Nixstasis

Every device in your fleet, one click away.

See what each device reports, get alerted when something breaks, and open a shell on any of them, even behind NAT, without opening a port on the device.

Nixstasis is a server you run and a small agent on each Linux device.

Get started Read the docs
Each hexagon is a device. Open one, and its terminal comes to your browser through the connection the device already made.
  • Checking in
  • Waiting for your approval
  • Alerting
  • Gone quiet
  • Open in your browser

Approve

Nothing joins your fleet on its own.

Each device registers with an identity tied to the MAC address of the interface that reaches your server. It stays pending until you approve it.

Watch

Find out when something breaks.

Every check-in carries telemetry from built-in inventory and the Starlark scripts you install. Your rules turn it into alerts, a device that goes quiet raises one too, and alerts reach you by email or webhook.

Organize

Find the devices you mean.

Put devices in groups, filter the fleet down to the ones you care about, and build reports from their telemetry.

Script

Change devices without handing out a shell.

Push Starlark scripts to devices and run them. A script can only run commands on an allowlist you control, and you can push a new allowlist from the server.

Reach

A shell when you need one, and only then.

Open a device and you get an SSH terminal in your browser. The tunnel behind it exists only while you have the device open.

No way in but yours

  • No inbound ports to open on your devices. The agent and the tunnel both connect out, so devices work behind NAT and firewalls that only allow outbound traffic.
  • No shell commands from the server. The agent accepts a fixed set of actions, and scripts can only run the commands you allowed.
  • No shortcuts on TLS. The agent always checks the server's certificate and never follows a redirect, so it only talks to the address you configured.
  • Single sign-on with your identity provider. Operators sign in through any OpenID Connect or OAuth 2.0 provider, such as Microsoft Entra ID, Google, GitHub, GitLab, Okta, or Meta, and you decide who is a viewer, operator, or admin. The server ignores identity headers that don't carry the gateway's shared secret.

From clone to first device

You need a host with Docker for the server, and Linux devices on amd64 or arm64 with systemd, or Nix.

  1. Run the server

    In a clone of the repository, copy the environment template and fill in every required value. Then run the migrations and start the stack.

    cd deploy/compose
cp .env.example .env
docker compose --env-file .env run --rm nixstasis /app/bin/migrate
docker compose --env-file .env up -d nixstasis caddy frps postgres

    Deployment guide

  2. Install the agent

    Grab the package for your device from the latest release. It bundles frpc, and the .deb and .rpm packages pull in OpenSSH and sudo. Before using the .run installer, install OpenSSH and sudo yourself and start the SSH server.

    # Debian, Ubuntu
sudo apt install ./nixstasis_<version>_amd64.deb
# Fedora, RHEL
sudo dnf install ./nixstasis-<version>-1.x86_64.rpm
# Any other Linux with systemd
sudo sh nixstasis-<version>-linux-amd64.run

    On arm64, use the arm64 or aarch64 file. With Nix, run nix build .#client.

    Client installation guide

  3. Point it at your server and approve it

    Set your server's address in /etc/nixstasis/config.yaml. The agent retries registration every two minutes, or you can restart it now.

    api:
  url: "https://nixstasis.example.com"
frp:
  server_addr: "nixstasis.example.com"
    sudo systemctl restart nixstasis-registration.service

    The device shows up waiting for approval. Approve it, and it starts checking in.