simtabi/ssh-manager

Profile-based SSH key and config lifecycle manager: one manifest is the source of truth, and ~/.ssh is reproducible output.

A single static binary (sshmgr) with no runtime dependencies. macOS, Linux and Windows are all first-class; OpenSSH is the only requirement.

curl -fsSL https://raw.githubusercontent.com/simtabi/ssh-manager/main/src/scripts/install.sh | bash
sshmgr doctor

Windows: irm https://raw.githubusercontent.com/simtabi/ssh-manager/main/src/scripts/install.ps1 | iex. Also go install github.com/simtabi/ssh-manager/src/v3/cmd/sshmgr@latest, or a binary from Releases. Every path, and where per-user state lives, is in docs/installation.md.

• Installation — install paths, requirements, and where per-user state lives.
• Getting started — first run, from init to a deployed key.
• Configuration — the manifest, profiles, hosts, .env, environment variables.
• Architecture — packages, key flows, and why the v2 layout is what it is.
• Release — the tag-driven GoReleaser flow.

• Feature catalog — every command, what it does, and how it is tested.
• doctor — what it checks, --fix, --json, --strict.
• deploy — installing a public key on its target.
• providers — the adapter catalog and how to extend it.
• VPS keys — cloud account keys and server keys.
• rotate — zero-downtime staged rotation and rollback.
• expiry — rotation age and scheduled reminders.
• knownhosts — pinning host keys into the trust store.
• net — reachability and VPN-gated hosts.
• validate — keypair integrity checks.
• bundle — encrypted backup and restore.
• recover — break-glass when you are locked out.
• tui — the interactive menu.

• Two GitHub accounts on one machine — one hostname, two identities, neither able to act as the other.
• Onboard an existing ~/.ssh — bring a hand-built setup under management without regenerating anything.
• Rotate a key with no downtime — stage, verify, commit; and how to step back.
• Work against a sandbox — exercise every verb without touching your real ~/.ssh.
• Back up, and restore onto a new machine — the only path that recovers the same keys.
• Recover from a locked-out server — break-glass with no working SSH.
• Run it in CI — non-interactive, sandboxed, failing loudly.

Contributing · Security policy · Code of conduct · Changelog

MIT © Simtabi LLC — see LICENSE.