AI powered ssh session manager
8.5K
support: [email protected]
live demo: https://demo.tscmc.io
This image is designed for quick local evaluation and small deployments where a single-container topology is preferred.
80 : Web UI + reverse proxy entrypoint8080 : API service5001 : gRPC serverTypical mapping:
3000 -> container 80docker run -d \
--name scm-server \
-p 3000:80 \
-v scm_data:/home/scm/data \
-e JWT_SECRET=change-me \
-e JWT_ISSUER=ssh-conn-manager \
-e JWT_AUDIENCE=ssh-conn-manager-ui \
-e SECRET_ENCRYPTION_KEY=change-me \
-e CHAT_GATEWAY_INTERNAL_TOKEN=dev-chat-gateway-token \
feilfly/scm-server:latest
Then open:
http://localhost:3000Use the provided compose file under docker/docker-compose.yml.
cd docker
cp .env.sample .env
docker compose up -d
Notes:
rabbitmq service is optional. Keep it only if you use RabbitMQ-backed messaging features.redis service is optional. Keep it only if you need persisted execution/error history and related features.services:
scm-server:
image: feilfly/scm-server:latest
container_name: scm-server
ports:
- "3000:80"
volumes:
- scm_data:/home/scm/data
environment:
CHAT_GATEWAY_INTERNAL_TOKEN: this-is-a-token-for-chat-gateway-internal-use-only
JWT_SECRET: change-me
JWT_ISSUER: ssh-conn-manager
JWT_AUDIENCE: ssh-conn-manager-ui
SECRET_ENCRYPTION_KEY: change-me
RABBITMQ_HOST: rabbitmq
RABBITMQ_PORT: 5672
RABBITMQ_USER: guest
RABBITMQ_PASS: guest
RABBITMQ_EXCHANGE: ssh_cmds
REDIS_HOST: redis
REDIS_PORT: 6379
REDIS_DB: 10
REDIS_TLS: "false"
depends_on:
- rabbitmq
- redis
restart: unless-stopped
# Optional: include RabbitMQ only if you use RabbitMQ-backed messaging features.
rabbitmq:
image: rabbitmq:3-management
container_name: rabbitmq
ports:
- "5672:5672"
- "15672:15672"
restart: unless-stopped
# Optional: include Redis only if you need persisted execution/error history features.
redis:
image: redis:7-alpine
container_name: redis
ports:
- "6379:6379"
command: ["redis-server", "--appendonly", "yes"]
restart: unless-stopped
volumes:
scm_data:
Mount /home/scm/data to keep SQLite database and runtime data across restarts.
Recommended:
scm_data:/home/scm/data| Variable | Required | Default | Description |
|---|---|---|---|
JWT_SECRET | Yes | random-rando-rand-ran-ra-r | JWT signing secret for API auth tokens. |
JWT_ISSUER | Recommended | dolphin-group | JWT issuer claim. |
JWT_AUDIENCE | Recommended | me | JWT audience claim. |
JWT_EXPIRY_HOURS | No | 24 | JWT token expiration in hours. |
SECRET_ENCRYPTION_KEY | Yes | dev-container | Key used by secret manager encryption. |
MFA_ENABLED | No | false | Enable/disable MFA features. |
MFA_ISSUER | No | dolphin-group | MFA OTP issuer label. |
MFA_SECRET_ENCRYPTION_KEY | Recommended | dev-container | Encryption key for MFA secret storage. |
API_KEY | No | dev-api-key | API key used by some integrations/dev flows. |
CHAT_GATEWAY_INTERNAL_TOKEN | Recommended | dev-chat-gateway-token | Internal token between chat gateway and API provider-runtime endpoints. |
| Variable | Required | Default | Description |
|---|---|---|---|
OIDC_ISSUER_URL | Optional | empty | OIDC provider issuer URL. |
OIDC_CLIENT_ID | Optional | empty | OIDC client ID. |
OIDC_CLIENT_SECRET | Optional | empty | OIDC client secret. |
OIDC_REDIRECT_URL | Optional | empty | OIDC callback URL. |
OIDC_COOKIE_NAME | No | oidc_id_token | Cookie name for OIDC token storage. |
OIDC_COOKIE_SECURE | No | false | Use secure cookie flag. Set true behind HTTPS. |
| Variable | Required | Default | Description |
|---|---|---|---|
DATABASE_TYPE | No | sqlite | Database engine: sqlite or mariadb. |
DB_SQLITE_FILE | For sqlite | /home/scm/data/server-db.sqlite | SQLite DB path. |
DB_MARIADB_HOST | For mariadb | 127.0.0.1 | MariaDB host. |
DB_MARIADB_PORT | For mariadb | 3306 | MariaDB port. |
DB_MARIADB_USERNAME | For mariadb | root | MariaDB username. |
DB_MARIADB_PASSWORD | For mariadb | root | MariaDB password. |
DB_MARIADB_DATABASE | For mariadb | scm | MariaDB database name. |
| Variable | Required | Default | Description |
|---|---|---|---|
RABBITMQ_HOST | Optional | rabbitmq | RabbitMQ host. |
RABBITMQ_PORT | Optional | 5672 | RabbitMQ port. |
RABBITMQ_USER | Optional | guest | RabbitMQ username. |
RABBITMQ_PASS | Optional | guest | RabbitMQ password. |
RABBITMQ_EXCHANGE | Optional | ssh_scm | Exchange name used for SCM messaging. |
| Variable | Required | Default | Description |
|---|---|---|---|
REDIS_HOST | Optional | empty | Redis host. |
REDIS_PORT | No | 6379 | Redis port. |
REDIS_USER | Optional | empty | Redis username (ACL mode). |
REDIS_PASS | Optional | empty | Redis password. |
REDIS_DB | No | 10 | Redis DB index. |
REDIS_TLS | No | false | Enable TLS for Redis connection. |
REDIS_TTL | No | 604800 | TTL in seconds for stored execution/error history. |
| Variable | Required | Default | Description |
|---|---|---|---|
SSH_DIAL_TIMEOUT | No | 10 | SSH dial timeout (seconds). |
SSH_MAX_IDLE_TIME | No | 1800 | Max idle time per SSH connection (seconds). |
SSH_MAX_CONNECTIONS | No | 50 | Max concurrent managed SSH connections. |
SSH_MAX_SESSIONS | No | 5 | Max concurrent SSH sessions per connection. |
SSH_JUMP_HOST_ENABLE_NC_TUNNEL | No | false | Enable jump-host netcat tunnel mode. |
| Variable | Required | Default | Description |
|---|---|---|---|
TERMINAL_ENABLED | No | true | Enable terminal feature. |
TERMINAL_MAX_SESSIONS_GLOBAL | No | 200 | Global max terminal sessions. |
TERMINAL_MAX_SESSIONS_PER_USER | No | 20 | Max terminal sessions per user. |
TERMINAL_MAX_SESSIONS_PER_CONNECTION | No | 5 | Max terminal sessions per SSH connection. |
TERMINAL_MAX_LIFETIME_SECONDS | No | 14400 | Max terminal session lifetime. |
TERMINAL_IDLE_TIMEOUT_SECONDS | No | 1200 | Terminal idle timeout. |
TERMINAL_MAX_INPUT_BYTES | No | 32768 | Max input bytes per message. |
TERMINAL_MAX_OUTPUT_BUFFER_BYTES | No | 262144 | Max output buffer size. |
| Variable | Required | Default | Description |
|---|---|---|---|
VAULT_ADDR / VAULT_URL | Optional | empty | Vault endpoint URL. |
VAULT_TOKEN | Optional | empty | Vault token (if token auth is used). |
VAULT_NAMESPACE | Optional | empty | Vault namespace. |
VAULT_ROLE_ID | Optional | empty | AppRole role id. |
VAULT_SECRET_ID | Optional | empty | AppRole secret id. |
VAULT_PREFIX | Optional | empty | Secret path prefix. |
VAULT_VERIFY | No | true | Enable TLS cert verification for Vault. |
| Variable | Required | Default | Description |
|---|---|---|---|
LOG_LEVEL | No | info | Log level (debug, info, warn, error). |
LOG_FILE_PATH | No | /var/log/scm/scm-api.log (API), /var/log/scm/scm.log (gRPC) | Log output file path. |
LOG_CONSOLE | No | true | Also emit logs to console. |
LOG_MAX_SIZE_MB | No | 10 | Log file max size before rotation. |
Content type
Image
Digest
sha256:ec5ea453b…
Size
227.5 MB
Last updated
4 months ago
docker pull feilfly/scm-server