01
Observe the host
Live and historical CPU, memory, load, network, and root-disk views, sampled from the machine itself.
Self-hosted Linux control plane
Your whole host.
One calm deck.
ServerDeck brings Incus, Docker, storage, networking, updates, and systemd into one local-first control surface. It runs on the machine itself, signs in with the accounts already on that machine, and keeps privileged actions on a short, audited leash.
- Linux x86_64
- Self-contained runtime
- MIT-licensed source
serverdeck
/
this-host
local
Host control
Every layer,
within reach.
PAM
within reach.
$ curl -fsSL https://serverdeck.black.ax/install.sh | sh
Root actions
Allow-listed helper
Explore what’s inside
Linux / x86_64 · systemd · PAM
01
The control surface
Everything that matters.
Nothing that doesn’t.
The day-to-day shape of a Linux host, without the tab sprawl. ServerDeck reads the machine directly and gives the boring parts a consistent, deliberate interface.
02
Operate workloads
Incus containers and VMs, Docker containers, and systemd services. Inspect, console, and act in place.
03
Mind the storage
Disks, ZFS pools and datasets, SMART health, backups, and snapshots with retention controls in one place.
04
See the network
Interfaces, routes, DNS, and firewall state. Make firewall changes through the same audited path as everything else.
05
Keep it current
APT, DNF/DNF5, and Pacman updates, reboot state, health checks, and notification routing without a cron spreadsheet.
06
Keep a record
Existing Linux accounts sign in through PAM. Roles stay simple, and privileged actions land in the audit log.
Works with
Incus
Docker
systemd
ZFS
SMART
Linux PAM
SQLite
FrankenPHP
02
Built for one machine
The host is the
source of truth.
There is no agent to deploy, no fleet to reconcile, and no second copy of your infrastructure to keep honest. ServerDeck lives on the host it describes.
-
Bundled runtime
FrankenPHP, a static PHP CLI, the host helper, and PAM tooling ship in the release. No system PHP, Node, nginx, or Composer required.
-
A narrow privileged path
The web process runs unprivileged. Root actions go through one no-argument sudo rule and a validated, allow-listed helper.
-
Your accounts, not another password
Authentication goes straight to Linux PAM. ServerDeck never stores application passwords.
Request path
Local host
01 / Browser
Host sign-in
Linux username and password, checked by PAM.
02 / FrankenPHP
Unprivileged web process
Reads host state and serves the panel.
03 / Host helper
Validated root actions
Allow-listed operations arrive as structured JSON.
04 / Linux
The machine itself
systemd, Incus, Docker, ZFS, and the filesystem.
Every privileged command is logged. Console output and keystrokes are not.
03
Get on deck
One command.
A deck on the other side.
Run this on the Linux host you want to manage. The bootstrap resolves the latest stable release, verifies its published SHA-256 checksum, and then starts the installer.
Terminal
SHA-256 verified
$ curl -fsSL https://serverdeck.black.ax/install.sh | sh
Runs with
sudo.
x86_64 Linux only.
-
01
Resolve the release
The latest stable tag is read from GitHub. No credentials needed.
-
02
Verify the archive
The tarball is checked against the release’s SHA-256 before extraction.
-
03
Install the deck
A self-contained release lands in
/opt/serverdeck, with systemd units and a CLI. -
04
Open your host
The installer prints the panel URL. Sign in with an existing Linux account that uses sudo.
Latest release
v0.1.0
Release notes
Useful installer options
--port 8443 changes the listener, --url sets the public URL, and --open-firewall opens the port in ufw or firewalld.
Upgrades keep your data
A newer release preserves configuration and state, backs up SQLite before migrations, and rolls back automatically if the health check fails.
Your host is already capable.