Your whole VPS fleet, one keystroke away.
A fast, colourful terminal UI for SSH — open it, pick a server, you're in.
██╗ ██╗███╗ ██╗██╗███████╗███████╗██╗ ██╗
██║ ██║████╗ ██║██║██╔════╝██╔════╝██║ ██║
██║ ██║██╔██╗ ██║██║███████╗███████╗███████║
██║ ██║██║╚██╗██║██║╚════██║╚════██║██╔══██║
╚██████╔╝██║ ╚████║██║███████║███████║██║ ██║
╚═════╝ ╚═╝ ╚═══╝╚═╝╚══════╝╚══════╝╚═╝ ╚═╝
You already have ~/.ssh/config. You already have a text file with IP addresses somewhere.
This replaces both with something you can actually look at.
- It shows you a fleet, not a list of strings. Live status, ping, CPU, memory, disk and running tunnels — right next to the server your cursor is on.
- It sets up new boxes for you. Point it at a fresh VPS with a root password: it creates
a sudo user, installs your key, hardens
sshd, configures the firewall and fail2ban — and verifies that key login works before it turns passwords off. - It doesn't leak your passwords. No
sshpass. Nothing on disk. Passwords live in your system keyring — the macOS Keychain or the Secret Service on Linux. The clipboard auto-clears after 45 seconds, and only a SHA-256 hash of the secret ever reachesargv. - It stays out of your way. Everything is one keystroke, and a server you have already visited opens instantly — the connection is kept alive and reused. The mouse works too.
- Connect in one key.
con any server. Opens in a new terminal window — Warp, iTerm2, Terminal.app, kitty, gnome-terminal and friends are detected automatically — or inline. - Reconnects are instant. The first connect opens a master socket and every one after
reuses it, skipping the TCP handshake, key exchange and auth entirely.
scprides on it too. Nothing to configure. - Auto password login. Password-auth servers get their password typed in for you via
expect. An instant, ready session — no clipboard dance. - Folders. Group servers, collapse with
←/→. Pressmto grab a server — it travels between folders with your cursor untilEnterdrops it. - Multi-select and batch actions.
spacemarks a server (on a folder row — the whole group). Run one command everywhere, move them, delete them. - Search, sort, favourites.
/filters,scycles the sort mode,fpins to the top.
- Live monitor built into the main screen: CPU, RAM, disk, load, network throughput, uptime and every interface IP — refreshed over a single persistent SSH connection, so fail2ban never sees a reconnect storm.
- Fleet health dashboard. One table, every server, worst-first. Answers "who is on fire right now" in a single keystroke.
- Port forwarding.
-L,-Rand-D(SOCKS5) tunnels running in the background, with their state shown right in the stats panel — up, stopped, or failed with the reason. - File transfer over
scp, with progress, in both directions. - Journal. Every login, every command with its exit code, every transfer.
- Automatic first-time setup of a fresh VPS: system update, base packages, a sudo user with a generated password, your SSH key, UFW/firewalld, fail2ban, sshd hardening, a custom SSH port, swap, timezone, hostname, unattended security upgrades.
- Lockout protection. Key-based login is verified before passwords are disabled. If the
check after the
sshdrestart fails, the config is rolled back over the still-open root session. The full list of invariants is in ARCHITECTURE.md.
ssh-agent and passphrase keys · ProxyJump / bastion · snippets for frequent
commands · import from ~/.ssh/config · export back into it, so ssh <name> works
from any terminal · config backups with restore · five colour themes ·
two languages (English / Russian).
# Go (recommended)
go install github.com/MrBenoit/unissh@latest
# From source
git clone https://github.com/MrBenoit/unissh
cd unissh && ./install.shHomebrew (
brew install MrBenoit/tap/unissh) is planned — uncomment thebrewsblock in.goreleaser.yamland set the tap token to enable it.
Requirements. Go ≥ 1.26 to build from source. macOS and Linux are both supported.
The servers you manage must be Linux — the monitor reads /proc, and bootstrap speaks
apt and dnf.
unissh degrades gracefully when an optional tool is missing, but it is nicer with them:
| Feature | macOS | Linux |
|---|---|---|
| Password storage | Keychain (built in) | secret-tool — libsecret-tools. Falls back to a 0600 file |
| Clipboard | pbcopy (built in) |
wl-clipboard on Wayland, xclip or xsel on X11 |
| Auto password login | expect (built in) |
expect — apt install expect |
| Open in a new window | Warp / iTerm2 / Terminal.app | kitty, foot, ghostty, wezterm, alacritty, gnome-terminal, konsole, xfce4-terminal, xterm, or $TERMINAL |
# Ubuntu / Debian, everything at once:
sudo apt install expect wl-clipboard libsecret-toolsIf no terminal emulator is found, unissh quietly connects in the current window instead of
failing. ./install.sh tells you what's missing.
unissh interactive TUI
unissh <name> quick connect (prefix match, e.g. `unissh prod`)
unissh list list servers with statuses (works without a TTY)
unissh add add a server
unissh version show version
Press ? inside the app to see this list at any time.
| Key | Action |
|---|---|
tab / shift+tab |
move between panels |
↑ ↓ / k j / mouse |
navigate; g / G jump to top / bottom |
enter / → |
open actions for the server (or expand a folder) |
space |
mark a server — on a folder row, the whole group |
c |
connect |
t |
port forwarding |
f |
toggle favourite |
s |
cycle sort mode |
/ |
search |
n r d |
new / rename / delete folder |
m |
grab the server and carry it between folders |
shift+↑↓ |
reorder folders |
? esc q |
help · back · quit |
unissh→ Add a server- Name, IP, port → With initial setup
- Give it the root password (the one your hosting provider emailed you)
- Tick the steps you want — everything safe is on by default
- Go get a coffee. You come back to a card with the new login and a generated password, already in your Keychain and in your clipboard.
⚠️ After hardening, password login is disabled. Don't delete~/.ssh/unissh_ed25519. The key is installed forrootas well, as a spare way in.
| What | Where |
|---|---|
| Servers & settings | ~/.config/unissh/servers.json |
| Host fingerprints | ~/.config/unissh/known_hosts |
| Connection sockets (multiplexing) | ~/.config/unissh/cm/ |
| Config backups | ~/.config/unissh/backups/ |
Journal (0600 — commands may contain secrets) |
~/.config/unissh/history.jsonl |
| Passwords | macOS Keychain, or the Linux Secret Service (secret-tool), service unissh |
| SSH key | ~/.ssh/unissh_ed25519 |
| Exported ssh config | ~/.ssh/unissh_config (+ an Include line in ~/.ssh/config) |
./uninstall.sh removes the binary and tells you exactly what it left behind.
Two packages. internal/core is pure logic — no TUI, no network, no i18n. It is tested to
99%, and make build refuses to run below 90%. internal/app is everything that
touches a terminal, a socket or the OS.
make build gates on fmt → vet → tests → coverage. make ci adds the race detector.
You cannot ship a red build.
- ARCHITECTURE.md — the long read (in Russian): every design decision, every trade-off, and a chronicle of the bugs we hit and how they were fixed. Start here if you want to understand why the code looks the way it does.
- SECURITY.md — threat model and known limitations.
- CONTRIBUTING.md — how to build, test and send a patch.
- CLAUDE.md — a condensed map for AI assistants.
Built with bubbletea, lipgloss and x/crypto/ssh. Five direct dependencies, no cgo.