Documentation
HostSSH docs
Everything you need to deploy, protect, and relocate your servers — from your first ten minutes to the internals. Pick a track below, or search from the sidebar.
User guide
- User guide — overviewThe complete guide to deploying, protecting, and relocating your servers with HostSSH — for operators, founders, and teams.
- Getting started with HostSSHYour first 10 minutes — account, first server, first capture, and a nightly schedule with a monthly restore-drill.
- Concepts & vocabularyEvery word HostSSH uses — Node, Slot, Rack, Mesh, Fleet, App, and the rest — defined precisely, with the mental model behind each.
- Install HostSSH on a supported Linux hostJoin a machine through the verified Fleet onboarding path.
- Backups & recoveryCapture a whole server to one encrypted .hsi image, then restore, clone, or relocate it anywhere — with automatic IP rewrite and proven recoverability.
- Connections (Bring-Your-Own-Keys)Wire HostSSH to your own storage and platform accounts — BYO buckets, choose how your keys are held, and unlock DNS cutover, web-SSH, alerts, and metrics.
- Deploying appsEvery way to ship an app on HostSSH — dashboard, CLI, git-push, and GitHub webhooks — plus builders, env, slots, volumes, workers, health gates, logs, and rollback.
- Hardening your serverOne-click hardening with a live Security Score, granular controls, and an armed auto-revert that makes it impossible to lock yourself out.
- Move WordPress into a SlotBring an existing shared-hosting WordPress site onto HostSSH with the Migrate plugin.
- Domains & TLSPoint a real domain at an app, get automatic Let's Encrypt HTTPS, and cut over from an old host with zero downtime using DNS-01.
- Web-SSH & accessBrowser shells with no open port 22, ephemeral short-TTL keys, per-server grants, and audited sessions — managed, keyless-by-default access to your whole fleet.
- Licensing, seats & transfersHow HostSSH licenses work — what each tier unlocks, activating a key, binding and moving servers, the offline grace window, and what happens on expiry or revocation.
- Secrets & environmentHow HostSSH delivers environment variables and secrets to your apps — sealed at rest, decrypted only inside the agent, editable after deploy.
- Slots & capacityThe unit that makes hosting portable and safe to pack — size an app, place it on a node with hard resource caps, meter it, and move it.
- Join a home or office Node (no public IP)Cloudflare Tunnel is the default inbound path for residential, CGNAT, and office boxes — the agent itself is pull-only and still joins the fleet without it.
- Environment variables & secretsSet config and secrets for a deployed app — plain variables, sealed secrets, auto-generated keys, and linking a managed database — from the App Settings editor.
- Deploy an appThe Deploy page — pick a one-click template or build from a repo, set the domain, port and readiness gate, then watch the live build→run→route on the deployment detail page.
- Monitoring & alertsWatch uptime and fleet health, and get paged the moment something breaks — Slack, PagerDuty, webhook, or email.
- ApplicationsThe Applications page — a read-only fleet view of every app HostSSH is running, with health, status, domains and host.
- GPU workloadsRun GPU inference and training on a HostSSH node — the -gpu deploy flag, the node prerequisites, doctor's gpu check, GPU heartbeat stats, exposing a rented GPU box through a long-timeout tunnel, and which Vast.ai/RunPod rental types work.
- ImagesThe Images page — the ledger of encrypted .hsi snapshots across your fleet, their integrity and backend, retention policies, and loading a snapshot onto a Node.
- Migrating to HostSSHMove an app off Coolify, Vercel, Heroku, or a raw VPS onto HostSSH with zero downtime — the per-app playbook, cutover, soak, and decommission.
- CLI referenceEvery hostssh command, its flags, and what it does — the complete reference for the agent CLI on a Node.
- RecoveryThe Recovery page — capture, restore, clone or relocate-to-new-IP a whole server, choose a transfer mode, and watch live jobs and their history across the fleet.
- ProvisioningQueue and observe evidence-backed VPS provisioning from the operator dashboard.
- Add-onsThe extra capabilities that ship inside HostSSH — email sending, DNS tools & integrity, webhooks, scraping, browser automation, and the AI copilot / MCP.
- Fleet & NodesThe Nodes page for connected, provisioned, and provider-discovered machines, with live status, resource use, backup health, origin evidence, and on-box operations.
- ObservabilityThe single pane for fleet health — heartbeat telemetry, real uptime %, backup-success, alerts, and per-server restore-drill posture.
- Troubleshooting & FAQFix the common problems — 502s, stuck certificates, failed deploys, offline nodes, license grace — with the exact command to run.
- DNS ToolsThe built-in DNS/email diagnostics console — run A/MX/TXT/SPF/DMARC/TLS/blacklist lookups from the dashboard and read the results.
- Fleet CopilotAn AI SRE that diagnoses your fleet from live state and proposes one-click fixes you confirm — never auto-executing.
- MeshThe private overlay network that bonds Nodes so they talk over a private address.
- Load BalancingSpread one hostname across several Nodes with a health-checked pool, at the edge or over the mesh.
- Sending email with HostSSHAdd a sending domain, publish and verify your DKIM/SPF/DMARC records, check deliverability health, mint an API key, and send transactional email through your own MTA.
- build-secrets
- fleet-script-rehearsal
- local-recovery-rehearsal
- ordered-recovery
- postgres-recovery-adapter
- recovery-manifest
- transfer-evidence
- transfer-resume
Developer docs
- Developer docs — overviewArchitecture, internals, APIs, and contribution guide for people building HostSSH itself.
- HostSSH Platform — architecture & decision recordWhy and how we build our own PaaS (Railpack, no Nix), the 100%-ownable stack, and the phased roadmap.
- Control-plane dashboardArchitecture of the HostSSH SaaS dashboard — stack, design system, RBAC, and how to add a page.
- API & CLIThe hostssh CLI, REST API, and MCP server — four surfaces, one core. Verbs, --json output, cron/CI usage, and AI-agent tools.
- Control panel — product north star & build orderThe canonical "what we're building and in what order" — HostSSH as a class-of-its-own server control plane (deploy + browser-root access + hardening + monitoring + AI), the verified implementation status, the security build order, and the license-code business model.
- Local developmentGet the control plane and the agent building, running, and tested on your machine — the exact commands CI runs.
- System architectureHow the running system fits together — control plane, Go agent, Postgres, and the dual-backend store pattern.
- Agent protocolHow the HostSSH agent talks to the control plane — mTLS, license activation, telemetry, the capture/restore/migrate RPCs, the live progress stream, and the .hsi image format.
- ContributingBranch and commit conventions, the fix-forward rule, the security posture, and the PR checklist.
- Hardening engineThe HostSSH one-click + granular server-hardening engine — controls, profiles, the check/apply/revert/drift model, and the lockout-protection invariants that let it run as root without bricking a box.
- API referenceEvery HTTP endpoint — method, auth, request schema, and responses.
- HostPack — the build engineHostSSH's branded build engine — a brand + policy layer over Railpack (MIT) on BuildKit, with a slim/distroless base-image policy that takes a 508 MB app image to ~140 MB. Phased wrap → fork → original.
- Database & migrationsThe connection, baseline schemas, the boot-time migration runner, how to add a migration, and the least-privilege role model.
- Testing & CIRun the local gates, the vitest suite, and what CI checks.
- Environment variables & secretsHow env vars and secrets reach a deployed container — the custody model, the three delivery paths (generate / sealed / linked), and the code map.
- The deploy pipelineHow source becomes a running, routed container inside the agent — orchestrator, builders, gates, rollback, and the env/secret flow.
- Build guards — the fix-forward catalogThe discipline that keeps bugs from recurring — every fix lands upstream, gets a regression test, and a catalog entry. The full G1–G19 index.
- Email & Deliverability add-onArchitecture of the self-hosted, white-label email engine — engine → native Postgres queue → send worker → API surface — with the /v1/email/* endpoints, DKIM/SPF/DMARC handling, and where real outbound is gated.
- Add-on systemThe registry / catalog / entitlement pattern that carries every harvested capability into the backbone as a first-class, gated add-on — plus the shared core guards they all reuse.
- Security modelHow HostSSH protects secrets, tenants, and the control-plane↔agent channel — sealed env, Postgres RLS, mTLS, and the signed trust root.
- Add-on — Outbound WebhooksDurable Postgres delivery queue, a pure circuit breaker, Stripe-style signing, and SSRF-safe delivery — the webhooks add-on absorbed from altohost and rebuilt on the backbone's primitives.
- Add-on — Scraper & BrowserThe dependency-light rule-driven scraper (SSRF-safe fetch + regex/JSON-LD, css/xpath behind a DomExtractor seam) and the browser add-on (indexed-DOM observe→plan→act agent + rendered scrape) whose heavy Playwright runtime is gated into browser-worker.
- Add-on — Attack-Surface Self-ScanAn owner-gated active scan of a customer's own domain — a curated common-port sweep plus a structural exposed-file probe — where the DNS-TXT ownership gate lives inside the scanner so it can't be bypassed.
- Add-on — DNS Integrity & DeliverabilityRead-only mail-DNS health scoring (MX/SPF/DMARC/DKIM with RFC 7208 lookup-cost) and domain-auth verification for email onboarding, done over node:dns with no third-party DoH.
- Add-on — Identity & AuthThe Clerk-style multi-tenant identity layer absorbed from extrastate (better-auth + Drizzle) — orgs/passkey/2FA/JWT — where the active organization is the canonical tenantId and the JWKS verify chokepoint feeds withTenant / Postgres RLS.
- CLI referenceEvery hostssh command the agent binary dispatches — purpose, key flags, exit codes, and what each does — grounded in agent/internal/cli/cli.go.
- Job kindsThe deploy-queue job kinds the control plane enqueues and the agent claims — what each does, the JobSpec fields it uses, how executeJob runs it, and how secrets are delivered.
- Migration engineHow the Coolify→HostSSH container migrator works — the single-container mover (M1), multi-container apps (M4), and the staged DNS cutover with health-verify + auto-rollback. Schematics + code map.
- GPU supportHow GPU deploys work in the agent — the -gpu flag, the internal/gpu package, the doctor gpu check, GPU heartbeat stats, and the Traefik long-response timeout. Proven on real hardware 2026-07-12.
- Stateful servicesThe stateful service class — never-auto-recreate semantics on deploy, the force-recreate consent, default data volumes for database templates, and pg_dump→R2 backup recipes.
- ChangelogWhat shipped recently and why.
- dns-tools
- FRAMEWORK
- mcp-kit
- secure-access
- web-ssh