Sign in

Open your deployment in a browser and sign in with the SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD you set in .env.prod.

Change that password immediately, from Profile → Change password. The seeded password is sitting in a file on your server and may be in your shell history.

Set up the certificate authority

Shellius generates the organisation's CA automatically the first time you bootstrap a host, so there is usually nothing to do here. You can review it under Administration → Certificate authority, where you can see the public key and rotate the pair.

Rotating the CA invalidates trust on every host that was bootstrapped against the old key, so the hosts have to be re-bootstrapped. Plan it.

Create the records a server needs

Shellius organises hosts in a hierarchy, so create these in order:

1. Customer — a client or project. Servers belong to one.
2. Server — the SSH or RDP target, tagged with an environment of demo, dev, staging, or prod. The environment tag is what drives the approval rules, so set it honestly.
3. Access policy — who may reach which servers, as which principals, for how long.

A policy has allow and deny rules. Deny always wins. Each allow rule names the subjects it applies to (users, groups, or a role tier), the servers it covers (by customer, environment, label, or specific host), the principals it grants, and a maximum lifetime.

WARNING

Marking a server prod is what sends its requests to an approver. A production host tagged dev will quietly auto-approve if a policy allows it.

Invite your team

Under Administration → Users, invite people and assign a role. Roles are sets of permissions, and every organisation starts with four built-in ones — super_admin, admin, manager, and member — which you can edit apart from super_admin.

You can only create, edit, or assign a role whose permissions are a subset of your own. Nobody can edit their own role, and the last active super admin cannot be demoted or suspended.

If you use an identity provider, configure OIDC under Administration → Single sign-on instead of inviting people by hand.

Next

Bootstrap your first host so it trusts the CA.