Certificate authority
An Ed25519 CA per organisation, encrypted at rest and decrypted in memory only while signing.
Skip to content
What changes
Measured against the two things most teams are actually running today: public keys in authorized_keys, or a browser gateway with some scripts around it.
| Capability | Keys in authorized_keys | Guacamole and scripts | Shellius |
|---|---|---|---|
| Access ends without anyone acting | No | No | At the certificate TTL |
| Revoking takes effect | After editing every host | Varies | On the next connection |
| Production access is reviewed | No | No | Yes, bypass is audited |
| Record of who reached what | sshd logs, per host | Partial | One immutable audit log |
| Replay a session | No | No | asciinema recordings |
| RDP from a browser | No | Yes | Yes, behind the same policy |
| Sign in with your identity provider (OIDC) | No | No | Yes |
What you get
All of it is in the repository, under the AGPL-3.0. No feature gating and no licence key.
Policy engine
Allow and deny rules scoped by customer, environment, label, host, user or group. Deny always wins.
Approval workflow
Production is reviewed by default. The bypass is a role permission plus an org switch, and is still recorded.
Browser terminal
xterm.js over a WebSocket for SSH, and a full Guacamole client for RDP.
Terminal client
A Go client with device-flow sign-in that drops you straight onto an approved host.
Session recording
asciinema casts for SSH sessions, replayable in the portal.
Audit log
Every read, write and connection, with actor, target, time and address. Append-only.
Multi-tenant
Every tenant-scoped table carries an org id, enforced at the query layer.
Single sign-on
OIDC — Google, Entra ID, Okta, Auth0 or generic — configured per organisation with credentials encrypted at rest.
Keystore
Encrypted identities for hosts that cannot take certificates. Never returned by list or get.
Session expiry jobs
Certificates, requests and sessions expire on their own through background workers.
Prometheus metrics
A token-guarded metrics endpoint for your existing monitoring.
Where it is the wrong tool
Worth knowing before you spend an evening on it.
- It is six containers. For a homelab with three boxes this is heavier than you need.
- check-principals fails closed — if hosts cannot reach the API, nobody gets in.
- Compromising the Shellius host means compromising everything it can sign for.
- Approval stops accidents, not a determined insider with the right permissions.
Try it against one non-production host.
That is enough to see whether the model fits how your team works.