Local VPS Operations Without a Hosted Control Plane

Managing several servers usually means splitting work across SSH config files, terminal sessions, audit scripts, benchmarking tools, and a separate place to remember which machine is which. Serv1x brings those tasks into a single interactive terminal interface while keeping configuration and credentials on the operator's machine.

The project can store VPS profiles, open interactive SSH sessions, inspect server details, run a 13-check security review, and collect system, disk, and network benchmarks. There is no hosted dashboard, account system, telemetry client, or cloud synchronization path in the inspected implementation.

How the TUI Is Structured

Serv1x is a React terminal application rendered with Ink. Its screen state moves between server creation and editing, quick connections, saved-server lists, server details, security checks, benchmarks, help, and settings.

It uses two SSH paths for different kinds of work:

  • Interactive sessions launch the native OpenSSH client through node-pty, preserving familiar terminal behavior.
  • Server inspection, security checks, and benchmarks use node-ssh to run bounded programmatic commands and parse their results.

Saved profiles can use password or private-key authentication. Profiles can be edited, removed, and exported without their saved passwords.

Security Review

The implemented audit runs 13 checks across practical Linux server concerns, including:

  • Root login and password authentication policy.
  • Empty-password and SSH protocol settings.
  • Firewall status and listening ports.
  • Pending security updates and automatic update configuration.
  • AppArmor or SELinux state.
  • /tmp mount restrictions.
  • Home-directory permissions.

The checks adapt package and update commands for several detected operating-system families, but the audit is primarily designed around Linux. Results should be treated as operational guidance, not as a formal compliance certification or a replacement for a threat-model-specific security review.

Benchmarking

The benchmark flow collects a broad operational snapshot rather than one synthetic score. Its output includes:

  • Operating system, kernel, virtualization, and TCP congestion control.
  • Load, CPU, memory, and swap information.
  • Disk capacity, inode usage, and three disk I/O runs.
  • Public network information and speed-test results.
  • Total execution duration.

Because the checks run through the same saved server workflow, an operator can move from inventory to inspection and performance diagnosis without leaving the TUI.

Local Credential Storage

Serv1x stores its configuration under ~/.config/serv1x. Saved passwords are encrypted with AES-256-GCM using a random salt and IV for each value. Argon2id derives the encryption key with a 64 MiB memory cost, three iterations, and parallelism four.

A random 32-byte master key is stored locally with requested mode 0600, while the configuration directory requests mode 0700. Authenticated decryption failures are surfaced instead of being converted into an empty password.

This protects credentials from casual disclosure when someone sees only the configuration file. It is not a hardware-backed secret store. A user or process that can read both the encrypted configuration and the local master key can decrypt the saved passwords, so host security and filesystem permissions still matter.

SSH Host Verification

Interactive SSH sessions use a Serv1x-specific known_hosts file and enable OpenSSH StrictHostKeyChecking=yes by default. Changed-host-key output receives a dedicated warning, and the setting can be changed by the operator.

That guarantee should be scoped carefully. The separate node-ssh connection path used for audits and benchmarks does not pass an explicit host verifier in the inspected version. The project therefore does not claim that every SSH path has the same known-host enforcement as the interactive OpenSSH session.

Installation

Serv1x requires Node.js 18 or newer and can be installed globally or launched through npx:

npm install -g serv1x
serv1x

# or run without a permanent global installation
npx serv1x

The package declares Linux, macOS, and Windows support on x64 and arm64. Because it uses native terminal dependencies, the local platform may need build tools during installation.

For development:

git clone https://github.com/aldevvv/serv1x.git
cd serv1x
pnpm install
pnpm dev

Technology and Status

Serv1x 1.0.0 is an ESM TypeScript package. Ink and React render the interface, node-ssh handles programmatic SSH, node-pty hosts interactive terminal sessions, Conf manages local configuration, and Node's crypto primitives provide AES-256-GCM. Argon2id is used for key derivation, while tsup builds the executable.

The repository includes build and type-check scripts but does not contain an automated test suite or CI workflow at the inspected revision. It is best presented as a released, practical local operations tool without implying broad production validation or continuous security regression coverage.

Sources

  1. Serv1x README
  2. Application and screen state
  3. SSH, audit, and benchmark implementation
  4. Configuration and credential storage
  5. Package manifest