItems = pgTable(
+ "homepage_items",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ typeId: text("type_id").notNull(),
+ title: text("title"),
+ config: text("config").notNull().default("{}"),
+ folderId: integer("folder_id"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_homepage_items_user_id").on(table.userId)],
+);
+
+export const homepageLayouts = pgTable("homepage_layouts", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .unique()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON: { entries: HomepageLayoutEntry[], pan: {x,y}, zoom: number }
+ layout: text("layout").notNull().default("{}"),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+// --- homepage end ---
+
+// --- fleets begin ---
+export const fleets = pgTable("fleets", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ description: text("description"),
+ color: text("color"),
+ icon: text("icon"),
+ // JSON array of { tag: string } rules, unioned with static fleetMembers at
+ // resolution time. Kept to tag-equality matching for v1.
+ tagRules: text("tag_rules"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const fleetMembers = pgTable(
+ "fleet_members",
+ {
+ id: serial("id").primaryKey(),
+ fleetId: integer("fleet_id")
+ .notNull()
+ .references(() => fleets.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ addedAt: text("added_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // fleet_id leads the unique pair, so listing a fleet's hosts is already
+ // served. Finding the fleets a host belongs to starts from host_id.
+ (table) => [
+ uniqueIndex("idx_fleet_members_fleet_host").on(table.fleetId, table.hostId),
+ index("idx_fleet_members_host").on(table.hostId),
+ ],
+);
+
+// Latest-only inventory snapshot per host, overwritten on each refresh - no
+// historical log, matching the "latest snapshot only" scope decision.
+export const fleetInventory = pgTable(
+ "fleet_inventory",
+ {
+ id: serial("id").primaryKey(),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ osPrettyName: text("os_pretty_name"),
+ kernel: text("kernel"),
+ architecture: text("architecture"),
+ hostname: text("hostname"),
+ uptimeSeconds: integer("uptime_seconds"),
+ ip: text("ip"),
+ packageManager: text("package_manager"),
+ collectedAt: text("collected_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // host_id leads the unique pair; a user's whole inventory is read by user_id.
+ (table) => [
+ uniqueIndex("idx_fleet_inventory_host").on(table.hostId, table.userId),
+ index("idx_fleet_inventory_user").on(table.userId),
+ ],
+);
+// --- fleets end ---
+
+// --- workspaces begin ---
+export const userWorkspaces = pgTable(
+ "user_workspaces",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: varchar("name", { length: 255 }).notNull(),
+ color: text("color"),
+ icon: text("icon"),
+ // "manual" | "last_session" - exactly one last_session row per user.
+ kind: text("kind").notNull().default("manual"),
+ isDefault: boolean("is_default")
+ .notNull()
+ .default(false),
+ // JSON-encoded WorkspacePayload: tabs, splitMode, paneTabIds, rowSizes, rowColSizes
+ payload: text("payload").notNull().default("{}"),
+ syncId: varchar("sync_id", { length: 255 }).unique(),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ lastUsedAt: text("last_used_at"),
+ },
+ (table) => [index("idx_user_workspaces_user_id").on(table.userId)],
+);
+// --- workspaces end ---
+
+// --- sync begin ---
+// Records a delete for a synced entity type so the other side of a sync
+// pair (embedded desktop backend <-> connected remote server) learns about
+// the deletion instead of re-creating the row on its next pull.
+export const syncTombstones = pgTable("sync_tombstones", {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ entityType: text("entity_type").notNull(),
+ syncId: varchar("sync_id", { length: 255 }).notNull(),
+ deletedAt: text("deleted_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+// --- sync end ---
+
+// --- ai begin ---
+/**
+ * A user's connection to one AI provider. api_key is encrypted at rest via
+ * FieldCrypto; it is never returned to the frontend, which only ever sees
+ * api_key_prefix for display.
+ */
+export const aiProviders = pgTable(
+ "ai_providers",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // ollama | anthropic | openai | gemini | openai_compatible
+ providerType: text("provider_type").notNull(),
+ label: varchar("label", { length: 255 }).notNull(),
+ // Required for ollama and openai_compatible, optional elsewhere.
+ baseUrl: text("base_url"),
+ apiKey: text("api_key"),
+ // First few characters, kept in the clear so the UI can identify a key.
+ apiKeyPrefix: text("api_key_prefix"),
+ defaultModel: text("default_model"),
+ enabled: boolean("enabled").notNull().default(true),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ uniqueIndex("idx_ai_providers_user_label").on(table.userId, table.label),
+ ],
+);
+
+export const aiConversations = pgTable(
+ "ai_conversations",
+ {
+ id: serial("id").primaryKey(),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ title: text("title"),
+ providerId: integer("provider_id"),
+ model: text("model"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: varchar("updated_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_ai_conversations_user").on(table.userId, table.updatedAt),
+ ],
+);
+
+export const aiMessages = pgTable(
+ "ai_messages",
+ {
+ id: serial("id").primaryKey(),
+ conversationId: integer("conversation_id")
+ .notNull()
+ .references(() => aiConversations.id, { onDelete: "cascade" }),
+ // user | assistant | tool
+ role: text("role").notNull(),
+ content: text("content").notNull().default(""),
+ // Serialized tool calls and their results for this turn.
+ toolCalls: text("tool_calls"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_ai_messages_conversation").on(
+ table.conversationId,
+ table.createdAt,
+ ),
+ ],
+);
+
+/**
+ * A change the assistant wants to make. Nothing here has been applied: the
+ * payload is re-validated against the tool schema at apply time and only then
+ * dispatched through the same repository logic a human action uses.
+ */
+export const aiProposals = pgTable(
+ "ai_proposals",
+ {
+ id: serial("id").primaryKey(),
+ conversationId: integer("conversation_id")
+ .notNull()
+ .references(() => aiConversations.id, { onDelete: "cascade" }),
+ userId: varchar("user_id", { length: 255 })
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // The propose_* tool name that produced this.
+ kind: text("kind").notNull(),
+ summary: text("summary"),
+ payload: text("payload").notNull().default("{}"),
+ // pending | applied | rejected | expired
+ status: varchar("status", { length: 255 }).notNull().default("pending"),
+ appliedAt: text("applied_at"),
+ resultSummary: text("result_summary"),
+ createdAt: varchar("created_at", { length: 255 })
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_ai_proposals_user").on(table.userId, table.status),
+ index("idx_ai_proposals_conversation").on(table.conversationId),
+ ],
+);
+// --- ai end ---
diff --git a/src/backend/database/db/schema.ts b/src/backend/database/db/schema.ts
index 6e0a305..6a15e34 100644
--- a/src/backend/database/db/schema.ts
+++ b/src/backend/database/db/schema.ts
@@ -1,4 +1,12 @@
-import { sqliteTable, text, integer, real } from "drizzle-orm/sqlite-core";
+import {
+ sqliteTable,
+ text,
+ integer,
+ real,
+ index,
+ uniqueIndex,
+ type AnySQLiteColumn,
+} from "drizzle-orm/sqlite-core";
import { sql } from "drizzle-orm";
export const users = sqliteTable("users", {
@@ -53,42 +61,54 @@ export const ssoProviders = sqliteTable("sso_providers", {
.default(sql`CURRENT_TIMESTAMP`),
});
-export const sessions = sqliteTable("sessions", {
- id: text("id").primaryKey(),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- jwtToken: text("jwt_token").notNull(),
- deviceType: text("device_type").notNull(),
- deviceInfo: text("device_info").notNull(),
- oidcSub: text("oidc_sub"),
- oidcSid: text("oidc_sid"),
- ssoProviderId: integer("sso_provider_id"),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- expiresAt: text("expires_at").notNull(),
- lastActiveAt: text("last_active_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const sessions = sqliteTable(
+ "sessions",
+ {
+ id: text("id").primaryKey(),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ jwtToken: text("jwt_token").notNull(),
+ deviceType: text("device_type").notNull(),
+ deviceInfo: text("device_info").notNull(),
+ oidcSub: text("oidc_sub"),
+ oidcSid: text("oidc_sid"),
+ ssoProviderId: integer("sso_provider_id"),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: text("expires_at").notNull(),
+ lastActiveAt: text("last_active_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Listing a user's devices, and the startup sweep of expired rows.
+ (table) => [
+ index("idx_sessions_user_id").on(table.userId),
+ index("idx_sessions_expires_at").on(table.expiresAt),
+ ],
+);
-export const trustedDevices = sqliteTable("trusted_devices", {
- id: text("id").primaryKey(),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- deviceFingerprint: text("device_fingerprint").notNull(),
- deviceType: text("device_type").notNull(),
- deviceInfo: text("device_info").notNull(),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- expiresAt: text("expires_at").notNull(),
- lastUsedAt: text("last_used_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const trustedDevices = sqliteTable(
+ "trusted_devices",
+ {
+ id: text("id").primaryKey(),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ deviceFingerprint: text("device_fingerprint").notNull(),
+ deviceType: text("device_type").notNull(),
+ deviceInfo: text("device_info").notNull(),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: text("expires_at").notNull(),
+ lastUsedAt: text("last_used_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_trusted_devices_user_id").on(table.userId)],
+);
export const webauthnCredentials = sqliteTable("webauthn_credentials", {
id: text("id").primaryKey(),
@@ -109,228 +129,303 @@ export const webauthnCredentials = sqliteTable("webauthn_credentials", {
lastUsedAt: text("last_used_at"),
});
-export const hosts = sqliteTable("ssh_data", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- connectionType: text("connection_type").notNull().default("ssh"),
- name: text("name"),
- ip: text("ip").notNull(),
- port: integer("port").notNull(),
- username: text("username").notNull(),
- folder: text("folder"),
- tags: text("tags"),
- pin: integer("pin", { mode: "boolean" }).notNull().default(false),
- authType: text("auth_type").notNull(),
- useWarpgate: integer("use_warpgate", { mode: "boolean" }).notNull().default(false),
- forceKeyboardInteractive: text("force_keyboard_interactive"),
+export const hosts = sqliteTable(
+ "ssh_data",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ connectionType: text("connection_type").notNull().default("ssh"),
+ name: text("name"),
+ ip: text("ip").notNull(),
+ port: integer("port").notNull(),
+ username: text("username").notNull(),
+ folder: text("folder"),
+ // Sub-host nesting: a host acting as an organizational parent for other
+ // hosts, mutually exclusive with folder (see host route validation).
+ parentHostId: integer("parent_host_id").references(
+ (): AnySQLiteColumn => hosts.id,
+ { onDelete: "set null" },
+ ),
+ tags: text("tags"),
+ pin: integer("pin", { mode: "boolean" }).notNull().default(false),
+ // Manual drag-to-reorder position within a folder. Null means the host has
+ // never been manually reordered; falls back to name sort in that case.
+ sortOrder: integer("sort_order"),
+ authType: text("auth_type").notNull(),
+ useWarpgate: integer("use_warpgate", { mode: "boolean" }).notNull().default(false),
+ shareSshAuth: integer("share_ssh_auth", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ forceKeyboardInteractive: text("force_keyboard_interactive"),
- password: text("password"),
- key: text("key", { length: 8192 }),
- keyPassword: text("key_password"),
- keyType: text("key_type"),
- sudoPassword: text("sudo_password"),
+ password: text("password"),
+ key: text("key", { length: 8192 }),
+ keyPassword: text("key_password"),
+ keyType: text("key_type"),
+ sudoPassword: text("sudo_password"),
- autostartPassword: text("autostart_password"),
- autostartKey: text("autostart_key", { length: 8192 }),
- autostartKeyPassword: text("autostart_key_password"),
+ autostartPassword: text("autostart_password"),
+ autostartKey: text("autostart_key", { length: 8192 }),
+ autostartKeyPassword: text("autostart_key_password"),
- credentialId: integer("credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
- overrideCredentialUsername: integer("override_credential_username", {
- mode: "boolean",
- }),
- // When authType is "vault", the host authenticates via a Vault SSH signer
- // profile (shared settings, no secrets). The signing certificate is obtained
- // per-user at connect time via an interactive Vault OIDC flow.
- vaultProfileId: integer("vault_profile_id").references(
- () => vaultProfiles.id,
- { onDelete: "set null" },
- ),
- enableTerminal: integer("enable_terminal", { mode: "boolean" })
- .notNull()
- .default(true),
- enableSessionLogging: integer("enable_session_logging", { mode: "boolean" })
- .notNull()
- .default(true),
- enableCommandHistory: integer("enable_command_history", { mode: "boolean" })
- .notNull()
- .default(true),
- enableTunnel: integer("enable_tunnel", { mode: "boolean" })
- .notNull()
- .default(true),
- tunnelConnections: text("tunnel_connections"),
- jumpHosts: text("jump_hosts"),
- enableFileManager: integer("enable_file_manager", { mode: "boolean" })
- .notNull()
- .default(true),
- scpLegacy: integer("scp_legacy", { mode: "boolean" }).notNull().default(false),
- enableDocker: integer("enable_docker", { mode: "boolean" })
- .notNull()
- .default(false),
- enableTmuxMonitor: integer("enable_tmux_monitor", { mode: "boolean" })
- .notNull()
- .default(false),
- showTerminalInSidebar: integer("show_terminal_in_sidebar", { mode: "boolean" })
- .notNull()
- .default(true),
- showFileManagerInSidebar: integer("show_file_manager_in_sidebar", { mode: "boolean" })
- .notNull()
- .default(false),
- showTunnelInSidebar: integer("show_tunnel_in_sidebar", { mode: "boolean" })
- .notNull()
- .default(false),
- showDockerInSidebar: integer("show_docker_in_sidebar", { mode: "boolean" })
- .notNull()
- .default(false),
- showServerStatsInSidebar: integer("show_server_stats_in_sidebar", { mode: "boolean" })
- .notNull()
- .default(false),
- defaultPath: text("default_path"),
- statsConfig: text("stats_config"),
- dockerConfig: text("docker_config"),
- enableProxmox: integer("enable_proxmox", { mode: "boolean" })
- .notNull()
- .default(false),
- proxmoxConfig: text("proxmox_config"),
- terminalConfig: text("terminal_config"),
- quickActions: text("quick_actions"),
- notes: text("notes"),
- enableSsh: integer("enable_ssh", { mode: "boolean" }).notNull().default(true),
- enableRdp: integer("enable_rdp", { mode: "boolean" }).notNull().default(false),
- enableVnc: integer("enable_vnc", { mode: "boolean" }).notNull().default(false),
- enableTelnet: integer("enable_telnet", { mode: "boolean" }).notNull().default(false),
+ credentialId: integer("credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ overrideCredentialUsername: integer("override_credential_username", {
+ mode: "boolean",
+ }),
+ // When authType is "vault", the host authenticates via a Vault SSH signer
+ // profile (shared settings, no secrets). The signing certificate is obtained
+ // per-user at connect time via an interactive Vault OIDC flow.
+ vaultProfileId: integer("vault_profile_id").references(
+ () => vaultProfiles.id,
+ { onDelete: "set null" },
+ ),
+ enableTerminal: integer("enable_terminal", { mode: "boolean" })
+ .notNull()
+ .default(true),
+ enableSessionLogging: integer("enable_session_logging", { mode: "boolean" })
+ .notNull()
+ .default(true),
+ allowSessionSharing: integer("allow_session_sharing", { mode: "boolean" })
+ .notNull()
+ .default(true),
+ enableCommandHistory: integer("enable_command_history", { mode: "boolean" })
+ .notNull()
+ .default(true),
+ enableTunnel: integer("enable_tunnel", { mode: "boolean" })
+ .notNull()
+ .default(true),
+ tunnelConnections: text("tunnel_connections"),
+ jumpHosts: text("jump_hosts"),
+ enableFileManager: integer("enable_file_manager", { mode: "boolean" })
+ .notNull()
+ .default(true),
+ scpLegacy: integer("scp_legacy", { mode: "boolean" }).notNull().default(false),
+ enableDocker: integer("enable_docker", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ enableTmuxMonitor: integer("enable_tmux_monitor", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ enableTerminalToolbar: integer("enable_terminal_toolbar", { mode: "boolean" })
+ .notNull()
+ .default(true),
+ showTerminalInSidebar: integer("show_terminal_in_sidebar", { mode: "boolean" })
+ .notNull()
+ .default(true),
+ showFileManagerInSidebar: integer("show_file_manager_in_sidebar", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ showTunnelInSidebar: integer("show_tunnel_in_sidebar", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ showDockerInSidebar: integer("show_docker_in_sidebar", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ showServerStatsInSidebar: integer("show_server_stats_in_sidebar", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ defaultPath: text("default_path"),
+ statsConfig: text("stats_config"),
+ dockerConfig: text("docker_config"),
+ enableProxmox: integer("enable_proxmox", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ proxmoxConfig: text("proxmox_config"),
+ enableProxmoxStats: integer("enable_proxmox_stats", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ proxmoxStatsConfig: text("proxmox_stats_config"),
+ terminalConfig: text("terminal_config"),
+ quickActions: text("quick_actions"),
+ notes: text("notes"),
+ enableSsh: integer("enable_ssh", { mode: "boolean" }).notNull().default(true),
+ enableRdp: integer("enable_rdp", { mode: "boolean" }).notNull().default(false),
+ enableVnc: integer("enable_vnc", { mode: "boolean" }).notNull().default(false),
+ enableTelnet: integer("enable_telnet", { mode: "boolean" }).notNull().default(false),
- sshPort: integer("ssh_port").default(22),
- rdpPort: integer("rdp_port").default(3389),
- vncPort: integer("vnc_port").default(5900),
- telnetPort: integer("telnet_port").default(23),
+ sshPort: integer("ssh_port").default(22),
+ rdpPort: integer("rdp_port").default(3389),
+ vncPort: integer("vnc_port").default(5900),
+ telnetPort: integer("telnet_port").default(23),
- rdpCredentialId: integer("rdp_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
- rdpUser: text("rdp_user"),
- rdpPassword: text("rdp_password"),
- rdpDomain: text("rdp_domain"),
- rdpSecurity: text("rdp_security"),
- rdpIgnoreCert: integer("rdp_ignore_cert", { mode: "boolean" }).default(false),
+ rdpCredentialId: integer("rdp_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ rdpUser: text("rdp_user"),
+ rdpPassword: text("rdp_password"),
+ rdpDomain: text("rdp_domain"),
+ rdpSecurity: text("rdp_security"),
+ rdpIgnoreCert: integer("rdp_ignore_cert", { mode: "boolean" }).default(false),
- vncCredentialId: integer("vnc_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
- vncPassword: text("vnc_password"),
- vncUser: text("vnc_user"),
+ vncCredentialId: integer("vnc_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ vncPassword: text("vnc_password"),
+ vncUser: text("vnc_user"),
- telnetUser: text("telnet_user"),
- telnetPassword: text("telnet_password"),
- telnetCredentialId: integer("telnet_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+ telnetUser: text("telnet_user"),
+ telnetPassword: text("telnet_password"),
+ telnetCredentialId: integer("telnet_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
- rdpAuthType: text("rdp_auth_type"),
- vncAuthType: text("vnc_auth_type"),
- telnetAuthType: text("telnet_auth_type"),
+ rdpAuthType: text("rdp_auth_type"),
+ vncAuthType: text("vnc_auth_type"),
+ telnetAuthType: text("telnet_auth_type"),
- domain: text("domain"),
- security: text("security"),
- ignoreCert: integer("ignore_cert", { mode: "boolean" }).default(false),
- guacamoleConfig: text("guacamole_config"),
+ domain: text("domain"),
+ security: text("security"),
+ ignoreCert: integer("ignore_cert", { mode: "boolean" }).default(false),
+ guacamoleConfig: text("guacamole_config"),
- useSocks5: integer("use_socks5", { mode: "boolean" }),
- socks5Host: text("socks5_host"),
- socks5Port: integer("socks5_port"),
- socks5Username: text("socks5_username"),
- socks5Password: text("socks5_password"),
- socks5ProxyChain: text("socks5_proxy_chain"),
+ useSocks5: integer("use_socks5", { mode: "boolean" }),
+ socks5Host: text("socks5_host"),
+ socks5Port: integer("socks5_port"),
+ socks5Username: text("socks5_username"),
+ socks5Password: text("socks5_password"),
+ socks5ProxyChain: text("socks5_proxy_chain"),
- macAddress: text("mac_address"),
- wolBroadcastAddress: text("wol_broadcast_address"),
- portKnockSequence: text("port_knock_sequence"),
+ // null = use the desktop app's global default; "local" | "remote" pins
+ // this specific host's SSH/Docker-console/Serial connections to originate
+ // from the embedded local backend or a connected remote sync server.
+ // Ignored for rdp/vnc/telnet, which always require the remote server.
+ connectionOrigin: text("connection_origin"),
- hostKeyFingerprint: text("host_key_fingerprint"),
- hostKeyType: text("host_key_type"),
- hostKeyAlgorithm: text("host_key_algorithm").default("sha256"),
- hostKeyFirstSeen: text("host_key_first_seen"),
- hostKeyLastVerified: text("host_key_last_verified"),
- hostKeyChangedCount: integer("host_key_changed_count").default(0),
+ macAddress: text("mac_address"),
+ wolBroadcastAddress: text("wol_broadcast_address"),
+ portKnockSequence: text("port_knock_sequence"),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- updatedAt: text("updated_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+ hostKeyFingerprint: text("host_key_fingerprint"),
+ hostKeyType: text("host_key_type"),
+ hostKeyAlgorithm: text("host_key_algorithm").default("sha256"),
+ hostKeyFirstSeen: text("host_key_first_seen"),
+ hostKeyLastVerified: text("host_key_last_verified"),
+ hostKeyChangedCount: integer("host_key_changed_count").default(0),
-export const fileManagerRecent = sqliteTable("file_manager_recent", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- hostId: integer("host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
- name: text("name").notNull(),
- path: text("path").notNull(),
- lastOpened: text("last_opened")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+ // Stable identity used to match this row across two independently-seeded
+ // databases (the embedded backend and a connected remote server) during
+ // sync -- local autoincrement ids collide across instances.
+ syncId: text("sync_id").unique(),
-export const fileManagerPinned = sqliteTable("file_manager_pinned", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- hostId: integer("host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
- name: text("name").notNull(),
- path: text("path").notNull(),
- pinnedAt: text("pinned_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Every host read is scoped by owner, so user_id carries the host list.
+ //
+ // `folder` is deliberately not indexed: on Postgres/MySQL an indexed text
+ // column is generated as varchar(255), and folder holds a joined nested path
+ // with no length cap, so indexing it would truncate deep hierarchies.
+ (table) => [
+ index("idx_ssh_data_user_id").on(table.userId),
+ index("idx_ssh_data_parent_host").on(table.parentHostId),
+ index("idx_ssh_data_credential").on(table.credentialId),
+ ],
+);
-export const fileManagerShortcuts = sqliteTable("file_manager_shortcuts", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- hostId: integer("host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
- name: text("name").notNull(),
- path: text("path").notNull(),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const fileManagerRecent = sqliteTable(
+ "file_manager_recent",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ path: text("path").notNull(),
+ lastOpened: text("last_opened")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Every file manager surface is read for one user on one host at a time.
+ (table) => [
+ index("idx_file_manager_recent_user").on(table.userId, table.hostId),
+ ],
+);
-export const transferRecent = sqliteTable("transfer_recent", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- sourceHostId: integer("source_host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
- destHostId: integer("dest_host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
- destPath: text("dest_path").notNull(),
- destPathLabel: text("dest_path_label").notNull(),
- lastUsed: text("last_used")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const fileManagerPinned = sqliteTable(
+ "file_manager_pinned",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ path: text("path").notNull(),
+ pinnedAt: text("pinned_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_file_manager_pinned_user").on(table.userId, table.hostId),
+ ],
+);
-export const dismissedAlerts = sqliteTable("dismissed_alerts", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- alertId: text("alert_id").notNull(),
- dismissedAt: text("dismissed_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const fileManagerShortcuts = sqliteTable(
+ "file_manager_shortcuts",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ path: text("path").notNull(),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_file_manager_shortcuts_user").on(table.userId, table.hostId),
+ ],
+);
-export const sshCredentials = sqliteTable("ssh_credentials", {
+export const transferRecent = sqliteTable(
+ "transfer_recent",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ sourceHostId: integer("source_host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ destHostId: integer("dest_host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ destPath: text("dest_path").notNull(),
+ destPathLabel: text("dest_path_label").notNull(),
+ lastUsed: text("last_used")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_transfer_recent_user").on(table.userId)],
+);
+
+export const dismissedAlerts = sqliteTable(
+ "dismissed_alerts",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ alertId: text("alert_id").notNull(),
+ dismissedAt: text("dismissed_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_dismissed_alerts_user_id").on(table.userId)],
+);
+
+export const sshCredentials = sqliteTable(
+ "ssh_credentials",
+ {
id: integer("id").primaryKey({ autoIncrement: true }),
userId: text("user_id")
.notNull()
@@ -339,6 +434,11 @@ export const sshCredentials = sqliteTable("ssh_credentials", {
description: text("description"),
folder: text("folder"),
tags: text("tags"),
+ pin: integer("pin", { mode: "boolean" }).notNull().default(false),
+ // Manual drag-to-reorder position within a folder. Null means the
+ // credential has never been manually reordered; falls back to name sort
+ // in that case, same convention as hosts.sortOrder.
+ sortOrder: integer("sort_order"),
authType: text("auth_type").notNull(),
username: text("username"),
password: text("password"),
@@ -354,48 +454,64 @@ export const sshCredentials = sqliteTable("ssh_credentials", {
usageCount: integer("usage_count").notNull().default(0),
lastUsed: text("last_used"),
+ syncId: text("sync_id").unique(),
createdAt: text("created_at")
.notNull()
.default(sql`CURRENT_TIMESTAMP`),
updatedAt: text("updated_at")
.notNull()
.default(sql`CURRENT_TIMESTAMP`),
-});
+ },
+ (table) => [index("idx_ssh_credentials_user_id").on(table.userId)],
+);
-export const sshCredentialUsage = sqliteTable("ssh_credential_usage", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- credentialId: integer("credential_id")
- .notNull()
- .references(() => sshCredentials.id, { onDelete: "cascade" }),
- hostId: integer("host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- usedAt: text("used_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const sshCredentialUsage = sqliteTable(
+ "ssh_credential_usage",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ credentialId: integer("credential_id")
+ .notNull()
+ .references(() => sshCredentials.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ usedAt: text("used_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_ssh_credential_usage_credential").on(table.credentialId),
+ index("idx_ssh_credential_usage_user").on(table.userId),
+ ],
+);
-export const snippets = sqliteTable("snippets", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- name: text("name").notNull(),
- content: text("content").notNull(),
- description: text("description"),
- folder: text("folder"),
- order: integer("order").notNull().default(0),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- updatedAt: text("updated_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- hostFilter: text("host_filter"),
-});
+export const snippets = sqliteTable(
+ "snippets",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ content: text("content").notNull(),
+ description: text("description"),
+ folder: text("folder"),
+ order: integer("order").notNull().default(0),
+ syncId: text("sync_id").unique(),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ hostFilter: text("host_filter"),
+ isNote: integer("is_note", { mode: "boolean" }).notNull().default(false),
+ },
+ (table) => [index("idx_snippets_user_id").on(table.userId)],
+);
export const snippetFolders = sqliteTable("snippet_folders", {
id: integer("id").primaryKey({ autoIncrement: true }),
@@ -405,6 +521,7 @@ export const snippetFolders = sqliteTable("snippet_folders", {
name: text("name").notNull(),
color: text("color"),
icon: text("icon"),
+ syncId: text("sync_id").unique(),
createdAt: text("created_at")
.notNull()
.default(sql`CURRENT_TIMESTAMP`),
@@ -430,74 +547,107 @@ export const c2sTunnelPresets = sqliteTable("c2s_tunnel_presets", {
.default(sql`CURRENT_TIMESTAMP`),
});
-export const snippetAccess = sqliteTable("snippet_access", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- snippetId: integer("snippet_id")
- .notNull()
- .references(() => snippets.id, { onDelete: "cascade" }),
+export const snippetAccess = sqliteTable(
+ "snippet_access",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ snippetId: integer("snippet_id")
+ .notNull()
+ .references(() => snippets.id, { onDelete: "cascade" }),
- userId: text("user_id").references(() => users.id, { onDelete: "cascade" }),
- roleId: integer("role_id").references(() => roles.id, {
- onDelete: "cascade",
- }),
+ userId: text("user_id").references(() => users.id, { onDelete: "cascade" }),
+ roleId: integer("role_id").references(() => roles.id, {
+ onDelete: "cascade",
+ }),
- grantedBy: text("granted_by")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
+ grantedBy: text("granted_by")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
- permissionLevel: text("permission_level").notNull().default("view"),
+ permissionLevel: text("permission_level").notNull().default("view"),
- expiresAt: text("expires_at"),
+ expiresAt: text("expires_at"),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Same three lookup shapes as host_access: by grantee, by role, by snippet.
+ (table) => [
+ index("idx_snippet_access_user_id").on(table.userId),
+ index("idx_snippet_access_snippet_id").on(table.snippetId),
+ index("idx_snippet_access_role_id").on(table.roleId),
+ ],
+);
-export const sshFolders = sqliteTable("ssh_folders", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- name: text("name").notNull(),
- color: text("color"),
- icon: text("icon"),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- updatedAt: text("updated_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const sshFolders = sqliteTable(
+ "ssh_folders",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ color: text("color"),
+ icon: text("icon"),
+ credentialId: integer("credential_id").references(() => sshCredentials.id, {
+ onDelete: "set null",
+ }),
+ // Manual drag-to-reorder position among sibling folders. Null falls back
+ // to name sort, same convention as hosts.sortOrder.
+ sortOrder: integer("sort_order"),
+ syncId: text("sync_id").unique(),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_ssh_folders_user_id").on(table.userId)],
+);
-export const recentActivity = sqliteTable("recent_activity", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- type: text("type").notNull(),
- hostId: integer("host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
- hostName: text("host_name"),
- timestamp: text("timestamp")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const recentActivity = sqliteTable(
+ "recent_activity",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ type: text("type").notNull(),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ hostName: text("host_name"),
+ timestamp: text("timestamp")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Always read newest-first for one user, so timestamp follows user_id.
+ (table) => [
+ index("idx_recent_activity_user_ts").on(table.userId, table.timestamp),
+ ],
+);
-export const commandHistory = sqliteTable("command_history", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- hostId: integer("host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
- command: text("command").notNull(),
- executedAt: text("executed_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const commandHistory = sqliteTable(
+ "command_history",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ command: text("command").notNull(),
+ executedAt: text("executed_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_command_history_user_host").on(table.userId, table.hostId),
+ ],
+);
export const networkTopology = sqliteTable("network_topology", {
id: integer("id").primaryKey({ autoIncrement: true }),
@@ -513,72 +663,122 @@ export const networkTopology = sqliteTable("network_topology", {
.default(sql`CURRENT_TIMESTAMP`),
});
-export const hostAccess = sqliteTable("host_access", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- hostId: integer("host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
+export const hostAccess = sqliteTable(
+ "host_access",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
- userId: text("user_id")
- .references(() => users.id, { onDelete: "cascade" }),
- roleId: integer("role_id")
- .references(() => roles.id, { onDelete: "cascade" }),
+ userId: text("user_id")
+ .references(() => users.id, { onDelete: "cascade" }),
+ roleId: integer("role_id")
+ .references(() => roles.id, { onDelete: "cascade" }),
- grantedBy: text("granted_by")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
+ grantedBy: text("granted_by")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
- permissionLevel: text("permission_level")
- .notNull()
- .default("connect"),
+ permissionLevel: text("permission_level")
+ .notNull()
+ .default("connect"),
- expiresAt: text("expires_at"),
+ expiresAt: text("expires_at"),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- lastAccessedAt: text("last_accessed_at"),
- accessCount: integer("access_count").notNull().default(0),
- overrideCredentialId: integer("override_credential_id").references(
- () => sshCredentials.id,
- { onDelete: "set null" },
- ),
-});
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ lastAccessedAt: text("last_accessed_at"),
+ accessCount: integer("access_count").notNull().default(0),
+ },
+ // Resolved on every host list request and every permission check, so all
+ // three lookup shapes (by grantee, by role, by host) need to be indexed.
+ (table) => [
+ index("idx_host_access_user_id").on(table.userId),
+ index("idx_host_access_role_id").on(table.roleId),
+ index("idx_host_access_host_id").on(table.hostId),
+ index("idx_host_access_expires_at").on(table.expiresAt),
+ ],
+);
-export const sharedHostSecrets = sqliteTable("shared_host_secrets", {
- id: integer("id").primaryKey({ autoIncrement: true }),
+export const sharedHostAuthOverrides = sqliteTable(
+ "shared_host_auth_overrides",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ protocol: text("protocol").notNull().default("ssh"),
+ credentialId: integer("credential_id")
+ .notNull()
+ .references(() => sshCredentials.id, { onDelete: "cascade" }),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ uniqueIndex("shared_host_auth_overrides_host_user_protocol_unique").on(
+ table.hostId,
+ table.userId,
+ table.protocol,
+ ),
+ ],
+);
- hostAccessId: integer("host_access_id")
- .notNull()
- .references(() => hostAccess.id, { onDelete: "cascade" }),
+export const sharedHostSecrets = sqliteTable(
+ "shared_host_secrets",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
- targetUserId: text("target_user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
+ hostAccessId: integer("host_access_id")
+ .notNull()
+ .references(() => hostAccess.id, { onDelete: "cascade" }),
- protocol: text("protocol").notNull().default("ssh"),
- sourceType: text("source_type").notNull().default("credential"),
+ targetUserId: text("target_user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
- originalCredentialId: integer("original_credential_id").references(
- () => sshCredentials.id,
- { onDelete: "cascade" },
- ),
+ protocol: text("protocol").notNull().default("ssh"),
+ sourceType: text("source_type").notNull().default("credential"),
- encryptedUsername: text("encrypted_username"),
- encryptedAuthType: text("encrypted_auth_type"),
- encryptedPassword: text("encrypted_password"),
- encryptedKey: text("encrypted_key", { length: 16384 }),
- encryptedKeyPassword: text("encrypted_key_password"),
- encryptedKeyType: text("encrypted_key_type"),
- encryptedDomain: text("encrypted_domain"),
+ originalCredentialId: integer("original_credential_id").references(
+ () => sshCredentials.id,
+ { onDelete: "cascade" },
+ ),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- updatedAt: text("updated_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+ encryptedUsername: text("encrypted_username"),
+ encryptedAuthType: text("encrypted_auth_type"),
+ encryptedPassword: text("encrypted_password"),
+ encryptedKey: text("encrypted_key", { length: 16384 }),
+ encryptedKeyPassword: text("encrypted_key_password"),
+ encryptedKeyType: text("encrypted_key_type"),
+ encryptedDomain: text("encrypted_domain"),
+
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ (table) => [
+ uniqueIndex("idx_shared_host_secrets_scope").on(
+ table.hostAccessId,
+ table.targetUserId,
+ table.protocol,
+ ),
+ ],
+);
export const roles = sqliteTable("roles", {
id: integer("id").primaryKey({ autoIncrement: true }),
@@ -600,102 +800,211 @@ export const roles = sqliteTable("roles", {
.default(sql`CURRENT_TIMESTAMP`),
});
-export const userRoles = sqliteTable("user_roles", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- roleId: integer("role_id")
- .notNull()
- .references(() => roles.id, { onDelete: "cascade" }),
+export const userRoles = sqliteTable(
+ "user_roles",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ roleId: integer("role_id")
+ .notNull()
+ .references(() => roles.id, { onDelete: "cascade" }),
+
+ grantedBy: text("granted_by").references(() => users.id, {
+ onDelete: "set null",
+ }),
+ grantedAt: text("granted_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ //
+ // The unique pair already serves lookups by user, since user_id leads it.
+ // Listing a role's members starts from role_id, which it cannot serve.
+ (table) => [
+ uniqueIndex("idx_user_roles_user_role").on(table.userId, table.roleId),
+ index("idx_user_roles_role_id").on(table.roleId),
+ ],
+);
- grantedBy: text("granted_by").references(() => users.id, {
- onDelete: "set null",
- }),
- grantedAt: text("granted_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const auditLogs = sqliteTable(
+ "audit_logs",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
-export const auditLogs = sqliteTable("audit_logs", {
- id: integer("id").primaryKey({ autoIncrement: true }),
+ // Nullable on purpose: the trail outlives the account, and username keeps the
+ // entry attributable once the reference is gone.
+ userId: text("user_id").references(() => users.id, { onDelete: "set null" }),
+ username: text("username").notNull(),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- username: text("username").notNull(),
+ action: text("action").notNull(),
+ resourceType: text("resource_type").notNull(),
+ resourceId: text("resource_id"),
+ resourceName: text("resource_name"),
- action: text("action").notNull(),
- resourceType: text("resource_type").notNull(),
- resourceId: text("resource_id"),
- resourceName: text("resource_name"),
+ details: text("details"),
+ ipAddress: text("ip_address"),
+ userAgent: text("user_agent"),
- details: text("details"),
- ipAddress: text("ip_address"),
- userAgent: text("user_agent"),
+ success: integer("success", { mode: "boolean" }).notNull(),
+ errorMessage: text("error_message"),
- success: integer("success", { mode: "boolean" }).notNull(),
- errorMessage: text("error_message"),
+ timestamp: text("timestamp")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // This table only grows, and is always read newest-first with an optional
+ // filter. Each composite leads with the filtered column so the same index
+ // also satisfies the ORDER BY.
+ (table) => [
+ index("idx_audit_logs_timestamp").on(table.timestamp),
+ index("idx_audit_logs_user_ts").on(table.userId, table.timestamp),
+ index("idx_audit_logs_action_ts").on(table.action, table.timestamp),
+ index("idx_audit_logs_resource_ts").on(table.resourceType, table.timestamp),
+ ],
+);
- timestamp: text("timestamp")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const sessionRecordings = sqliteTable(
+ "session_recordings",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
-export const sessionRecordings = sqliteTable("session_recordings", {
- id: integer("id").primaryKey({ autoIncrement: true }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ // Nullable on purpose: a recording is evidence about the host as much as the
+ // person, so it outlives the account. username keeps it attributable.
+ userId: text("user_id").references(() => users.id, { onDelete: "set null" }),
+ username: text("username"),
+ accessId: integer("access_id").references(() => hostAccess.id, {
+ onDelete: "set null",
+ }),
+
+ startedAt: text("started_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ endedAt: text("ended_at"),
+ duration: integer("duration"),
+
+ commands: text("commands"),
+ dangerousActions: text("dangerous_actions"),
+
+ recordingPath: text("recording_path"),
+ protocol: text("protocol").notNull().default("ssh"),
+ format: text("format").notNull().default("text"),
+
+ terminatedByOwner: integer("terminated_by_owner", {
+ mode: "boolean",
+ }).default(false),
+ terminationReason: text("termination_reason"),
+ },
+ // Listed newest-first per user, and audited per host.
+ (table) => [
+ index("idx_session_recordings_user_started").on(
+ table.userId,
+ table.startedAt,
+ ),
+ index("idx_session_recordings_host").on(table.hostId),
+ ],
+);
+
+export const sessionShares = sqliteTable(
+ "session_shares",
+ {
+ id: text("id").primaryKey(),
hostId: integer("host_id")
.notNull()
.references(() => hosts.id, { onDelete: "cascade" }),
- userId: text("user_id")
+ ownerUserId: text("owner_user_id")
.notNull()
.references(() => users.id, { onDelete: "cascade" }),
- accessId: integer("access_id").references(() => hostAccess.id, {
- onDelete: "set null",
+
+ protocol: text("protocol").notNull(),
+
+ // Live-session binding: TerminalSessionManager's session.id for SSH, or
+ // guacd's own guacamoleConnectionId for rdp/vnc/telnet. Neither is a DB
+ // row (process-local, in-memory) so this intentionally has no FK.
+ sessionId: text("session_id").notNull(),
+ tabInstanceId: text("tab_instance_id"),
+
+ shareType: text("share_type").notNull(), // "link" | "user"
+ targetUserId: text("target_user_id").references(() => users.id, {
+ onDelete: "cascade",
}),
+ linkToken: text("link_token").unique(),
- startedAt: text("started_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- endedAt: text("ended_at"),
- duration: integer("duration"),
-
- commands: text("commands"),
- dangerousActions: text("dangerous_actions"),
-
- recordingPath: text("recording_path"),
- protocol: text("protocol").notNull().default("ssh"),
- format: text("format").notNull().default("text"),
-
- terminatedByOwner: integer("terminated_by_owner", { mode: "boolean" })
- .default(false),
- terminationReason: text("termination_reason"),
-});
-
-export const opksshTokens = sqliteTable("opkssh_tokens", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- hostId: integer("host_id")
- .notNull()
- .references(() => hosts.id, { onDelete: "cascade" }),
-
- sshCert: text("ssh_cert", { length: 8192 }).notNull(),
- privateKey: text("private_key", { length: 8192 }).notNull(),
-
- email: text("email"),
- sub: text("sub"),
- issuer: text("issuer"),
- audience: text("audience"),
+ permissionLevel: text("permission_level").notNull().default("read-only"),
createdAt: text("created_at")
.notNull()
.default(sql`CURRENT_TIMESTAMP`),
expiresAt: text("expires_at").notNull(),
- lastUsed: text("last_used"),
-});
+ revokedAt: text("revoked_at"),
+
+ lastJoinedAt: text("last_joined_at"),
+ joinCount: integer("join_count").notNull().default(0),
+ },
+ // Resolved from the live session on join, and listed per host.
+ (table) => [
+ index("idx_session_shares_session_id").on(table.sessionId),
+ index("idx_session_shares_host_id").on(table.hostId),
+ ],
+);
+
+export const sessionShareParticipants = sqliteTable(
+ "session_share_participants",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ shareId: text("share_id")
+ .notNull()
+ .references(() => sessionShares.id, { onDelete: "cascade" }),
+
+ userId: text("user_id").references(() => users.id, {
+ onDelete: "cascade",
+ }),
+ guestLabel: text("guest_label"),
+
+ joinedAt: text("joined_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ leftAt: text("left_at"),
+ },
+);
+
+export const opksshTokens = sqliteTable(
+ "opkssh_tokens",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+
+ sshCert: text("ssh_cert", { length: 8192 }).notNull(),
+ privateKey: text("private_key", { length: 8192 }).notNull(),
+
+ email: text("email"),
+ sub: text("sub"),
+ issuer: text("issuer"),
+ audience: text("audience"),
+
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: text("expires_at").notNull(),
+ lastUsed: text("last_used"),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ (table) => [uniqueIndex("idx_opkssh_tokens_user_host").on(table.userId, table.hostId)],
+);
// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
// are intended to be shared across users (shared === true makes a profile
@@ -724,6 +1033,7 @@ export const vaultProfiles = sqliteTable("vault_profiles", {
keyType: text("key_type"),
// When true the profile is visible/usable by all users on the server
shared: integer("shared", { mode: "boolean" }).notNull().default(false),
+ syncId: text("sync_id").unique(),
createdAt: text("created_at")
.notNull()
.default(sql`CURRENT_TIMESTAMP`),
@@ -735,56 +1045,73 @@ export const vaultProfiles = sqliteTable("vault_profiles", {
// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
// Transient: rows live only until the certificate expires. Secret fields are
// encrypted under the user's data-encryption key (see field-crypto.ts).
-export const vaultTokens = sqliteTable("vault_tokens", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- profileId: integer("profile_id")
- .notNull()
- .references(() => vaultProfiles.id, { onDelete: "cascade" }),
+export const vaultTokens = sqliteTable(
+ "vault_tokens",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ profileId: integer("profile_id")
+ .notNull()
+ .references(() => vaultProfiles.id, { onDelete: "cascade" }),
+
+ sshCert: text("ssh_cert", { length: 8192 }).notNull(),
+ privateKey: text("private_key", { length: 8192 }).notNull(),
+
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: text("expires_at").notNull(),
+ lastUsed: text("last_used"),
+ },
+ // Declared inline in the production DDL as UNIQUE(...), but never here,
+ // so the generated Postgres and MySQL schemas allowed duplicates the
+ // SQLite deployment forbids โ and the upsert had nothing to conflict on.
+ (table) => [uniqueIndex("idx_vault_tokens_user_profile").on(table.userId, table.profileId)],
+);
- sshCert: text("ssh_cert", { length: 8192 }).notNull(),
- privateKey: text("private_key", { length: 8192 }).notNull(),
+export const apiKeys = sqliteTable(
+ "api_keys",
+ {
+ id: text("id").primaryKey(),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ tokenHash: text("token_hash").notNull(),
+ tokenPrefix: text("token_prefix").notNull(),
+ createdAt: text("created_at").notNull().default(sql`CURRENT_TIMESTAMP`),
+ expiresAt: text("expires_at"),
+ lastUsedAt: text("last_used_at"),
+ isActive: integer("is_active", { mode: "boolean" }).notNull().default(true),
+ },
+ (table) => [index("idx_api_keys_user_id").on(table.userId)],
+);
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- expiresAt: text("expires_at").notNull(),
- lastUsed: text("last_used"),
-});
-
-export const apiKeys = sqliteTable("api_keys", {
- id: text("id").primaryKey(),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- name: text("name").notNull(),
- tokenHash: text("token_hash").notNull(),
- tokenPrefix: text("token_prefix").notNull(),
- createdAt: text("created_at").notNull().default(sql`CURRENT_TIMESTAMP`),
- expiresAt: text("expires_at"),
- lastUsedAt: text("last_used_at"),
- isActive: integer("is_active", { mode: "boolean" }).notNull().default(true),
-});
-
-export const userOpenTabs = sqliteTable("user_open_tabs", {
- id: text("id").primaryKey(),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- tabType: text("tab_type").notNull(),
- hostId: integer("host_id").references(() => hosts.id, { onDelete: "cascade" }),
- label: text("label").notNull(),
- tabOrder: integer("tab_order").notNull().default(0),
- backendSessionId: text("backend_session_id"),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- updatedAt: text("updated_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const userOpenTabs = sqliteTable(
+ "user_open_tabs",
+ {
+ id: text("id").primaryKey(),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ tabType: text("tab_type").notNull(),
+ hostId: integer("host_id").references(() => hosts.id, {
+ onDelete: "cascade",
+ }),
+ label: text("label").notNull(),
+ tabOrder: integer("tab_order").notNull().default(0),
+ backendSessionId: text("backend_session_id"),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_user_open_tabs_user_id").on(table.userId)],
+);
export const userPreferences = sqliteTable("user_preferences", {
userId: text("user_id")
@@ -811,14 +1138,27 @@ export const userPreferences = sqliteTable("user_preferences", {
disableUpdateCheck: integer("disable_update_check", { mode: "boolean" }),
confirmTabClose: integer("confirm_tab_close", { mode: "boolean" }),
hiddenRailTabs: text("hidden_rail_tabs"),
+ // null means the user has not been asked yet; the assistant stays hidden
+ // until this is explicitly true and the admin global is on.
+ aiAssistantEnabled: integer("ai_assistant_enabled", { mode: "boolean" }),
+ // Opt-in to letting the assistant run allowlisted read-only diagnostics
+ // without a per-command approval click.
+ aiReadOnlyCommands: integer("ai_read_only_commands", { mode: "boolean" }),
compactHostView: integer("compact_host_view", { mode: "boolean" }),
statusColorScheme: text("status_color_scheme"),
+ customThemes: text("custom_themes"),
+ customKeybindings: text("custom_keybindings"),
+ terminalDefaults: text("terminal_defaults"),
+ rdpDefaults: text("rdp_defaults"),
+ terminalMacros: text("terminal_macros"),
updatedAt: text("updated_at")
.notNull()
.default(sql`CURRENT_TIMESTAMP`),
});
-export const hostMetricsPreferences = sqliteTable("host_metrics_preferences", {
+export const hostMetricsPreferences = sqliteTable(
+ "host_metrics_preferences",
+ {
id: integer("id").primaryKey({ autoIncrement: true }),
userId: text("user_id")
.notNull()
@@ -835,9 +1175,79 @@ export const hostMetricsPreferences = sqliteTable("host_metrics_preferences", {
updatedAt: text("updated_at")
.notNull()
.default(sql`CURRENT_TIMESTAMP`),
+ },
+ // One layout per user per host. Enforced in production since the inline DDL
+ // creates it, but it was never declared here, so the generated Postgres and
+ // MySQL schemas lacked it โ and the upsert has nothing to conflict on.
+ (table) => [
+ uniqueIndex("idx_host_metrics_prefs_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const proxmoxStatsPreferences = sqliteTable(
+ "proxmox_stats_preferences",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+ hostId: integer("host_id").notNull().references(() => hosts.id, { onDelete: "cascade" }),
+ // JSON-encoded ProxmoxStatsLayout. Layout has no secrets, so it is stored as
+ // plain JSON (no field-level encryption), same convention as hostMetricsPreferences.layout.
+ layout: text("layout").notNull(),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ uniqueIndex("idx_proxmox_stats_prefs_user_host").on(table.userId, table.hostId),
+ ],
+);
+
+export const hostSidebarPreferences = sqliteTable("host_sidebar_preferences", {
+ userId: text("user_id")
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON-encoded HostSidebarPreferences. No secrets in this blob, stored as
+ // plain JSON like hostMetricsPreferences.layout.
+ data: text("data").notNull(),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
});
-export const hostHealthChecks = sqliteTable("host_health_checks", {
+export const credentialSidebarPreferences = sqliteTable(
+ "credential_sidebar_preferences",
+ {
+ userId: text("user_id")
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON-encoded CredentialSidebarPreferences. No secrets in this blob,
+ // same convention as hostSidebarPreferences.data.
+ data: text("data").notNull(),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+);
+
+export const uiPreferences = sqliteTable("ui_preferences", {
+ userId: text("user_id")
+ .primaryKey()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // JSON-encoded UiPreferences (preset + per-area overrides + onboarding
+ // state). No secrets in this blob, same convention as
+ // hostSidebarPreferences.data.
+ data: text("data").notNull(),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const hostHealthChecks = sqliteTable(
+ "host_health_checks",
+ {
id: integer("id").primaryKey({ autoIncrement: true }),
userId: text("user_id")
.notNull()
@@ -854,7 +1264,12 @@ export const hostHealthChecks = sqliteTable("host_health_checks", {
updatedAt: text("updated_at")
.notNull()
.default(sql`CURRENT_TIMESTAMP`),
-});
+ },
+ // Same as above: one set of checks per user per host.
+ (table) => [
+ uniqueIndex("idx_host_health_checks_user_host").on(table.userId, table.hostId),
+ ],
+);
export const hostHealthHistory = sqliteTable("host_health_history", {
id: integer("id").primaryKey({ autoIncrement: true }),
@@ -879,9 +1294,13 @@ export const dashboardServiceLinks = sqliteTable("dashboard_service_links", {
label: text("label").notNull(),
url: text("url").notNull(),
order: integer("order").notNull().default(0),
+ syncId: text("sync_id").unique(),
createdAt: text("created_at")
.notNull()
.default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
});
// --- termix-id begin ---
@@ -991,6 +1410,23 @@ export const hostMetricsHistory = sqliteTable("host_metrics_history", {
});
// --- metrics-history end ---
+// --- proxmox-node-history begin ---
+export const proxmoxNodeHistory = sqliteTable("proxmox_node_history", {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ ts: text("ts")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ cpuPercent: real("cpu_percent"),
+ memPercent: real("mem_percent"),
+ diskPercent: real("disk_percent"),
+ netRxBytes: integer("net_rx_bytes"),
+ netTxBytes: integer("net_tx_bytes"),
+});
+// --- proxmox-node-history end ---
+
// --- alerts begin ---
export const alertRules = sqliteTable("alert_rules", {
id: integer("id").primaryKey({ autoIncrement: true }),
@@ -1036,44 +1472,218 @@ export const alertRuleChannels = sqliteTable("alert_rule_channels", {
.references(() => notificationChannels.id, { onDelete: "cascade" }),
});
-export const alertFirings = sqliteTable("alert_firings", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- ruleId: integer("rule_id")
- .notNull()
- .references(() => alertRules.id, { onDelete: "cascade" }),
- hostId: integer("host_id").notNull(),
- hostName: text("host_name").notNull(),
- firedAt: text("fired_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- resolvedAt: text("resolved_at"),
- value: real("value"),
- message: text("message").notNull(),
- severity: text("severity").notNull().default("warning"),
- acknowledged: integer("acknowledged", { mode: "boolean" }).notNull().default(false),
-});
+export const alertFirings = sqliteTable(
+ "alert_firings",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ ruleId: integer("rule_id")
+ .notNull()
+ .references(() => alertRules.id, { onDelete: "cascade" }),
+ hostId: integer("host_id").notNull(),
+ hostName: text("host_name").notNull(),
+ firedAt: text("fired_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ resolvedAt: text("resolved_at"),
+ value: real("value"),
+ message: text("message").notNull(),
+ severity: text("severity").notNull().default("warning"),
+ acknowledged: integer("acknowledged", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ },
+ // A rule's history is read newest-first; host_id is filtered on its own.
+ (table) => [
+ index("idx_alert_firings_rule").on(table.ruleId, table.firedAt),
+ index("idx_alert_firings_host").on(table.hostId),
+ ],
+);
// --- alerts end ---
+// --- automations begin ---
+export const automations = sqliteTable(
+ "automations",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ description: text("description"),
+ enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+ // The whole trigger + steps graph, shaped by AutomationDefinition. Read and
+ // written as a unit, never queried by its inner structure.
+ definition: text("definition").notNull(),
+ definitionVersion: integer("definition_version").notNull().default(1),
+ concurrencyPolicy: text("concurrency_policy").notNull().default("skip"),
+ maxRunSeconds: integer("max_run_seconds").notNull().default(300),
+ dryRun: integer("dry_run", { mode: "boolean" }).notNull().default(false),
+ lastRunAt: text("last_run_at"),
+ lastRunStatus: text("last_run_status"),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // The scheduler sweeps enabled automations for one user at a time.
+ (table) => [index("idx_automations_user").on(table.userId, table.enabled)],
+);
+
+/**
+ * Durable per-target trigger state. state_key scopes a trigger to what it is
+ * actually watching ("", ":/data", ":"), so
+ * a sustained-breach window can track one filesystem rather than a whole host.
+ * Living in the database rather than memory means cooldowns and dwell windows
+ * survive a restart.
+ */
+export const automationTriggerState = sqliteTable(
+ "automation_trigger_state",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ automationId: integer("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ stateKey: text("state_key").notNull(),
+ breachStartedAt: text("breach_started_at"),
+ lastFiredAt: text("last_fired_at"),
+ lastValue: real("last_value"),
+ lastObservedState: text("last_observed_state"),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ uniqueIndex("idx_automation_trigger_state_key").on(
+ table.automationId,
+ table.stateKey,
+ ),
+ ],
+);
+
+export const automationSchedules = sqliteTable(
+ "automation_schedules",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ automationId: integer("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ cron: text("cron"),
+ intervalSeconds: integer("interval_seconds"),
+ timezone: text("timezone"),
+ nextDueAt: text("next_due_at"),
+ lastTickAt: text("last_tick_at"),
+ },
+ (table) => [
+ uniqueIndex("idx_automation_schedules_automation").on(table.automationId),
+ index("idx_automation_schedules_due").on(table.nextDueAt),
+ ],
+);
+
+export const automationRuns = sqliteTable(
+ "automation_runs",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ automationId: integer("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ triggerType: text("trigger_type").notNull(),
+ triggerContext: text("trigger_context"),
+ status: text("status").notNull(),
+ startedAt: text("started_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ finishedAt: text("finished_at"),
+ durationMs: integer("duration_ms"),
+ error: text("error"),
+ dryRun: integer("dry_run", { mode: "boolean" }).notNull().default(false),
+ // Set when one automation invoked another, so a chain can be traced.
+ parentRunId: integer("parent_run_id"),
+ },
+ (table) => [
+ index("idx_automation_runs_automation").on(
+ table.automationId,
+ table.startedAt,
+ ),
+ index("idx_automation_runs_user").on(table.userId, table.startedAt),
+ ],
+);
+
+export const automationRunSteps = sqliteTable(
+ "automation_run_steps",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ runId: integer("run_id")
+ .notNull()
+ .references(() => automationRuns.id, { onDelete: "cascade" }),
+ stepIndex: integer("step_index").notNull(),
+ stepId: text("step_id").notNull(),
+ stepType: text("step_type").notNull(),
+ status: text("status").notNull(),
+ startedAt: text("started_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ finishedAt: text("finished_at"),
+ output: text("output"),
+ error: text("error"),
+ truncated: integer("truncated", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ },
+ (table) => [
+ index("idx_automation_run_steps_run").on(table.runId, table.stepIndex),
+ ],
+);
+
+export const automationChannels = sqliteTable(
+ "automation_channels",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ automationId: integer("automation_id")
+ .notNull()
+ .references(() => automations.id, { onDelete: "cascade" }),
+ channelId: integer("channel_id")
+ .notNull()
+ .references(() => notificationChannels.id, { onDelete: "cascade" }),
+ },
+ (table) => [
+ uniqueIndex("idx_automation_channels_pair").on(
+ table.automationId,
+ table.channelId,
+ ),
+ ],
+);
+// --- automations end ---
+
// --- homepage begin ---
-export const homepageItems = sqliteTable("homepage_items", {
- id: integer("id").primaryKey({ autoIncrement: true }),
- userId: text("user_id")
- .notNull()
- .references(() => users.id, { onDelete: "cascade" }),
- typeId: text("type_id").notNull(),
- title: text("title"),
- config: text("config").notNull().default("{}"),
- folderId: integer("folder_id"),
- createdAt: text("created_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
- updatedAt: text("updated_at")
- .notNull()
- .default(sql`CURRENT_TIMESTAMP`),
-});
+export const homepageItems = sqliteTable(
+ "homepage_items",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ typeId: text("type_id").notNull(),
+ title: text("title"),
+ config: text("config").notNull().default("{}"),
+ folderId: integer("folder_id"),
+ syncId: text("sync_id").unique(),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [index("idx_homepage_items_user_id").on(table.userId)],
+);
export const homepageLayouts = sqliteTable("homepage_layouts", {
id: integer("id").primaryKey({ autoIncrement: true }),
@@ -1088,3 +1698,241 @@ export const homepageLayouts = sqliteTable("homepage_layouts", {
.default(sql`CURRENT_TIMESTAMP`),
});
// --- homepage end ---
+
+// --- fleets begin ---
+export const fleets = sqliteTable("fleets", {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ description: text("description"),
+ color: text("color"),
+ icon: text("icon"),
+ // JSON array of { tag: string } rules, unioned with static fleetMembers at
+ // resolution time. Kept to tag-equality matching for v1.
+ tagRules: text("tag_rules"),
+ syncId: text("sync_id").unique(),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const fleetMembers = sqliteTable(
+ "fleet_members",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ fleetId: integer("fleet_id")
+ .notNull()
+ .references(() => fleets.id, { onDelete: "cascade" }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ addedAt: text("added_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // fleet_id leads the unique pair, so listing a fleet's hosts is already
+ // served. Finding the fleets a host belongs to starts from host_id.
+ (table) => [
+ uniqueIndex("idx_fleet_members_fleet_host").on(table.fleetId, table.hostId),
+ index("idx_fleet_members_host").on(table.hostId),
+ ],
+);
+
+// Latest-only inventory snapshot per host, overwritten on each refresh - no
+// historical log, matching the "latest snapshot only" scope decision.
+export const fleetInventory = sqliteTable(
+ "fleet_inventory",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ hostId: integer("host_id")
+ .notNull()
+ .references(() => hosts.id, { onDelete: "cascade" }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ osPrettyName: text("os_pretty_name"),
+ kernel: text("kernel"),
+ architecture: text("architecture"),
+ hostname: text("hostname"),
+ uptimeSeconds: integer("uptime_seconds"),
+ ip: text("ip"),
+ packageManager: text("package_manager"),
+ collectedAt: text("collected_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ // host_id leads the unique pair; a user's whole inventory is read by user_id.
+ (table) => [
+ uniqueIndex("idx_fleet_inventory_host").on(table.hostId, table.userId),
+ index("idx_fleet_inventory_user").on(table.userId),
+ ],
+);
+// --- fleets end ---
+
+// --- workspaces begin ---
+export const userWorkspaces = sqliteTable(
+ "user_workspaces",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ name: text("name").notNull(),
+ color: text("color"),
+ icon: text("icon"),
+ // "manual" | "last_session" - exactly one last_session row per user.
+ kind: text("kind").notNull().default("manual"),
+ isDefault: integer("is_default", { mode: "boolean" })
+ .notNull()
+ .default(false),
+ // JSON-encoded WorkspacePayload: tabs, splitMode, paneTabIds, rowSizes, rowColSizes
+ payload: text("payload").notNull().default("{}"),
+ syncId: text("sync_id").unique(),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ lastUsedAt: text("last_used_at"),
+ },
+ (table) => [index("idx_user_workspaces_user_id").on(table.userId)],
+);
+// --- workspaces end ---
+
+// --- sync begin ---
+// Records a delete for a synced entity type so the other side of a sync
+// pair (embedded desktop backend <-> connected remote server) learns about
+// the deletion instead of re-creating the row on its next pull.
+export const syncTombstones = sqliteTable("sync_tombstones", {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ entityType: text("entity_type").notNull(),
+ syncId: text("sync_id").notNull(),
+ deletedAt: text("deleted_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+});
+// --- sync end ---
+
+// --- ai begin ---
+/**
+ * A user's connection to one AI provider. api_key is encrypted at rest via
+ * FieldCrypto; it is never returned to the frontend, which only ever sees
+ * api_key_prefix for display.
+ */
+export const aiProviders = sqliteTable(
+ "ai_providers",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // ollama | anthropic | openai | gemini | openai_compatible
+ providerType: text("provider_type").notNull(),
+ label: text("label").notNull(),
+ // Required for ollama and openai_compatible, optional elsewhere.
+ baseUrl: text("base_url"),
+ apiKey: text("api_key", { length: 8192 }),
+ // First few characters, kept in the clear so the UI can identify a key.
+ apiKeyPrefix: text("api_key_prefix"),
+ defaultModel: text("default_model"),
+ enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ uniqueIndex("idx_ai_providers_user_label").on(table.userId, table.label),
+ ],
+);
+
+export const aiConversations = sqliteTable(
+ "ai_conversations",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ title: text("title"),
+ providerId: integer("provider_id"),
+ model: text("model"),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ updatedAt: text("updated_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_ai_conversations_user").on(table.userId, table.updatedAt),
+ ],
+);
+
+export const aiMessages = sqliteTable(
+ "ai_messages",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ conversationId: integer("conversation_id")
+ .notNull()
+ .references(() => aiConversations.id, { onDelete: "cascade" }),
+ // user | assistant | tool
+ role: text("role").notNull(),
+ content: text("content").notNull().default(""),
+ // Serialized tool calls and their results for this turn.
+ toolCalls: text("tool_calls"),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_ai_messages_conversation").on(
+ table.conversationId,
+ table.createdAt,
+ ),
+ ],
+);
+
+/**
+ * A change the assistant wants to make. Nothing here has been applied: the
+ * payload is re-validated against the tool schema at apply time and only then
+ * dispatched through the same repository logic a human action uses.
+ */
+export const aiProposals = sqliteTable(
+ "ai_proposals",
+ {
+ id: integer("id").primaryKey({ autoIncrement: true }),
+ conversationId: integer("conversation_id")
+ .notNull()
+ .references(() => aiConversations.id, { onDelete: "cascade" }),
+ userId: text("user_id")
+ .notNull()
+ .references(() => users.id, { onDelete: "cascade" }),
+ // The propose_* tool name that produced this.
+ kind: text("kind").notNull(),
+ summary: text("summary"),
+ payload: text("payload").notNull().default("{}"),
+ // pending | applied | rejected | expired
+ status: text("status").notNull().default("pending"),
+ appliedAt: text("applied_at"),
+ resultSummary: text("result_summary"),
+ createdAt: text("created_at")
+ .notNull()
+ .default(sql`CURRENT_TIMESTAMP`),
+ },
+ (table) => [
+ index("idx_ai_proposals_user").on(table.userId, table.status),
+ index("idx_ai_proposals_conversation").on(table.conversationId),
+ ],
+);
+// --- ai end ---
diff --git a/src/backend/database/repositories/ai-repository.ts b/src/backend/database/repositories/ai-repository.ts
new file mode 100644
index 0000000..cf313f7
--- /dev/null
+++ b/src/backend/database/repositories/ai-repository.ts
@@ -0,0 +1,407 @@
+import { and, desc, eq } from "drizzle-orm";
+import {
+ aiConversations,
+ aiMessages,
+ aiProposals,
+ aiProviders,
+} from "../db/schema.js";
+import { DataCrypto } from "../../utils/data-crypto.js";
+import type { DatabaseContext } from "./database-context.js";
+import { rowsAffected } from "./mutation-result.js";
+import { insertReturning } from "./returning.js";
+import { formatSqlTimestamp } from "./sql-timestamp.js";
+
+const now = (): string => formatSqlTimestamp(new Date());
+
+export type AiProviderRecord = typeof aiProviders.$inferSelect;
+export type AiConversationRecord = typeof aiConversations.$inferSelect;
+export type AiMessageRecord = typeof aiMessages.$inferSelect;
+export type AiProposalRecord = typeof aiProposals.$inferSelect;
+
+export interface AiProviderInput {
+ userId: string;
+ providerType: string;
+ label: string;
+ baseUrl?: string | null;
+ apiKey?: string | null;
+ defaultModel?: string | null;
+ enabled?: boolean;
+}
+
+/**
+ * Keeps the first few characters so the UI can tell two keys apart without
+ * ever receiving the key itself.
+ */
+export function apiKeyPrefix(apiKey: string | null | undefined): string | null {
+ if (!apiKey) return null;
+ return apiKey.slice(0, 6);
+}
+
+export class AiRepository {
+ constructor(
+ private readonly context: DatabaseContext,
+ private readonly onWrite?: () => void | Promise,
+ ) {}
+
+ /**
+ * Provider API keys are field-encrypted like any other credential. The key is
+ * derived from the row id, which does not exist until after the insert, so a
+ * new provider is written once and then re-encrypted in place with its real
+ * id -- the same approach AlertRepository uses for channel configs.
+ */
+ private userDataKey(userId: string): Buffer | null {
+ try {
+ return DataCrypto.getUserDataKey(userId);
+ } catch {
+ // Crypto is not initialized (tests, early boot); leave the value as is.
+ return null;
+ }
+ }
+
+ private encryptApiKey(
+ apiKey: string,
+ userId: string,
+ recordId: number | string,
+ ): string {
+ const userDataKey = this.userDataKey(userId);
+ if (!userDataKey) return apiKey;
+ return DataCrypto.encryptRecord(
+ "ai_providers",
+ { id: recordId, apiKey },
+ userId,
+ userDataKey,
+ ).apiKey;
+ }
+
+ private decryptApiKey(
+ apiKey: string,
+ userId: string,
+ recordId: number | string,
+ ): string {
+ const userDataKey = this.userDataKey(userId);
+ if (!userDataKey) return apiKey;
+ try {
+ return DataCrypto.decryptRecord(
+ "ai_providers",
+ { id: recordId, apiKey },
+ userId,
+ userDataKey,
+ ).apiKey;
+ } catch {
+ // Rows written before encryption was enabled are still plaintext.
+ return apiKey;
+ }
+ }
+
+ // --- providers ---
+
+ /** Never includes the key material; callers get the masked prefix only. */
+ async listProviders(userId: string): Promise {
+ const rows = await this.context.drizzle
+ .select()
+ .from(aiProviders)
+ .where(eq(aiProviders.userId, userId))
+ .orderBy(aiProviders.id);
+
+ return rows.map((row) => ({ ...row, apiKey: null }));
+ }
+
+ async findProvider(
+ id: number,
+ userId: string,
+ ): Promise {
+ const rows = await this.context.drizzle
+ .select()
+ .from(aiProviders)
+ .where(and(eq(aiProviders.id, id), eq(aiProviders.userId, userId)))
+ .limit(1);
+
+ if (!rows[0]) return null;
+ return { ...rows[0], apiKey: null };
+ }
+
+ /**
+ * The one path that returns usable key material. Only the provider adapters
+ * call this, immediately before an outbound request.
+ */
+ async findProviderWithSecret(
+ id: number,
+ userId: string,
+ ): Promise {
+ const rows = await this.context.drizzle
+ .select()
+ .from(aiProviders)
+ .where(and(eq(aiProviders.id, id), eq(aiProviders.userId, userId)))
+ .limit(1);
+
+ const row = rows[0];
+ if (!row) return null;
+ if (!row.apiKey) return row;
+ return {
+ ...row,
+ apiKey: this.decryptApiKey(row.apiKey, userId, row.id),
+ };
+ }
+
+ async createProvider(input: AiProviderInput): Promise {
+ const [created] = await insertReturning(this.context, aiProviders, {
+ userId: input.userId,
+ providerType: input.providerType,
+ label: input.label,
+ baseUrl: input.baseUrl ?? null,
+ apiKey: input.apiKey ?? null,
+ apiKeyPrefix: apiKeyPrefix(input.apiKey),
+ defaultModel: input.defaultModel ?? null,
+ enabled: input.enabled ?? true,
+ });
+
+ if (input.apiKey) {
+ const encrypted = this.encryptApiKey(
+ input.apiKey,
+ input.userId,
+ created.id,
+ );
+ if (encrypted !== input.apiKey) {
+ await this.context.drizzle
+ .update(aiProviders)
+ .set({ apiKey: encrypted })
+ .where(eq(aiProviders.id, created.id));
+ }
+ }
+
+ await this.afterWrite();
+ return { ...created, apiKey: null };
+ }
+
+ async updateProvider(
+ id: number,
+ userId: string,
+ input: Partial>,
+ ): Promise {
+ const existing = await this.findProvider(id, userId);
+ if (!existing) return null;
+
+ const updates: Record = { updatedAt: now() };
+ if (input.providerType !== undefined)
+ updates.providerType = input.providerType;
+ if (input.label !== undefined) updates.label = input.label;
+ if (input.baseUrl !== undefined) updates.baseUrl = input.baseUrl;
+ if (input.defaultModel !== undefined)
+ updates.defaultModel = input.defaultModel;
+ if (input.enabled !== undefined) updates.enabled = input.enabled;
+
+ // An empty string clears the key; undefined leaves it untouched.
+ if (input.apiKey !== undefined) {
+ if (input.apiKey) {
+ updates.apiKey = this.encryptApiKey(input.apiKey, userId, id);
+ updates.apiKeyPrefix = apiKeyPrefix(input.apiKey);
+ } else {
+ updates.apiKey = null;
+ updates.apiKeyPrefix = null;
+ }
+ }
+
+ await this.context.drizzle
+ .update(aiProviders)
+ .set(updates)
+ .where(and(eq(aiProviders.id, id), eq(aiProviders.userId, userId)));
+
+ await this.afterWrite();
+ return this.findProvider(id, userId);
+ }
+
+ async deleteProvider(id: number, userId: string): Promise {
+ const result = await this.context.drizzle
+ .delete(aiProviders)
+ .where(and(eq(aiProviders.id, id), eq(aiProviders.userId, userId)));
+
+ const deleted = rowsAffected(result) > 0;
+ if (deleted) await this.afterWrite();
+ return deleted;
+ }
+
+ // --- conversations ---
+
+ async listConversations(
+ userId: string,
+ limit = 50,
+ ): Promise {
+ return this.context.drizzle
+ .select()
+ .from(aiConversations)
+ .where(eq(aiConversations.userId, userId))
+ .orderBy(desc(aiConversations.updatedAt))
+ .limit(limit);
+ }
+
+ async findConversation(
+ id: number,
+ userId: string,
+ ): Promise {
+ const rows = await this.context.drizzle
+ .select()
+ .from(aiConversations)
+ .where(
+ and(eq(aiConversations.id, id), eq(aiConversations.userId, userId)),
+ )
+ .limit(1);
+ return rows[0] ?? null;
+ }
+
+ async createConversation(input: {
+ userId: string;
+ title?: string | null;
+ providerId?: number | null;
+ model?: string | null;
+ }): Promise {
+ const [created] = await insertReturning(this.context, aiConversations, {
+ userId: input.userId,
+ title: input.title ?? null,
+ providerId: input.providerId ?? null,
+ model: input.model ?? null,
+ });
+ await this.afterWrite();
+ return created;
+ }
+
+ async touchConversation(id: number, title?: string | null): Promise
-
- 
@@ -340,14 +421,17 @@ Interested in a paid placement to support development? Email [mail@termix.site](
-
+
+
+ 
+
