Termimus

The Local-First, Zero-Knowledge SSH Client & Server Management Suite
A modern, self-hosted Termius alternative for Linux, macOS, and Windows · v0.7.0

Termimus is an open-source, desktop SSH manager and terminal suite designed for engineers, sysadmins, and DevOps teams who refuse to store production credentials in third-party proprietary clouds.

Unlike SaaS alternatives that force cloud account registration, Termimus is Local-First: your database runs 100% offline via embedded SQLite, and your private keys and passwords never leave your machine unencrypted. When you need multi-device synchronization, Termimus connects to your own Self-Hosted Go Sync Relay using end-to-end zero-knowledge encryption — the server is a blind relay that cannot decrypt your data.

Prebuilt installers for every release are published automatically to the GitHub Releases page — no build tools required.

Prefer to build from source, or want to contribute? See Getting Started below.

• Async Rust SSH Engine: Multi-tab terminal powered by russh and @xterm/xterm 6.
• Split Panes & Dynamic Layouts: Split terminals in any direction with resizable dividers, tab drag-and-drop, and auto-grouping tabs (Web Server (2)).
• Terminal Interconnection & Input Broadcast: One-click synchronized input across all split panes (SYNC toggle / Alt+B) to broadcast keystrokes and run commands simultaneously across multiple servers.
• Session Geometry Protection: Background tabs stay mounted without collapsing to 0×0 geometry, preventing remote htop, vim, and curses TUIs from corrupting due to bogus SIGWINCH events.
• Quick Connect: Instant fuzzy-search launcher accessible anywhere with Ctrl+K.

• Multi-Server Layout Presets: Design and save complex multi-terminal split layouts (Single, Vertical 2-way, Horizontal 2-way, 3-way, 4-way Grid, 6-way Matrix) with assigned hosts for each pane.
• 1-Click Cluster Launcher: Atomic multi-session launcher connects to all target machines simultaneously and arranges them into their pre-configured split panes with zero layout jitter.
• Interactive Blueprint Designer: Visual layout designer to preview blueprints, assign hosts to panes, and customize workspace tags and colors.
• Save Active Split as Preset: Snapshot your current live split layout and open SSH sessions into a reusable workspace preset with a single click.

• Seamless Transfers: Dual-pane local ↔ remote browser with fast click-to-transfer navigation.
• Direct Remote Editor: View and edit configuration files directly over SFTP with syntax highlighting and keyboard shortcut saving (Ctrl+S).

• Private Key Vault & Import: Securely store and organize SSH private keys (OpenSSH, PEM, PuTTY). Import directly from local key files or paste PEM text.
• Instant Public Key Derivation: Automatically derive OpenSSH public key lines (ssh-ed25519, ssh-rsa, ecdsa) and SHA256 fingerprints from imported private keys to paste into remote authorized_keys.
• Private Key Reveal & Copy: Securely inspect or copy decrypted private keys on demand when the vault is unlocked, protected with privacy blur.
• Password Identities: Store reusable username & password combinations to assign across multiple hosts without re-typing.

• Multi-Type Tunnels: Support for Local (-L), Remote (-R), and Dynamic SOCKS5 (-D) port forwarding.
• Live Status Toggles: Monitor and manage forwarding rules with real-time active indicators.

• Instant Script Runner: Store frequently used shell scripts, deployment commands, and system diagnostics.
• Active Tab Injection: Send snippets straight into your running terminal session with a single click.

• Zero-Knowledge Vault: All passwords and keys are encrypted at rest with AES-256-GCM using keys derived via Argon2id.
• OS Keyring Integration: Optional silent auto-unlock on launch using your desktop's secure credential store (KWallet / GNOME Secret Service on Linux, macOS Keychain, or Windows Credential Manager).
• Configurable Auto-Lock: Automatically lock the vault and zero out memory after 15m/1h of inactivity or on window focus loss.
• TOFU Host-Key Verification: Trust-On-First-Use host key fingerprinting with hard rejection on key mismatch across SSH, SFTP, and tunnels to shield against Man-in-the-Middle (MITM) attacks.

• Zero-Knowledge Relay: Self-host our ultra-lightweight Go sync server (server/) with Docker.
• Real-Time WebSocket Sync: Connected devices receive instant push notifications when changes occur on another machine.
• Safe Merging: Sync merges incoming updates without overwriting locally trusted server fingerprints.

┌─────────────────────────────────┐               ┌─────────────────────────────────┐
│     Termimus (Work Laptop)      │               │      Termimus (Home Desktop)    │
│  - Tauri v2 + Rust + React 19   │               │  - Tauri v2 + Rust + React 19   │
│  - Local SQLite (termimus.db)   │               │  - Local SQLite (termimus.db)   │
│  - AES-256-GCM Encryption Key   │               │  - AES-256-GCM Encryption Key   │
└────────────────┬────────────────┘               └────────────────▲────────────────┘
                 │                                                 │
                 │   Push E2EE Ciphertext Bundle                   │   Pull & Auto-Merge
                 │   (Server cannot read payload)                  │   (WebSocket Event)
                 ▼                                                 │
      ┌─────────────────────────────────────────────────────────────────┐
      │             Termimus Sync Server (Go / Docker)                  │
      │         ghcr.io/termimus/termimus-sync:latest                   │
      │                                                                 │
      │  - Pure Go SQLite (modernc.org/sqlite, zero CGO)                │
      │  - Blind Relay Storage (< 20MB RAM)                             │
      │  - Real-time WebSocket Event Hub (`SYNC_UPDATED`)               │
      └─────────────────────────────────────────────────────────────────┘

• Rust (via rustup)
• Bun (or Node.js 20+)
• Linux system libraries:

  sudo apt install -y pkg-config build-essential \
    libwebkit2gtk-4.1-dev libssl-dev \
    libayatana-appindicator3-dev librsvg2-dev

# Clone the repository
git clone https://github.com/termimus/termimus-ssh.git
cd termimus-ssh

# Install frontend dependencies
bun install

# Run in Tauri dev mode
bun run tauri dev

bun run tauri build

Compiled bundles will be located in src-tauri/target/release/bundle/.

The sync server is packaged as a lightweight, multi-architecture Docker container (linux/amd64 and linux/arm64).

docker run -d \
  --name termimus-sync \
  -p 8080:8080 \
  -v termimus_data:/data \
  -e TERMIMUS_AUTH_TOKEN="your-secure-random-token" \
  --restart unless-stopped \
  ghcr.io/termimus/termimus-sync:latest

Create docker-compose.yml:

services:
  termimus-sync:
    image: ghcr.io/termimus/termimus-sync:latest
    container_name: termimus-sync
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - ./data:/data
    environment:
      - PORT=8080
      - DB_PATH=/data/sync.db
      - TERMIMUS_AUTH_TOKEN=your-secure-random-token

Run with:

docker compose up -d

cd server
export TERMIMUS_AUTH_TOKEN="your-secure-random-token"
export PORT="8080"
go run ./cmd/server

Termimus enforces defense-in-depth principles:

termimus/
├── src/                          # React 19 Frontend
│   ├── components/
│   │   ├── layout/               # Header, Sidebar, QuickConnect, ConfirmModal
│   │   ├── hosts/                # Host management, folder tree, latency badges
│   │   ├── terminal/             # Xterm.js terminal view & session tabs
│   │   ├── workspaces/           # Multi-server layout presets & cluster launcher
│   │   ├── sftp/                 # Dual-pane browser & remote code editor
│   │   ├── keychain/             # KeyModal, IdentityModal, public key derivation
│   │   ├── tunnels/              # Port forwarding manager
│   │   ├── snippets/             # Scripts library
│   │   ├── sync/                 # Self-hosted cloud sync manager
│   │   ├── vault/                # Backup & restore components
│   │   └── settings/             # Tabbed settings suite (full-width)
│   ├── stores/                   # Zustand domain stores
│   └── lib/                      # Tauri typed invoke wrappers
│
├── src-tauri/                    # Rust Backend (Tauri v2)
│   └── src/
│       ├── ssh/                  # Russh async client & TOFU verification
│       ├── sftp/                 # Russh-sftp engine & local filesystem
│       ├── tunnel/               # Channel direct TCP/IP forwarder
│       ├── vault/                # AES-256-GCM & Argon2id encryption manager
│       ├── sshkey/               # ED25519/RSA/ECDSA key generation & derivation
│       ├── db/                   # SQLite schema, queries & backup engine
│       └── commands/             # Tauri IPC command handlers
│
├── server/                       # Self-Hosted Sync Server (Go)
│   ├── cmd/server/               # Server entrypoint
│   ├── internal/                 # DB (pure Go SQLite), Hub (WebSockets), Handlers
│   ├── Dockerfile                # Multi-stage minimal container
│   ├── docker-compose.yml        # Production-ready compose configuration
│   └── README.md                 # Server documentation
│
└── .github/workflows/            # GitHub Actions CI/CD (Multi-arch GHCR build)

If you find Termimus useful and want to support its ongoing development (server infrastructure, domain, and new features), consider buying a coffee! Every contribution helps keep the project independent, local-first, and completely free.

Contributions, issues, and feature requests are welcome!

1. Fork the Project
2. Create your Feature Branch (git checkout -b feat/amazing-feature)
3. Commit your Changes (git commit -m 'feat: add amazing feature')
4. Push to the Branch (git push origin feat/amazing-feature)
5. Open a Pull Request

Distributed under the MIT License. See LICENSE for more information.

Built with ❤️ for privacy-minded sysadmins and developers.