Web: Deploy & Admin Guide 🌐 Web

Run TabSSH on your own server. One docker run, and the full app is live in a browser.

Web is the self-hosted sibling of the Android and Desktop apps — same accounts, same sync format, same 23 themes. See tabssh/web on GitHub for current status.

🐳 Deploy with Docker

Recommended for every OS. Persistent volumes keep config and encrypted data across restarts.

docker run -d \
  --name tabssh-web \
  -p 8080:8080 \
  -v tabssh-config:/config/tabssh \
  -v tabssh-data:/data/tabssh \
  ghcr.io/tabssh/web:latest

Or with Docker Compose:

docker compose -f docker/docker-compose.yml up -d

Put a reverse proxy (Caddy, nginx, Traefik) with TLS in front for anything reachable outside your LAN — TabSSH Web does not terminate TLS itself.

📦 Standalone Binary

Prefer no Docker? Download a precompiled binary from the releases page and run it directly:

./tabssh --config /etc/tabssh/tabssh/server.yml

👤 First Run & Admin Panel

Open http://your-server:8080 — the first account created becomes the instance admin.
The admin panel covers instance settings, user & org management, and per-user quotas.
Add a host the same way as mobile/desktop: manually, via SSH config paste, or bulk import (CSV, JSON, PuTTY .reg, Terraform .tf).
Every feature is also available over the API — Swagger UI at /server/docs/swagger, GraphiQL at /server/docs/graphql.

👥 Multi-User & Organizations

Each user gets an isolated vault and isolated sync storage — one instance can safely serve a whole team.
Create an organization to share a vault across members with role-based access — a self-hosted alternative to Termius/Termix team plans.
Sync between devices uses a server-blind, E2E-encrypted endpoint (TABSSH_SYNC_V2): the passphrase never leaves the client, so the server operator cannot read stored credentials.
Pair a phone or desktop to this instance with the built-in QR pairing broker — a short-lived rendezvous code, no credentials transmitted in the clear.

🛠️ Troubleshooting

Container won't start: check docker logs tabssh-web; most often a volume permission mismatch or a port already in use.
Health check: hit /server/healthz on the running instance to confirm the server process is up.
Can't reach it remotely: confirm the reverse proxy is forwarding to port 8080 and that any firewall/security group allows the proxy's port.
Sync not showing on another device: verify the pairing code hasn't expired (they're short-lived by design) and re-pair.
Still stuck? Open an issue on tabssh/web.

Back to Documentation Download for Web →