SELF-HOSTED / OPEN SOURCE / MIT

Your infrastructure.
One browser tab.

A terminal on every machine you own. Reach your servers, home lab, and Raspberry Pis from any browser. Your machines. Your control plane.

Deploy Spectre Explore the source

Docker ComposeOutbound-only agentstmux persistence

homelab-nuc — browser terminal

CONNECTED WSS / tmux

root@homelab-nuc ~ # docker ps

NAMES STATUS
app-web Up 3 hours
app-database Up 3 hours
app-grafana Up 2 days

root@homelab-nuc ~ # uname -sm
Linux x86_64

root@homelab-nuc ~ # ▊

SMALL STACK. FULL ACCESS.Go agentWebSocketsNode.jsSQLiteReact + xterm.js

BOOTSTRAP / CONNECT / OPERATE

From fresh host to first shell.

A straightforward install, with the moving parts explained. Know what runs before you run it.

Deploy the control plane

Three containers. One published port. Start with the supplied Docker Compose stack.

Install Spectre

Bring a machine online

Install the Go agent, approve its enrollment, and let it dial out. No inbound port required.

Enroll an agent

Make it production-ready

Terminate TLS, protect your admin password, back up state, and own the trust boundary.

Read the runbook

THE VIEW FROM YOUR BROWSER

Meet your machines.

See connected agents, host information, and Docker containers. Choose a machine and open a terminal.

Spectre control panel showing an enrolled homelab NUC, system and network information, Docker containers, and connection status. — The self-hosted dashboard. Your hosts and container details stay on your infrastructure.

UNDER THE HOOD

One public endpoint.
Agents dial out.

The proxy sends /api/* to the control server and serves the UI on the same origin. Each enrolled agent connects outbound using its own device key.

Trace the connection

BrowserHTTPS / ticket auth

↔

Reverse proxyTLS / one port

←

Go agentWSS / device key

/api/* → control server + SQLite/* → static web UI

No listening port on the agent host

Works behind your firewall

Agents initiate outbound WebSocket connections. Reach your home lab, VPS, or Pi without opening a port on the target.

Pick up where you left off

With tmux installed, your session survives a disconnect. Close the tab on your phone. Reattach from your laptop.

A small, inspectable stack

A Go agent, a TypeScript server, a React UI, and SQLite. Read the source, build the binaries, and run it yourself.

WITH ROOT ACCESS COMES RESPONSIBILITY

Your bastion.
Your trust boundary.

One admin password grants shell access to every enrolled machine. Use TLS, protect credentials, and revoke machines you no longer own.

Production checklist Upgrades & backups Connection troubleshooting Configuration & API

BUILT IN THE OPEN

Read it. Run it. Make it yours.

Spin up the development stack, inspect the wire protocol, or send your first contribution.

Start developing Browse the docs

Your infrastructure.One browser tab.