🐳
Docker
Containers
Container runtime and CLI from Docker's official apt repository, including Buildx and Compose plugins.
sshwiz turns server setup into a shelf you pick from. Save an encrypted profile, choose Docker, Nginx, Certbot or a pinned Node version, read the exact commands it's about to run — then watch them stream back in a live terminal. No copy-pasted gist, no half-remembered apt incantation.
Free during the Phase 1 preview · macOS, Linux and Windows · your keys never leave your machine
Container runtime and CLI from Docker's official apt repository, including Buildx and Compose plugins.
Installs a pinned major of Node.js (20.x by default) with npm from the official NodeSource repository.
The Let's Encrypt ACME client for obtaining and automatically renewing free TLS certificates.
High-performance web server and reverse proxy.
Define check / install / verify once and reuse it anywhere.
Share recipes with the team using the { } badge on any card.
What you get
The boring, error-prone middle of server setup — done once, properly, and reusable.
Hosts, keys and passphrases live in a single AES-256-GCM file on your machine, with the encryption key held in the OS keychain. The profile stores the path to your key, not a copy of it — and ~/.ssh/config imports in one click.
Docker, Nginx, Certbot, MongoDB, git, pinned Node.js and Python versions. Every recipe is the same three steps — check, install, verify — so a second run is a no-op instead of a disaster.
The install review lists every command, in order, for the exact box you're pointed at. Nothing touches the server until you press Install — then the output streams back live.
Pick your targets and send the same shelf to every server you've saved. Staging and production stop drifting apart because they were built from the same list.
Turn a shell script into a form: labelled fields, selects, defaults, and secret values that arrive as shell variables instead of sitting in your history.
The Market tab lists everything published to the catalog. Copy an item into your local Shelf and it keeps working offline — installed content is yours, not a remote lookup.
How it works
Add a profile — key file, password or a pasted key — or import your whole ~/.ssh/config. The sudo password is optional, and when you set one it's fed over stdin, never on a command line where ps could read it.
Tick the packages and scripts you want. Pull more from the Market tab, write your own with Custom recipe, or paste one a teammate exported as JSON.
Read the install review, choose your targets, press Install. Every line of output — checks, installs, verifications — streams into the terminal panel as it happens.
The shelf
A recipe carries a separate command list per distro family, so the card you click is the same whether the box underneath is Ubuntu, Fedora or Alpine.
{
"check": ["command -v docker"],
"install": [
"sudo install -m 0755 -d /etc/apt/keyrings",
"sudo apt-get update -y",
"sudo apt-get install -y docker-ce …"
],
"verify": ["docker --version"]
}# everything published, as JSON
curl -H "Authorization: Bearer $SSHWIZ_KEY" \
https://sshwiz.app/api/marketplace
# just the Ubuntu/Debian packages
curl -H "Authorization: Bearer $SSHWIZ_KEY" \
https://sshwiz.app/api/marketplace/packages?family=ubuntu
# one script by id
curl -H "Authorization: Bearer $SSHWIZ_KEY" \
https://sshwiz.app/api/marketplace/scripts/harden-sshMarketplace & AI assist
The AI assist panel's Recipe mode drafts the check / install / verify commands for whatever you ask for, per distro family, ready to review and edit before it ever runs.
localhost:11434.Trust
sshwiz is a desktop app that speaks SSH directly. There is no relay, no agent to install on the server, and nothing to sync.
Profiles are stored in a local AES-256-GCM file. The encryption key never leaves the OS keychain.
The sudo password is piped to sudo -S — never interpolated into a command line, never in shell history, never visible to ps.
Every command is listed in the install review first, and every byte of output comes back to the terminal panel. No hidden steps.
Coming with Pro
Provisioning is step one. These tabs turn the same connection into day-two operations — in preview now, and included for everyone who joins during Phase 1.
Questions
No. It opens a normal SSH session and runs the same commands you would have typed. There is no daemon, no agent and nothing left behind — uninstalling sshwiz changes nothing on the box.
On your machine only. Profiles are written to a local file encrypted with AES-256-GCM whose key sits in the OS keychain, and a key-file profile stores the path — your private key stays where it already was.
Nothing bad. Every recipe starts with a check step; if the package is already there, the install is skipped and the verify step still confirms it's healthy.
Yes — write one with Custom recipe, then use the { } badge on any card to export it as JSON. Teammates paste it straight into their own Shelf, or you can publish it to the marketplace for everyone. The authoring guide covers what makes a good one.
Whichever you bring. It speaks to Anthropic, OpenAI, or any OpenAI-compatible endpoint — including a local Ollama instance if you would rather nothing left the building.
Get started
Free through the Phase 1 preview. Install it, point it at a box you were going to set up by hand anyway, and see how far the shelf gets you.
Prefer to look around first? Read the authoring guide to see exactly what a recipe is made of.