The operator's cockpit
for everything you SSH into,
click through and forget about.
nsbd is a self-hosted admin dashboard that puts your entire stack — cloud instances, managed databases, domains, Git repos, object storage, hosting platforms, the boxes you SSH into, and the AI coding agents you point at all of it — behind a single login. Stop bouncing between twelve provider consoles and four terminal tabs to answer one question.
Even a small product is split across a dozen consoles.
One service is a repo at GitHub, DNS at Cloudflare, a container at Coolify, a database at Supabase, secrets in 1Password and logs on a VPS you SSH into. Answering “is it up?” means opening five tabs and hoping you remembered the right ones.
- 09:14open Cloudflare to check the DNS record
- 09:15open GitHub to grab the SHA that's deployed
- 09:16open Coolify to restart the container
- 09:17ssh into the VPS to tail the logs
- 09:18open 1Password to find the env var
- 09:19…what was the original question?
- trussbridgestrussbrid.ges · 8c01c72 · 2 days · healthy
- Repo · github.com/mikeroq/trussbridgesmaster · synced 4m ago · webhook receiving
- DNS · cloudflareA trussbrid.ges → 78.46.x.x · auto‑created on deploy
- Env vars · 7 keysencrypted in your Postgres · injected at deploy
- Last deploy · 4 days ago✓ build · ✓ healthcheck · rollback available
Group your sprawl into Projects.
A “service” becomes one thing again — its repo, its domain, its database, its host, its deploys — instead of seven tabs. Synced on a schedule from each provider's API.
OAuth or API key once per provider. nsbd polls the rest. Your data stays in your Postgres.
Find a repo, a hostname, a TXT record or a Stripe webhook by name across every provider you've connected.
Pin a repo, a domain, a host, a database and a deploy target together. Everything else follows.
Develop with your AI coding agents
— without ever leaving nsbd.
Claude Code, Codex, Gemini, OpenCode: spawn them, talk to them, watch them work, and approve what they do, all from one dashboard. The browser tab is the IDE; tmux, transcripts and per‑agent quirks stay out of your way.
Whether you launched a session from nsbd or fired one up in a terminal yourself, it shows up in the sessions list with a live status pill — starting, generating, awaiting input, idle, ended.
Streaming responses, tool‑call chips with inline diffs for Edit / MultiEdit, success/error coloring on every tool result, and a transcript search that actually finds things. No terminal in sight.
Permission requests land as a banner enriched with the actual path or command — not a generic “Claude wants permission for Write.” Allow, Allow always, or Deny travels back to the agent. Hooks or ACP, same banner.
Every session keeps a live Terminal tab next to its Chat — the agent’s full tmux window with scrollback and keystrokes, not a preview that only appears when something breaks. A stall sweep also flags sessions that have gone quiet, so a wedged agent surfaces on its own.
Launch from any project, working directory and model. A short preamble tells the agent where it is and to read the local AGENTS.md / CLAUDE.md — it arrives oriented instead of asking for a tour. Optional starting prompt.
Per‑session totals roll into account analytics: daily stacked bars by agent, totals by model and project. Tokens attribute to the day they were generated. Live 5‑hour quota windows for Claude and Codex.
Not just an inventory viewer.
The buttons actually do things.
Deploy, provision, run, schedule and roll back from one pane. Everything streams live; everything lands in the job log; everything can be put on a cron.
Push a Dockerfile or Compose file. Traefik routes, Let's Encrypt certs and DNS records get wired up automatically, with rollback to the last green SHA baked in.
Hand nsbd an IP. The Ansible playbook installs the Go host agent, registers the box and joins your inventory.
Edit, run and version playbooks against any host, group or tag — and chain them into Runbooks. Live output streams into the job log.
Compose Runbooks into a drag‑and‑drop canvas. Branch, parallelise, wait for approval, retry — a real DAG, not YAML stapled together.
Declarative cloud resources with state held in your own Postgres via a built‑in HTTP backend. No Terraform Cloud, no S3 + DynamoDB.
Every long‑running operation streams stdout/stderr over WebSocket and lands in a unified Postgres‑backed job history.
Backups, playbooks, deploys, custom scripts — schedule any job on a cron and get a Discord ping on failure.
Open a tmux session on any managed host straight from a tab — including the one your Claude, Codex or Gemini CLI is running inside. Pull‑down Quake terminal on every page.
A real DAG.
Not YAML stapled together.
Compose playbooks, runbooks, deploys and arbitrary shell into a drag‑and‑drop canvas. Branch on success or failure, parallelise, wait for human approval, retry. Each node streams its output into the unified job log; the whole pipeline is one row in the queue.
- 12:04:01trigger · git push origin master
- 12:04:03build · docker build -t trussbridges:8c01c72
- 12:04:11test · 342 passed · 0 failed · 14.2s
- 12:04:25deploy-staging · container up · traefik route bound
- 12:04:30healthcheck · GET /healthz · 200 · 3/3
- 12:04:30approve · waiting on @mikeroq
- —deploy-prod · queued · gated on approval
- —notify · discord #ops-deploys
Connect once. Sync forever.
Drop in an API key — nsbd handles the rest. Resources show up in inventory, can be grouped into Projects, and the credentials never leave your encrypted Postgres.
Inventory VMs, snapshots, regions, billing. Restart, destroy, attach storage.
Sync repos, branches, commits and webhooks. Wire deploy triggers without leaving the dashboard.
Registrar metadata, nameservers, transfer + renewal status, contact records.
Create and update DNS records — auto‑wired when you bind a domain to a service.
Read existing projects + deploys for context. You can keep using these — nsbd surfaces them, doesn't replace them.
Bring your own host: provision over SSH and nsbd runs Docker / Compose on it directly. This is where containerised deploys actually land.
Sync managed DBs, connection strings, plans and backup status — or provision Postgres / MySQL / Redis / SQLite on a managed host yourself.
List buckets, generate presigned uploads, manage CORS + lifecycle policies.
Power without lock‑in.
Built for operators who'd build this themselves —
if they had the weekends.
- Postgresstate · jobs · secrets
- DeployerGo · SQLite · rollback
- Host poolWS fan‑out
An Express dashboard, a Go host agent on every box and a Go deployer that owns rollbacks. Three small services, one Postgres, no orchestration framework.
Runs on any Ubuntu or Debian box behind your own Traefik. No SaaS dependency, no phone home, no telemetry.
All state — inventory, jobs, secrets, deploy history, Terraform state — lives in a Postgres database you own. Bring your own RDS or run the bundled one.
Provider API keys, SSH keypairs and per‑service env vars are sealed with a master key you supply. Injected into containers at deploy time, never logged.
Reach private hosts over your tailnet without exposing them publicly. The host agent listens on the interface you tell it to — pair it with Tailscale and you're done.
Every push is a fast‑forward‑only merge, build, restart, healthcheck — and auto‑rollback to the last green SHA on failure. Per‑deploy stdout/stderr tails live in a local SQLite store.
Bind a domain to a service and the DNS record gets created at your registrar and a Traefik route + Let's Encrypt cert gets wired up. No YAML to write.
Run Terraform with state stored in your own Postgres over a built‑in HTTP backend. No Terraform Cloud, no S3 + DynamoDB dance.
Deploys, playbooks, runbooks, terraform and backups all land in one job queue with live WebSocket tails, retries and a permanent history.
Bundled backup system on top of restic. Schedule snapshots of databases, volumes and home directories — cron‑gated, alert on failure.
Spin up Postgres, MySQL, Redis or SQLite on a managed host with users, roles, TLS, external ingress and restic backups configured.
The Go host agent runs on every managed box and holds a persistent WebSocket to the dashboard. System metrics, Docker, tmux and deploys streamed in real time.
Editable Ansible playbooks, chainable runbooks and a drag‑and‑drop pipeline canvas. Each step streams to the job log; failures pause for approval.
Failures fan out to Discord webhooks. Every action that the UI does is also available as an authenticated HTTP API with an in‑dashboard Scalar reference.
Monaco code editor and MDX wiki built in. The runbooks you keep meaning to write down, finally linked from every host, project and job.
Shipping in the open.
Steered by what operators actually do every Tuesday.
- Multi‑host fleet
Go host agent on every box, persistent WS pool, one‑command SSH provisioning.
- Database engine provisioner
Spin up Postgres / MySQL / Redis / SQLite with users, roles, TLS and ingress.
- Auto‑DNS + Traefik
Bind a domain to a service; DNS + Traefik route + Let's Encrypt cert wire up.
- Restic backups
Scheduled snapshots of databases, volumes and home directories with retention.
- HTTP Terraform state backend
Terraform with state in your own Postgres. No Terraform Cloud, no S3 + DynamoDB.
- Pipeline canvas
Drag‑and‑drop runbook DAG built on xyflow with approval gates and retries.
- Deployer with rollback
FF‑only merges, healthchecks, auto‑rollback to the last green SHA, SQLite audit trail.
- OAuth SSO + RBAC
Single‑user mode out of the box; add an OAuth provider for teams with per‑route permissions.
- Quake terminal + agent sessions
Pull‑down tmux on every page with Claude / Codex / Gemini state pills.
- Postgres‑backed job queue
Deploys, playbooks, runbooks, terraform and backups in one queue with live tails.
- Kubernetes provider
Deploy to existing clusters; sync namespaces, workloads and ingresses.
- More cloud providers
DigitalOcean, Linode and Scaleway. The adapter API stays small — PRs welcome.
- Fleet‑wide search
⌘K across every host, service, secret reference and job log.
- Pipeline host scoping
Deploy individual pipeline steps to specific hosts or host groups.
- Scheduled pipeline runs
Crontab any pipeline directly from the canvas; Discord on failure.
- Public API tokens
Scoped tokens for the existing HTTP API + a Scalar reference built in.
Frequently asked,
quickly answered.
How is this different from Coolify, Portainer or Dokku?+
Is the source available?+
Does it phone home?+
Where do my secrets live?+
Does it support SSO?+
What if my provider isn't supported?+
Do I need a domain?+
Can I bring my own Postgres?+
What's the minimum spec to self‑host?+
How do updates work?+
Can multiple people use it?+
Does it work with Tailscale?+
The dashboard you'd build for yourself.
Now you don't have to.
A Node/Express dashboard, a Go host agent and a Go deployer — all backed by your own Postgres. Three systemd units, no SaaS in the loop, no phone home.