wirecore/wireterm-server repository overview

⁠WireTerm Server

The sync backend of WireTerm⁠, the SSH, SFTP, FTP and S3 client: workspaces on every device and shared with your team. Every password and key arrives here already encrypted by the client — the server cannot read them.

Most people never run it themselves: WireTerm signs in with WireCloud⁠ and syncs to the hosted instance. This image is for running your own.

• Source, documentation and issues: github.com/WireCore/WireTerm-Server⁠
• License: AGPL-3.0

⁠Tags

X.Y.Z, X.Y, X and latest, for linux/amd64 and linux/arm64. Also on ghcr.io/wirecore/wireterm-server.

⁠Quick start

The repository's docker-compose.prod.yml⁠ is a complete example: MariaDB and the server, which applies pending migrations on every start.

curl -O https://raw.githubusercontent.com/WireCore/WireTerm-Server/main/docker-compose.prod.yml
curl -o .env https://raw.githubusercontent.com/WireCore/WireTerm-Server/main/.env.example
echo "DB_PASSWORD=$(openssl rand -hex 24)" >> .env
echo "DB_ROOT_PASSWORD=$(openssl rand -hex 24)" >> .env
docker compose -f docker-compose.prod.yml up -d

.env.example is set up for development. Change at least PUBLIC_URL, BETTER_AUTH_SECRET, COOKIE_SECRET, CORS_ORIGIN, BETTER_AUTH_TRUSTED_ORIGINS, BETTER_AUTH_COOKIE_DOMAIN, BETTER_AUTH_DISABLE_ORIGIN_CHECK=0 and SMTP_* — every variable is described in the README⁠.

⁠Good to know

• The server speaks plain HTTP on port 80 — put a reverse proxy with TLS in front and set TRUST_PROXY=1.
• It runs as the unprivileged user node; /health answers as soon as it accepts requests.
• Secrets can be passed as files: <NAME>_FILE, e.g. BETTER_AUTH_SECRET_FILE=/run/secrets/auth.
• The image contains the Prisma CLI and the migrations: npx prisma migrate deploy runs from the image itself.