Divyansh GuptaDivyansh Gupta
All work
Security · Infrastructure · CLI

MySSH

A zero-trust SSH access proxy that replaces static keys with short-lived certificates.

NestJSSQLiteSSH CertificatesTOTPAES-256-GCM
MySSH interface

Overview

MySSH is a personal infrastructure product: a CLI, a NestJS backend acting as a certificate authority and control plane, and a web dashboard. Instead of distributing static SSH keys, it issues short-lived, principal-scoped SSH certificates on demand, gated by organisation membership, per-node access lists, and optional TOTP. It also includes a Doppler-style encrypted secrets vault for injecting environment variables into processes and CI/CD.

The challenge

Static SSH keys are hard to revoke, hard to audit, and tend to outlive the person or process they were issued to. The system needed certificate issuance and revocation to be simple enough to use daily, while still enforcing per-node ACLs, multi-tenant organisations, and two-factor enforcement without adding friction to a normal `ssh` workflow.

What I built

  • CLI (`myssh connect`, `register`, `node-*`, `vault-*`, `run`, `proxy`) wrapping the whole flow
  • NestJS backend acting as certificate authority: issues ed25519-signed, principal-scoped SSH certs per connection
  • Organisation-based multi-tenancy with 4-tier RBAC (Owner/Admin/Member/Viewer)
  • Per-node access control lists and one-time registration tokens for onboarding new servers
  • Per-node TOTP enforcement with in-terminal QR setup and backup codes
  • Encrypted secrets vault (AES-256-GCM, versioned, audited) with long-lived service tokens for CI/CD
  • Web dashboard for managing organisations, nodes, members, and vault secrets

Architecture

CLI (myssh)
NestJS Control Plane / CA
SQLite
Web Dashboard
Target Nodes (sshd)

Engineering highlights

No static keys

Every connection gets a fresh ed25519 keypair and a certificate signed for that specific node principal, valid only for the session — there's nothing long-lived to leak or rotate.

Per-node TOTP

Admins can require a TOTP code at connection time on a per-node basis; the CLI walks a first-time user through authenticator setup and backup codes without leaving the terminal.

Secrets vault

Per-organisation AES-256-GCM encryption, versioned secrets, and audit logging give CI/CD pipelines and processes scoped, revocable access to environment secrets instead of shared .env files.

Results

Zero-trust certs

Auth model

4

RBAC tiers

CLI · API · Dashboard

Components shipped

Next project

KVCall

Mobile · Realtime · WebRTC