v1.43.0 - run your VPS as a sudo user, not just root (SSH config import, passphrase keys, static/PHP sites)

New Features

Run Your Server as a Sudo User

• Firewall, brute-force protection, SSH hardening, Docker, and deploys work when you sign in as a non-root sudo user — day-to-day work no longer requires root
  • New apps land in that user's home folder, not in root's
  • The Security tab shows who you are connected as, and whether passwordless sudo is available
  • Sync hardening to a user installs the app's key, grants passwordless sudo, and checks that login actually works — then offers to switch the connection to them
  • Set, generate, or unlock a user's password from the Users tab, including the account Server Compass signs in with
  • Connected as root? A recommendation to create a sudo user is on the Security tab, and Add Server no longer steers you toward root

Import Servers from Your SSH Config

• Add servers from the SSH config on this computer — pick the aliases you want and import them together
  • Jump hosts, proxies, and other unsupported entries are explained instead of failing silently
  • Servers you already added are skipped
• Passphrase-protected SSH keys work — generate one with a passphrase, import one, and connect by entering it. Encrypted keys are labeled, instead of failing with a generic login error

Static and PHP Sites, No Git Required

• Install a Static Site or a PHP Site from the Stack Wizard — HTML, CSS and JavaScript on Nginx, or PHP 8.3 on Apache, with an editable document root
  • A starter page is created only if the folder is empty, so a redeploy keeps your edits
  • Edit site content from the app overview opens those files directly

Keep Metric History

• Store CPU, memory, disk and load samples on the server and review them in Monitoring
  • Choose the folder, how many days to keep, and optionally send each sample as JSON to an HTTP address you own
  • Download the synced samples as JSON from the app

A Guided Tour of the App

• A visual tour from Get Started walks through how Server Compass sits on your computer, where each screen lives, how deploys and domains work, and where secrets stay
  • Progress is remembered if you close it part-way

Restore a Team Workspace

• Export a sealed recovery bundle from Team settings, and Restore it on a new device with the bundle, the passphrase, and the original storage bucket — losing a laptop does not have to lose the Owner workspace

SSH Hardening You Can Undo

• See the backups taken before SSH settings change, and restore one
  • A restore that would open a port the firewall still blocks is refused unless you allow it
  • Disabling root login requires a working sudo account with a key — the toggle stays locked until that fallback is verified

Cloud-init and What Changed

• Cloud-init status is visible under Advanced — installed, disabled, and which provider — without reading user data or secrets
• Server changes lists what Server Compass itself changed on the box

Improvements

• Install Docker on purpose — the Stack Wizard lets you browse templates, then asks you to install Docker Engine and Compose before you pick one
• Install Traefik inline, with named progress, from domain setup and the client portal — instead of a silent wait that can last several minutes
• Choose the monitoring interval before the agent is installed, and that interval is what actually runs
• Fail2ban can email you when it bans an address, if the server already has mail set up, and it leaves a jail file you wrote by hand alone
• Choose which services fail2ban protects — SSH, nginx, Apache, Postfix, and repeat offenders — instead of SSH only
• Client portal setup tells you whether DNS, TLS, or HTTP failed, instead of a grey "awaiting" with no reason
• Dark mode follows the system on first launch. The sidebar cycles System, Light, and Dark
• Drag the sidebar to resize it. Double-click the edge to reset
• The in-app terminal fills the tab instead of sitting in a fixed-height box
• Local command-log storage can go up to 100 GB, and the setting says it is storage on this computer
• Security, monitoring and other long actions show named steps and a result, including a confirmation when a password is copied
• The "Enable SSH Protection" toggle is green when protection is on
• Alert rules that name specific channels only notify those channels — and the install prompt reminds you to set channels up
• Pasting a compose that only pulls images no longer recommends "Build on VPS"

Bug Fixes

• Fixed firewall, fail2ban, and "Apply all recommendations" failing silently when signed in as a sudo user — failures now show, and Advanced → Activity → Errors lists actual failures
• Fixed deploying an app as a sudo user failing because files were created under root's home
• Fixed the terminal dropping into Command mode after a server reboot — it retries, shows Reconnecting, and offers Reconnect. Reconnecting one tab no longer reloads the others or replays the first command
• Fixed system listeners showing as unknown UDP ports and looking killable — common ports are named, and system services are not offered as something to kill
• Fixed connection and proxy-mode buttons reporting success when nothing happened
• Fixed changing an SSH password and then losing the saved login if the save failed — the previous password is restored
• Fixed deleting a busy user also removing their sudo grant
• Fixed redeploy retagging a pinned image as latest
• Fixed creating a user claiming an SSH key was installed when the connection was password-only
• Fixed switching from root to a sudo user without warning that apps deployed as root stay in root's home
• Fixed zero-downtime deploys always using root's app folder even when the app lives elsewhere
• Fixed Team Viewers and Members seeing other people's activity — Viewers see none; Members see their own
• Fixed Team activity export ignoring the person and action filters on screen