If you manage more than three Linux boxes, you eventually end up with SSH keys in three places, a spreadsheet of root passwords someone swears is "temporary," and a junior dev using the same personal Termius account for work and their homelab. The sessions work until someone leaves, a laptop is stolen, or counsel asks who had access to production last Tuesday.
Termix (~15k GitHub stars) is the open-source answer pitched as a self-hosted, plugin-based server management platform — "think free, self-hosted Termius." The core handles hosts, credentials, users, sharing, and audit. SSH terminals, file manager, Docker, metrics, RDP/VNC, automations, and two dozen other features ship as plugins you can enable, disable, or rip out entirely.
What the core gives you
Every install gets the same foundation:
- Hosts in nested folders with tags, bulk edit, import/export, and Quick Connect for one-offs
- Credentials reused across hosts — passwords, keys, per-folder defaults
- Sharing & roles at connect / view / edit / manage levels for users or roles
- Accounts with visible sessions you can revoke, trusted devices, API keys, audit log
- Encryption for secrets per user; optional database encryption at rest
- Desktop sync — desktop app can link to your server and keep an offline copy of your account
UI polish matters when this is daily driver software: tabs, split panes, command palette (double-tap left shift), rebindable shortcuts, themes, ~30 languages. SQLite by default; PostgreSQL and MySQL if you want a proper DB backend.
Plugins — the actual toolbox
Official plugins cover what hosting and homelab people actually touch:
- SSH Terminal — tabs, splits, history, macros; local terminal in the desktop app
- File Manager — SFTP browse/edit, server-to-server transfers
- Docker / Podman — containers, logs, stats, console over SSH
- Host Metrics — CPU, RAM, disk, network, GPU live graphs
- Remote Desktop — RDP, VNC, Telnet in the browser (needs
guacd) - Fleets — run commands or file pushes across host groups
- Automations — scheduled or event-driven steps on hosts
- Tunnels — SSH port forwarding with auto-reconnect
- SSO / LDAP / Passkeys / TOTP — pick your auth story
- Vault, Step CA, OPKSSH, Tailscale, Warpgate — short-lived certs and bastion patterns instead of long-lived root keys everywhere
Admins install or remove plugins from the UI; community plugins come from registries you control. If you don't want AI in your infra tool, don't install the AI Assistant plugin — that's the point of the architecture.
Why self-host Termix?
Credentials stay on your metal. Host definitions and encrypted secrets live in your database on a VPS you control — not a US SaaS sync bucket tied to someone's phone.
Audit and offboarding. Session list, revoke, optional session recording plugin, role-based sharing — easier to answer "who SSH'd into this client box?" than forwarding a shared 1Password vault forever.
One URL for the team. Web, desktop, mobile — same host inventory. Canadian agencies with contractors on laptops and tablets get one internal entry point instead of emailing ssh user@ip instructions.
Plugin risk management. Remote desktop and Docker plugins are powerful; you can run a slim install (SSH + files + metrics only) on a small team server and leave RDP for a separate jump host.
What running it takes
Docker is the straightforward path. Official sample compose runs ghcr.io/termix-ssh/termix:latest on port 8080 with a termix-data volume. If you use the Remote Desktop plugin, add guacamole/guacd on the same network — the README documents env vars for recording paths and RDP drive redirection. No RDP? You can omit guacd and simplify.
Plan 2 GB RAM minimum for a small team web install; more if you enable guacd, heavy session recording, or lots of concurrent browser terminals. Put TLS in front (Termix has an ACME plugin, or use Caddy/nginx on the same host). Restrict access — VPN, SSO plugin, or at minimum fail2ban on 8080 — because this is literally your keys to production.
Back up the termix-data volume (and external DB if you moved off SQLite). Losing that volume hurts worse than losing the container image.
Who it's for (and who should skip it)
Good fit: MSPs and internal IT managing dozens of client VPSs, dev teams with staging/prod sprawl, homelabbers who outgrew plain SSH config files, anyone comparing Termix to Termius but needing data residency.
Maybe skip it: if you already standardized on Ansible + mosh and hate GUIs. If you need full GitOps for infra with no interactive SSH, Termix complements but doesn't replace that. If you won't patch a web-facing admin tool monthly, don't expose it to the internet.
Hosting it in Canada
We deploy Termix on Canadian Docker hosting — TLS, firewall rules, volume backups, and sizing for guacd when you need browser RDP to Windows instances for a client. Pair it with our managed monitoring if you want alerts when the jump box itself goes dark.
Tell us how many admins, which plugins, and whether you need SSO or Vault integration — we'll scope a single jump host or a hardened internal-only deployment.
