Sign inSign up

feilfly/scm-server

By feilfly

•Updated 4 months ago

AI powered ssh session manager

Image
Developer tools
Operating systems
Monitoring & observability
1

8.5K

feilfly/scm-server repository overview

⁠Support

support: [email protected]⁠

live demo: https://demo.tscmc.io⁠

⁠AI Agentic Powered SSH Connection Manager (SCM)

This image is designed for quick local evaluation and small deployments where a single-container topology is preferred.

⁠Exposed Ports

  • 80 : Web UI + reverse proxy entrypoint
  • 8080 : API service
  • 5001 : gRPC server

Typical mapping:

  • host 3000 -> container 80

⁠Quick Start (Docker Run)

docker run -d \
  --name scm-server \
  -p 3000:80 \
  -v scm_data:/home/scm/data \
  -e JWT_SECRET=change-me \
  -e JWT_ISSUER=ssh-conn-manager \
  -e JWT_AUDIENCE=ssh-conn-manager-ui \
  -e SECRET_ENCRYPTION_KEY=change-me \
  -e CHAT_GATEWAY_INTERNAL_TOKEN=dev-chat-gateway-token \
  feilfly/scm-server:latest

Then open:

  • http://localhost:3000

⁠Quick Start (Docker Compose)

Use the provided compose file under docker/docker-compose.yml.

cd docker
cp .env.sample .env
docker compose up -d
⁠Sample Compose (SCM + RabbitMQ + Redis)

Notes:

  • rabbitmq service is optional. Keep it only if you use RabbitMQ-backed messaging features.
  • redis service is optional. Keep it only if you need persisted execution/error history and related features.
services:
  scm-server:
    image: feilfly/scm-server:latest
    container_name: scm-server
    ports:
      - "3000:80"
    volumes:
      - scm_data:/home/scm/data
    environment:
      CHAT_GATEWAY_INTERNAL_TOKEN: this-is-a-token-for-chat-gateway-internal-use-only
      JWT_SECRET: change-me
      JWT_ISSUER: ssh-conn-manager
      JWT_AUDIENCE: ssh-conn-manager-ui
      SECRET_ENCRYPTION_KEY: change-me

      RABBITMQ_HOST: rabbitmq
      RABBITMQ_PORT: 5672
      RABBITMQ_USER: guest
      RABBITMQ_PASS: guest
      RABBITMQ_EXCHANGE: ssh_cmds

      REDIS_HOST: redis
      REDIS_PORT: 6379
      REDIS_DB: 10
      REDIS_TLS: "false"
    depends_on:
      - rabbitmq
      - redis
    restart: unless-stopped

  # Optional: include RabbitMQ only if you use RabbitMQ-backed messaging features.
  rabbitmq:
    image: rabbitmq:3-management
    container_name: rabbitmq
    ports:
      - "5672:5672"
      - "15672:15672"
    restart: unless-stopped

  # Optional: include Redis only if you need persisted execution/error history features.
  redis:
    image: redis:7-alpine
    container_name: redis
    ports:
      - "6379:6379"
    command: ["redis-server", "--appendonly", "yes"]
    restart: unless-stopped

volumes:
  scm_data:

⁠Persistent Data

Mount /home/scm/data to keep SQLite database and runtime data across restarts.

Recommended:

  • Docker volume: scm_data:/home/scm/data

⁠Environment Variables Reference

⁠Security and Authentication
VariableRequiredDefaultDescription
JWT_SECRETYesrandom-rando-rand-ran-ra-rJWT signing secret for API auth tokens.
JWT_ISSUERRecommendeddolphin-groupJWT issuer claim.
JWT_AUDIENCERecommendedmeJWT audience claim.
JWT_EXPIRY_HOURSNo24JWT token expiration in hours.
SECRET_ENCRYPTION_KEYYesdev-containerKey used by secret manager encryption.
MFA_ENABLEDNofalseEnable/disable MFA features.
MFA_ISSUERNodolphin-groupMFA OTP issuer label.
MFA_SECRET_ENCRYPTION_KEYRecommendeddev-containerEncryption key for MFA secret storage.
API_KEYNodev-api-keyAPI key used by some integrations/dev flows.
CHAT_GATEWAY_INTERNAL_TOKENRecommendeddev-chat-gateway-tokenInternal token between chat gateway and API provider-runtime endpoints.
⁠OIDC (Optional)
VariableRequiredDefaultDescription
OIDC_ISSUER_URLOptionalemptyOIDC provider issuer URL.
OIDC_CLIENT_IDOptionalemptyOIDC client ID.
OIDC_CLIENT_SECRETOptionalemptyOIDC client secret.
OIDC_REDIRECT_URLOptionalemptyOIDC callback URL.
OIDC_COOKIE_NAMENooidc_id_tokenCookie name for OIDC token storage.
OIDC_COOKIE_SECURENofalseUse secure cookie flag. Set true behind HTTPS.
⁠Database
VariableRequiredDefaultDescription
DATABASE_TYPENosqliteDatabase engine: sqlite or mariadb.
DB_SQLITE_FILEFor sqlite/home/scm/data/server-db.sqliteSQLite DB path.
DB_MARIADB_HOSTFor mariadb127.0.0.1MariaDB host.
DB_MARIADB_PORTFor mariadb3306MariaDB port.
DB_MARIADB_USERNAMEFor mariadbrootMariaDB username.
DB_MARIADB_PASSWORDFor mariadbrootMariaDB password.
DB_MARIADB_DATABASEFor mariadbscmMariaDB database name.
⁠RabbitMQ (Optional)
VariableRequiredDefaultDescription
RABBITMQ_HOSTOptionalrabbitmqRabbitMQ host.
RABBITMQ_PORTOptional5672RabbitMQ port.
RABBITMQ_USEROptionalguestRabbitMQ username.
RABBITMQ_PASSOptionalguestRabbitMQ password.
RABBITMQ_EXCHANGEOptionalssh_scmExchange name used for SCM messaging.
⁠Redis (Optional; required for history/error persistence features)
VariableRequiredDefaultDescription
REDIS_HOSTOptionalemptyRedis host.
REDIS_PORTNo6379Redis port.
REDIS_USEROptionalemptyRedis username (ACL mode).
REDIS_PASSOptionalemptyRedis password.
REDIS_DBNo10Redis DB index.
REDIS_TLSNofalseEnable TLS for Redis connection.
REDIS_TTLNo604800TTL in seconds for stored execution/error history.
⁠SSH Runtime
VariableRequiredDefaultDescription
SSH_DIAL_TIMEOUTNo10SSH dial timeout (seconds).
SSH_MAX_IDLE_TIMENo1800Max idle time per SSH connection (seconds).
SSH_MAX_CONNECTIONSNo50Max concurrent managed SSH connections.
SSH_MAX_SESSIONSNo5Max concurrent SSH sessions per connection.
SSH_JUMP_HOST_ENABLE_NC_TUNNELNofalseEnable jump-host netcat tunnel mode.
⁠Terminal Runtime
VariableRequiredDefaultDescription
TERMINAL_ENABLEDNotrueEnable terminal feature.
TERMINAL_MAX_SESSIONS_GLOBALNo200Global max terminal sessions.
TERMINAL_MAX_SESSIONS_PER_USERNo20Max terminal sessions per user.
TERMINAL_MAX_SESSIONS_PER_CONNECTIONNo5Max terminal sessions per SSH connection.
TERMINAL_MAX_LIFETIME_SECONDSNo14400Max terminal session lifetime.
TERMINAL_IDLE_TIMEOUT_SECONDSNo1200Terminal idle timeout.
TERMINAL_MAX_INPUT_BYTESNo32768Max input bytes per message.
TERMINAL_MAX_OUTPUT_BUFFER_BYTESNo262144Max output buffer size.
⁠HashiCorp Vault Secret Provider (Optional)
VariableRequiredDefaultDescription
VAULT_ADDR / VAULT_URLOptionalemptyVault endpoint URL.
VAULT_TOKENOptionalemptyVault token (if token auth is used).
VAULT_NAMESPACEOptionalemptyVault namespace.
VAULT_ROLE_IDOptionalemptyAppRole role id.
VAULT_SECRET_IDOptionalemptyAppRole secret id.
VAULT_PREFIXOptionalemptySecret path prefix.
VAULT_VERIFYNotrueEnable TLS cert verification for Vault.
⁠Logging
VariableRequiredDefaultDescription
LOG_LEVELNoinfoLog level (debug, info, warn, error).
LOG_FILE_PATHNo/var/log/scm/scm-api.log (API), /var/log/scm/scm.log (gRPC)Log output file path.
LOG_CONSOLENotrueAlso emit logs to console.
LOG_MAX_SIZE_MBNo10Log file max size before rotation.

Tag summary

Content type

Image

Digest

sha256:ec5ea453b…

Size

227.5 MB

Last updated

4 months ago

docker pull feilfly/scm-server