hammadsaqib/fusionterm repository overview

⁠FusionTerm

Self-hosted SSH & RDP access in your browser. Linux terminals, Windows desktops, a file manager with sudo, shared team connections and a password vault — running on your own server, with SSO, MFA and a full audit log. Nothing to install on anyone's laptop.

⁠Features

• SSH — tabs, split screen, jump hosts (ProxyJump), tmux-backed sessions, live CPU/RAM/disk, broadcast input, snippets
• RDP — Windows desktops next to your terminals, idle timeout with warning, one-key reconnect
• Files — a real file manager (back/forward/up, upload, rename); Use sudo when you need root
• Teams — shared connection folders (people connect without seeing passwords), users & signed-in devices, one-click offboarding
• Vault — passwords, SSH keys and API tokens, encrypted on your server
• Security — AES-256-GCM at rest, SSH host-key verification, MFA, OpenID Connect SSO (Google, Microsoft Entra ID, Okta, Keycloak), audit log
• Phone — Android app and installable web app
• Net Tools — DNS, propagation, ping, ports, traceroute, MTR, WHOIS, TLS / website / email security checks

⁠Quick start (SSH, one command)

docker run -d --name fusionterm -p 5577:5577 \
  -e FORCE_SECURE_COOKIE=false \
  -v fusionterm-data:/data \
  --restart unless-stopped \
  hammadsaqib/fusionterm:latest

Open http://<your-server>:5577, create the admin account and add your first server.

⁠Full install (SSH + RDP) with Docker Compose

RDP needs the Apache Guacamole gateway (guacd) next to FusionTerm. Save this as docker-compose.yml:

services:
  fusionterm:
    image: hammadsaqib/fusionterm:latest
    ports:
      - "5577:5577"
    environment:
      GUACD_HOST: guacd
      # Plain-HTTP evaluation only — delete this line once you serve over HTTPS.
      FORCE_SECURE_COOKIE: "false"
    volumes:
      - fusionterm-data:/data
    depends_on:
      - guacd
    init: true
    restart: unless-stopped

  guacd:
    image: guacamole/guacd:1.6.0
    platform: linux/amd64
    restart: unless-stopped

volumes:
  fusionterm-data:

docker compose up -d

⁠Updating

docker compose pull && docker compose up -d
# or, with docker run:
docker pull hammadsaqib/fusionterm:latest && docker rm -f fusionterm   # then run the quick-start command again

Your data stays in the fusionterm-data volume; upgrades migrate it automatically, and the database is copied to backups/ in the volume first (last 5 kept). Admins see a notice in Settings when a new version is out.

⁠Production checklist

• HTTPS: put FusionTerm behind your reverse proxy (nginx, Caddy, Traefik) and remove FORCE_SECURE_COOKIE, so the sign-in cookie is only sent over HTTPS. Pass WebSockets (/ws/terminal) through.
• Back up the volume. It holds the database and secret.key, which encrypts saved passwords — without it they can't be read:

  docker run --rm -v fusionterm-data:/data -v "$PWD":/backup alpine \
    tar czf /backup/fusionterm-data.tgz -C /data .
  

  Copy
  (With Compose the volume name is prefixed by the folder name — see docker volume ls.)
• Don't publish guacd's port; FusionTerm reaches it on the Compose network.

⁠Settings (environment variables)

⁠Plans

Free for one person (up to 20 saved connections). Gold (2–10 users) and Platinum (11–50) add team members, shared connections, SSO and the phone app; Enterprise for larger teams. Paste the license key into Settings → License — it's verified offline, no license server.

⁠Tags

• latest — the newest release
• 1.0, 1.0.0 — pin a version for predictable upgrades

Images for linux/amd64 and linux/arm64. Runs as a non-root user.