sshoosh

sshoosh is a self-hosted SSH/TUI workspace chat for small teams and operators who want real-time collaboration over SSH.

Demo

Quick start

1. Install the release binary.

curl -fsSL https://raw.githubusercontent.com/puemos/sshoosh/main/install.sh | sh

Or install with Homebrew:

brew install puemos/tap/sshoosh

2. Generate an owner bootstrap token.

   sshoosh bootstrap-token
   

3. Start the server.

   SSHOOSH_DB=./sshoosh.sqlite \
   SSHOOSH_SERVER_KEY=./sshoosh_server_ed25519 \
   sshoosh serve --host 0.0.0.0 --port 2222
   

4. Connect with SSH and paste the token at the masked Token: prompt.

   ssh -p 2222 127.0.0.1
   

   Your SSH key is registered the first time you redeem a bootstrap, invite, or device link token. The token is requested over keyboard-interactive auth so it never appears in the SSH user field, ps, sshd logs, or shell history. For bootstrap and invite tokens, sshoosh then asks you to choose your username in the TUI. Device link tokens sign in to the existing account. Once your key is bound, future connections skip the prompt.

Docs and reference

For complete deployment, configuration, and command details, read the docs site:

• https://puemos.github.io/sshoosh/

Deployment summary

Setup path	Recommendation	Notes
Local or LAN	0.0.0.0:2222 on private network	Bind to your host IP and keep firewall rules tight.
Temporary sharing	Tunnel sshoosh TCP port	Works with ngrok, Cloudflare Tunnel, Tailscale, or SSH reverse tunnels.
Production	VPS + systemd	Use sudo sshoosh daemon install so the service runs as the locked-down sshoosh user.
Docker	GHCR image + persistent volume	Run as the image's non-root user, persist /data, and drop container capabilities.
PaaS/container hosts	Use only raw TCP paths	Avoid HTTP-only hosts.

VPS quick path:

curl -fsSL https://raw.githubusercontent.com/puemos/sshoosh/main/install.sh | sudo sh -s -- --dir /usr/local/bin
sudo /usr/local/bin/sshoosh daemon install --binary /usr/local/bin/sshoosh
sudo sh -c 'set -a; . /etc/sshoosh/sshoosh.env; set +a; exec sudo -E -u sshoosh /usr/local/bin/sshoosh bootstrap-token'
ssh -p 2222 sshoosh.example.com
# Paste the bootstrap token at the masked "Token:" prompt.

To apply a new release on a daemon install, replace the binary in place and restart the managed service:

curl -fsSL https://raw.githubusercontent.com/puemos/sshoosh/main/install.sh \
  | sudo sh -s -- --dir /usr/local/bin --version vX.Y.Z
sudo /usr/local/bin/sshoosh daemon restart --backup

Docker quick start:

docker volume create sshoosh-data
docker run --rm -v sshoosh-data:/data ghcr.io/puemos/sshoosh:latest bootstrap-token
docker run -d --name sshoosh --restart unless-stopped \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  -p 2222:2222 \
  -v sshoosh-data:/data \
  ghcr.io/puemos/sshoosh:latest

Core commands

sshoosh bootstrap-token
sshoosh serve
sshoosh doctor
sshoosh doctor --repair-search
sshoosh backup /var/backups/sshoosh.sqlite
sshoosh export --format json --out /var/backups/sshoosh.json --include-audit

Use the full command reference in the docs for CLI/TUI details.

Environment variables (quick starter)

SSHOOSH_DB=/var/lib/sshoosh/sshoosh.sqlite
SSHOOSH_SERVER_KEY=/var/lib/sshoosh/sshoosh_server_ed25519
SSHOOSH_HOST=0.0.0.0
SSHOOSH_PORT=2222

For advanced configuration options and production tuning, see the docs site.