Appearance

Get started

Quickstart

From an empty Docker host to your first certificate-based SSH login, in four steps.

This is the short path: install Shellius, sign in, bootstrap one host, and log in to it with a certificate that expires. Each step links to the full guide.

You need a Linux machine with Docker and Compose v2, a hostname for the portal, and one Linux host to manage that can reach Shellius over HTTPS.

ShelliusNew hostOne-time tokenexpires in 30 minutesShellius APIagent token authCA private keynever leavesinstall.shcurl … | sudo bash99-shellius.confCA public key + check-principalsHeartbeat timersystemdone-time URLvalidates loginsheartbeat
What you are about to set up: Shellius holds the CA, the host trusts its public key and asks Shellius about every login.

1. Install Shellius ​

bash
git clone https://github.com/YavLabs/shellius.git
cd shellius
cp .env.prod.example .env.prod

Fill .env.prod with generated secrets (openssl rand -hex 32), your hostname and the first super admin's email and password. Then:

bash
docker compose -f docker-compose.prod.yml --env-file .env.prod up -d

Migrations and the seed run on first boot. → Install with Docker

Back up SERVER_ENCRYPTION_KEY now

It encrypts your CA's private key. Lose it and every host has to be re-bootstrapped against a new CA.

2. Sign in and create the basics ​

  1. Sign in as the super admin you seeded.
  2. Set up the organisation's certificate authority.
  3. Create a Customer, then a Server under it — start with a dev or staging environment, not prod.
  4. Create an Access policy that allows you to reach it.

→ First login

Interface preview with sample data.

3. Bootstrap the host ​

Generate a bootstrap command for the server in the portal, then run it on the host. The token in it is single-use and lasts 30 minutes.

bash
curl -fsSL "https://shellius.example.com/api/bootstrap/install.sh?token=…" | sudo bash

The script validates the sshd configuration before reloading and ends with a self-test. → Bootstrap your first host

Keep your current session open

Do not close the SSH session you ran this from until you have confirmed a certificate login works from a second terminal.

4. Request access and connect ​

  1. Open the server and request access, with a duration and a reason.
  2. Because it is not a production server, a matching policy with auto-approve grants it immediately.
  3. Connect from the browser terminal.
Interface preview with sample data.

Now revoke your own access from the request, and try to connect again. The refusal you get is the point of the whole system.

Next steps ​

Access policiesWho may reach what, as whom, for how long.Access requestsTurn on review for production.The terminal clientThe same access from your own shell.Hardening checklistBefore you put real hosts behind it.
Was this page helpful?No, tell us why