ServerDeck is a native macOS and iPadOS app that manages the Linux servers you already own — over SSH, with zero background processes left listening on the box.
macOS 14+iPadOSUbuntu LinuxSSHZero Panel Overhead
Overview
ServerDeck eliminates the need for heavyweight web hosting panels (such as cPanel, Plesk, or aaPanel) running constantly on your cloud instances or dedicated Linux servers. Instead, ServerDeck uses a lightweight, audited Go agent delivered dynamically over SSH. When you interact with the app, commands are executed on demand via secure short-lived agent invocations. When you close the app, nothing of ServerDeck's remains listening on your server — leaving 100% of your system resources available for your applications.
Zero-Daemon SafetyNo persistent HTTP/gRPC daemons or listening ports exposed on your server.
SHA-256 Agent IntegrityThe binary agent payload is verified against a hardcoded SHA-256 hash before running.
Audit TrailEvery state-altering operation logs to /var/log/serverdeck/audit.jsonl.
Features & Functions
SSH Connection & Authentication: Connect using standard password authentication or SSH private keys (RSA, Ed25519) stored safely in your device's native Apple Keychain.
Pinned Host Keys: On initial connection, ServerDeck records the server's SSH fingerprint. Future connections verify this fingerprint to protect against server spoofing or man-in-the-middle attacks.
Automated Agent Upload & Updates: ServerDeck uploads a minimal, dependency-free Linux binary over SSH. If the agent version drifts, ServerDeck automatically updates it seamlessly upon connection.
Non-Root / Root Execution: Standard operations run through bounded agent calls with strict parameter validation and base64url transits.
Server Reboot Safeguards: Issues a clean system reboot over SSH accompanied by safety confirmation dialogs detailing service impact.
Multi-Server Management: Seamlessly switch between multiple managed Linux servers from the sidebar navigation.
Security model. Nothing privileged listens on a managed server. Secrets you choose are sealed to the agent's X25519 key before transport, so they never appear in system process listings; database passwords are generated directly on the server. Secrets are held in the Apple Keychain, and every state-changing action is written to an immutable audit log at /var/log/serverdeck/audit.jsonl.
Manage
Overview
The server dashboard — real-time hardware metrics, resource counters, agent status, and security action items at a glance.
Overview
The Overview section serves as your central command deck for a selected server. It aggregates real-time hardware health metrics (CPU, RAM, Disk), inventory statistics across all hosted services, agent connection integrity, and action items that require administrative attention (such as available security upgrades).
Health RingsLive CPU, memory, and disk usage collected securely over SSH.
Quick StatsCounts of websites, databases, active TLS certificates, and pending updates.
Agent StatusGreen seal displaying active SSH transport, wire protocol, and agent build.
Needs AttentionAvailable system security patches and recommended maintenance tasks.
Features & Functions
Live Hardware Health Rings: Real-time visual monitoring of CPU load percentage, RAM utilization (including active swap), and primary disk storage usage.
Resource Counters: Instant summary of total active Websites, WordPress instances, Databases, SSL/TLS certificates, and package updates.
Agent Connection Seal: Displays the currently active agent version, wire protocol, and SSH session verification state. Offers 1-click agent repair/reinstall if anomalies occur.
Needs Attention Panel: Highlights pending OS security updates, outdated packages, or expiring certificates before they cause downtime.
Server Actions Menu: Perform server-level operations, such as triggering a clean server reboot directly from the top bar.
Offline servers tell the truth. If a server becomes unreachable, Overview displays the last verified metrics collected and explicitly marks the timestamp — it never displays "just now" for stale cache data.
Manage
Websites
Create, host, and manage Nginx and PHP-FPM websites or static sites — with Let's Encrypt SSL, staging clones, and single-file site transfers.
Overview
The Websites module provides end-to-end management for web applications hosted on your server. In a single automated step, ServerDeck creates the Nginx virtual host server block, provisions document roots under /var/www/<domain>, configures PHP-FPM process pools, provisions databases with generated credentials, and issues SSL certificates. Sites can be safely enabled, disabled, cloned to staging, exported into single-file archives, or imported onto new servers.
1-Step CreationNginx vhost, document root, PHP pool, database, and SSL created together.
Dynamic PHP SwitchChange a website's PHP runtime version on the fly without service interruption.
Clone to StagingReplicate files and database to a staging subdomain for safe testing.
Single-File ExportPackage site files, database, and vhost into a portable .sdsite bundle.
Features & Functions
Create a Website:
Site Type: Choose between a Static HTML site or a PHP Application (with your preferred PHP-FPM runtime version).
Canonical Domain Redirection: Select whether www.domain.com or the bare domain domain.com is canonical. ServerDeck automatically configures 301 redirects for the non-canonical variant.
Database Provisioning: Optionally generate a matching MariaDB/MySQL or PostgreSQL database and user with generated credentials delivered securely over stdin.
Automatic Let's Encrypt SSL: Requests and installs a valid TLS certificate with automated renewal schedules.
Enable / Disable Website: Toggle a site offline or online with one click. Disabling a site removes the Nginx sites-enabled symlink while preserving all site files, configuration, and database data intact.
PHP Version Switching: Rebind a site to any installed PHP version (e.g. PHP 8.1, 8.2, 8.3, 8.4) dynamically.
Open in Files: Jump directly to the website's root folder (/var/www/<domain>/public_html) in the built-in file manager.
Edit Nginx VHost Config: Inspect and modify raw Nginx server block configuration files directly within the code editor.
TLS Certificate Management: Issue, inspect, renew, or force-renew Let's Encrypt certificates (supports HTTP-01 and Cloudflare DNS-01 challenges).
Clone to Staging: Duplicate an existing website (files and database) to a staging domain (e.g., staging.example.com). Database credentials and site URLs are automatically updated.
Refresh Staging: Overwrite staging site data with current production files and database tables.
Export Website (.sdsite): Bundle the website's document root, database dump, and Nginx vhost into a single, compressed .sdsite archive for backup or server migration.
Import Website: Upload and extract a .sdsite archive to quickly restore or migrate a site onto any ServerDeck server.
Install, migrate, optimize, and secure WordPress — featuring FastCGI & Redis caching, Fail2ban login protection, and .wpress backup importing.
Overview
The WordPress module provides complete lifecycle management for WordPress installations without requiring you to log into wp-admin or install bloated third-party control panels. ServerDeck automates WordPress deployments, database wiring, core updates, sealed admin password resets, multi-tier caching (Nginx FastCGI page cache + Redis object cache), security hardening, and Fail2ban brute-force protection. Crucially, it supports importing both native .sdsite packages and .wpress archives created by the All-in-One WP Migration plugin.
.wpress & .sdsite ImportsImport backups from All-in-One WP Migration (.wpress) or native (.sdsite) archives.
Fail2ban Login ProtectionBlocks wp-login.php & XML-RPC brute force attempts with real visitor IP extraction behind CDNs.
Sealed Password ResetReset WP admin credentials safely without passing plaintext passwords on the command line.
Features & Functions
Install WordPress: 1-click wizard that downloads official WordPress core, provisions a dedicated MariaDB/MySQL database, sets up Nginx server blocks with SSL, and configures initial administrator account credentials.
Import WordPress Backups:
Native .sdsite Archives: Import full single-site archives exported directly from ServerDeck.
All-in-One WP Migration (.wpress) Archives: Import .wpress backup files directly. ServerDeck unpacks the archive, restores database tables, automatically rewrites database URLs to match the target domain, sets file permissions, and wires up Nginx.
WordPress Core Updates: Perform 1-click upgrades to the latest stable WordPress release with pre-update integrity checks.
Sealed Admin Password Reset: Reset passwords for any WordPress administrator account. New passwords are sealed to the server using X25519 encryption, ensuring plaintext credentials never appear in command line process listings (ps aux).
WordPress Settings & Configuration: Modify Site Title, Site URL, Home URL, Search Engine Visibility (discourage search engines), and WP Debug flags directly.
Multi-Layer Performance & Caching:
Nginx FastCGI Page Cache: Caches dynamic HTML output directly in Nginx for anonymous visitors, reducing server response times to single-digit milliseconds.
Redis Object Cache: Installs and configures the redis-cache drop-in plugin to store database queries in Redis memory. (Checks for existing drop-ins to prevent cache conflicts).
Static Asset Cache Headers: Configures long-lived HTTP caching headers for images, CSS, JavaScript, and web fonts.
Hardening & Security Shield:
Disable XML-RPC: Block XML-RPC endpoints to stop brute-force login attempts and pingback amplification DDoS attacks.
Disable File Editing: Enforces DISALLOW_FILE_EDIT in wp-config.php to prevent unauthorized plugin/theme file editing from inside wp-admin.
Disable Directory Listing: Prevents web visitors from browsing unindexed directory contents.
Protect wp-config.php: Denies web access to sensitive configuration files.
Fail2ban Login Protection: Deploys a dedicated Fail2ban jail monitoring wp-login.php and XML-RPC. It extracts real visitor IPs when behind CDNs (Cloudflare CF-Connecting-IP / X-Forwarded-For) and bans attackers at both UFW firewall and Nginx layers.
Staging & Maintenance: Clone WordPress sites to staging subdomains, refresh staging data from production, switch PHP runtime versions, edit vhost configurations, and export single-file .sdsite packages.
CDN-Aware Intrusion Prevention. ServerDeck's WordPress Fail2ban jail parses HTTP headers like CF-Connecting-IP and X-Forwarded-For. Attackers attempting brute-force logins behind Cloudflare or proxy networks are identified by their true origin IP and banned at the server firewall.
Deploy and manage Node.js applications behind Nginx reverse proxies, running as dedicated Systemd background services.
Overview
The Node Projects module allows you to deploy Node.js applications (such as Next.js, Express, NestJS, Remix, or Fastify) on your server. ServerDeck configures the application directory under /var/www/<domain>/app, sets up a dedicated Systemd service unit (node-<domain>.service) bound to an internal port, and configures Nginx as a reverse proxy with Let's Encrypt SSL/TLS certificates.
Systemd Service IntegrationApp runs as a managed system service that auto-restarts on server reboot or crash.
Nginx Reverse Proxy & SSLProxies external HTTP/HTTPS traffic to internal app ports with automatic TLS.
Redeploy & Code SyncPull new code, update npm dependencies, and restart services in one click.
Environment ManagerStore and edit environment variables securely per application.
Features & Functions
Deploy New Node Project:
Domain & Node Version: Select target domain name and installed Node.js runtime version.
Entry Point & Start Command: Specify start scripts (e.g. npm start, node server.js, pm2) and application entry directory.
Deploy Python WSGI/ASGI web applications (Django, Flask, FastAPI, FastHTML) behind Nginx with managed virtual environments.
Overview
The Python Projects module simplifies deploying Python web applications using frameworks like Django, Flask, FastAPI, or FastHTML. ServerDeck isolates application dependencies using Python virtual environments (venv), configures WSGI/ASGI application servers (Gunicorn, Uvicorn, Waitress), generates Systemd service units (python-<domain>.service), and configures Nginx reverse proxying with automatic SSL certificates.
Isolated VirtualenvAutomatic creation and maintenance of Python venv virtual environments.
WSGI / ASGI SupportCompatible with Gunicorn, Uvicorn, Waitress, and custom application runners.
Systemd SupervisionProcess supervision ensures applications restart automatically after failure or reboot.
Track domain names across your server, inspect SSL/TLS certificate health, and verify public IP reachability.
Overview
The Domains module acts as a server-wide registry for all domain names associated with your Websites, WordPress instances, Node apps, Python apps, and Mail services. It monitors SSL/TLS certificate expiration countdowns, checks DNS A/AAAA record resolution against your server's public IP address, and verifies web port responsiveness.
Global RegistryAggregates every domain configured across all services on the server.
TLS Health TrackingDisplays certificate issuer, validity state, and exact days until expiration.
Reachability CheckVerifies domain DNS resolves to your server's public IP (NAT-aware).
Cloudflare Auto-PointAutomatically updates A/AAAA records when Cloudflare API is connected.
Features & Functions
Domain Inventory Table: Overview of all configured domain names, site types, associated Nginx server blocks, and certificate statuses.
Public IP Reachability Check: Resolves domain DNS records and compares them to your server's public IPv4/IPv6 address. Accounts for cloud NAT gateways (AWS EC2, Google Cloud, DigitalOcean, Hetzner) so public IP detection is accurate.
Web Port Diagnostics: Probes ports 80 (HTTP) and 443 (HTTPS) to verify web servers are answering requests.
Automated Cloudflare DNS Pointing: If Cloudflare integration is active, 1-click action points domain A/AAAA records to your server IP automatically.
NAT & Cloud Address Awareness. Cloud servers frequently operate behind internal NAT IPs. ServerDeck maintains your verified public IP address rather than relying on local network interface addresses.
Create, inspect, and maintain MariaDB, MySQL, and PostgreSQL databases with zero clear-text password exposure.
Overview
The Databases module manages relational database engines (MariaDB, MySQL, and PostgreSQL) on your server. Databases and dedicated database users are provisioned securely. High-entropy passwords are generated directly on the server and piped over stdin, ensuring credentials never appear in command-line arguments or process listings (/proc).
MariaDB / MySQL & PostgresSupport for both MySQL/MariaDB and PostgreSQL database engines.
Zero-Exposure PasswordsPasswords generated on-server and piped via stdin, keeping /proc clean.
Database InspectorInspect database disk usage, table counts, row counts, and collation.
Dependency MappingIdentifies which websites and applications depend on each database.
Features & Functions
Create Database & User: Provision a new database alongside a dedicated database user. High-entropy passwords are generated on the server and displayed once.
Secure Stdin Credentials: Credentials are piped directly into database engines via stdin, protecting passwords from appearing in system process tables (ps aux) or shell logs.
Database Inspector: View total database disk consumption, table lists, row counts, character sets, and collation details.
Website Dependency Mapping: ServerDeck automatically inspects website configurations (e.g. wp-config.php, .env files) to display which hosted applications rely on each database.
Password Rotation: Instantly generate a new password for a database user. New credentials are returned once and never stored in clear-text.
Delete Database: Safely drop a database and remove its associated database user with confirmation prompts.
Credentials are never stored in clear-text. ServerDeck's stored metadata contains database names and usernames, but never database passwords.
Manage system packages, APT sources & PPAs, edit software configuration files, and run multiple PHP versions side by side.
Overview
The Software module handles system package management, APT repository sources, software configuration editing, and multi-PHP runtime lifecycle management. You can browse a curated catalogue of Linux server software, install or purge packages with dependency previews, manage third-party PPAs, edit configuration files (php.ini, nginx.conf, my.cnf, redis.conf), and toggle individual PHP extensions per installed version.
Curated Package CatalogBrowse and manage Web Servers, Databases, Caching, and Utilities.
Side-by-Side PHPInstall and run multiple PHP versions (PHP 8.1 - 8.4) simultaneously.
In-Place Config EditorEdit php.ini, nginx.conf, my.cnf, and redis.conf directly.
Features & Functions
Curated Software Catalogue: Browse installed and candidate packages categorized into Web Servers (Nginx), Databases (MariaDB, PostgreSQL), Caching (Redis), Runtimes (PHP, Node.js, Python), and System Tools (Git, UFW, Fail2ban, WireGuard).
Package Installation & Removal: Install new software or remove unwanted packages. Removals display dependency impact previews before execution.
Purge Engine for Removals: Removing software (such as a PHP version) purges orphaned package files from dpkg and cleans directory trees without affecting custom configuration files.
APT Repository & PPA Manager: Inspect configured APT sources (`/etc/apt/sources.list`), add or remove Personal Package Archives (PPAs), and enable/disable third-party repositories.
Side-by-Side Multi-PHP Runtimes: Install and run multiple PHP versions independently. Assign different websites to different PHP versions as needed.
PHP Extension Manager: Toggle individual PHP extensions (e.g. mysqli, gd, redis, imagick, curl, mbstring, opcache, zip) per PHP version with automatic service reloads.
Config File Editor: In-place code editor for core system configurations (php.ini, nginx.conf, my.cnf, redis.conf, postfix/main.cf, dovecot.conf).
Check for Package Updates: Run `apt update` to scan for updated package candidates across configured repositories.
Automatically size PHP-FPM, OPcache, Redis, and Nginx based on live server hardware metrics — with reversible 1-click rollback.
Overview
The Tuning module optimizes server performance by deriving configuration parameters directly from live hardware metrics — total and available RAM, CPU core count, average PHP worker memory consumption, site count, and active pool allocations. Sizing formulas scale dynamically from a 1 GB VPS to a 32+ GB bare-metal server. If applying a tuning configuration causes a service failure, ServerDeck can automatically roll back to the previous known-good state.
Hardware Sizing EngineDerives optimal settings from RAM, CPU cores, worker memory, and pool count.
Per-PHP Version SizingCalculates PHP-FPM pool limits per PHP version accounting for other pools.
OPcache & Redis TuningOptimizes OPcache memory/buffers and Redis maxmemory/eviction policies.
Reversible Rollback1-click rollback restores prior settings if services fail to respond.
Features & Functions
PHP-FPM Process Sizing: Calculates pm.max_children, pm.start_servers, pm.min_spare_servers, pm.max_spare_servers, and pm.max_requests per installed PHP version. Subtractions prevent overcommitting RAM across multiple PHP versions.
OPcache Optimization: Sizes opcache.memory_consumption, opcache.interned_strings_buffer, opcache.max_accelerated_files, and file cache settings based on site codebases.
Redis Configuration Tuning: Configures maxmemory allocation based on available RAM and sets eviction policies (allkeys-lru).
Nginx Parameter Optimization: Tunes worker processes, connection limits, keepalive timeouts, client body buffers, and compression.
Side-by-Side Comparison: Displays current configuration vs recommended values before applying changes.
Safe Apply & Automatic Rollback: Applies settings and verifies service health over SSH. If a service stops responding, ServerDeck instantly rolls back to the previous configuration.
Per PHP version isolation. Each installed PHP version is sized independently while taking into account memory promised to other active PHP pools, ensuring total system memory is never overcommitted.
Operate
WireGuard
Provision a private, high-performance WireGuard VPN server in seconds and connect devices via instant QR code scanning.
Overview
The WireGuard module allows you to establish a secure, encrypted VPN tunnel directly into your server. ServerDeck installs the WireGuard daemon, generates cryptographically strong server/client keypairs (stored under root-only protected files at /etc/wireguard/), opens necessary UDP firewall ports, and generates ready-to-use device configuration profiles and interactive QR codes.
1-Tap SetupInstalls WireGuard, generates keys, and configures internal subnets automatically.
Instant QR CodeScan generated QR codes straight into WireGuard apps on iPad, Mac, or mobile.
Device Peer ManagerAdd and remove device profiles (Mac, iPad, iPhone, Android, PC) by name.
Root-Only Key SecurityKeypairs stored under strict 0600 permissions accessible only to root.
Features & Functions
Automated WireGuard Server Provisioning: Installs wireguard and resolvconf packages, generates server keypairs, and configures the internal VPN subnet (10.8.0.0/24).
Firewall Integration: Automatically opens the designated WireGuard UDP listening port in the UFW firewall.
Add Device / Peer: Generate a new device configuration by providing a friendly name (e.g., "Shady's MacBook Pro", "Work iPad").
Interactive QR Code Display: Displays a high-resolution QR code on screen for immediate scanning into the official WireGuard app on iOS, iPadOS, or Android.
Download Client Profile: Export raw .conf client configuration files to import into desktop WireGuard clients.
Device Revocation & Server Teardown: Revoke individual device keys instantly or remove the WireGuard VPN infrastructure entirely.
Explicit protocol naming. This section is named WireGuard to clearly identify the underlying modern VPN protocol used for client connections.
Operate
Email
Full mail server stack (Postfix & Dovecot) featuring virtual mailboxes, DKIM signing, TLS, and a deep Deliverability Diagnostic engine.
Overview
The Email module turns your Linux server into a production-grade mail server powered by Postfix (SMTP) and Dovecot (IMAP). It manages virtual mail domains, mailboxes, forwarders, catch-alls, DKIM signatures, and TLS certificates. Crucially, it includes an advanced Deliverability Diagnostic engine that pinpoints exactly why mail fails to reach recipients — checking DNS records, Reverse DNS (PTR), and outbound port 25 blocking by cloud providers.
Postfix & Dovecot StackFull SMTP and IMAP mail server stack with virtual mailbox support.
Deliverability DiagnosticDeep inspection of MX, SPF, DKIM, DMARC, Reverse DNS PTR, and Port 25.
2048-bit DKIM & TLSAutomated DKIM signing keys and dedicated Let's Encrypt mail TLS certificates.
Built-in Webmail ReaderRead mail safely in-app with remote image blocking and strict HTML policies.
Features & Functions
Virtual Mail Domains & Hostnames: Configure mail domains with custom mail hostnames (e.g. mail.example.com).
Mailbox & Alias Management:
Virtual Mailboxes: Create email accounts ([email protected]) with quotas and secure passwords.
Domain Forwarders: Forward incoming mail to external addresses.
Catch-All Aliases: Route unhandled domain addresses to a designated fallback mailbox.
Account Access Control: Enable or disable accounts. Disabled accounts continue receiving incoming mail but are blocked from signing into IMAP/SMTP.
Authentication & Encryption:
DKIM Signing: Generates 2048-bit RSA DKIM keys and formats DNS TXT records for OpenDKIM.
Mail TLS Certificate: Obtains Let's Encrypt TLS certificates for the mail hostname to enforce STARTTLS.
Sealed Password Transport: Account passwords are sealed via X25519 in transit and stored hashed on disk.
Deliverability Diagnostic Engine:
DNS Record Validation: Verifies correctness of MX, SPF (v=spf1), DKIM, and DMARC (v=DMARC1) records.
Reverse DNS (PTR): Checks whether the server's public IP has matching Reverse DNS resolving back to your mail hostname.
Outbound Port 25 Probing: Tests if your cloud hosting provider blocks outbound SMTP traffic on port 25 (a silent cause of deliverability failure on AWS, DigitalOcean, and GCP).
Built-in Webmail Reader: Inspect incoming messages directly inside ServerDeck. Remote images are blocked by default to prevent tracking pixels, and message HTML executes under strict CSP with scripting disabled.
Manage DNS zones and records directly from the app, with automated Cloudflare integration and DNS-01 SSL challenge support.
Overview
The DNS module handles domain name resolution and integrates with Cloudflare to manage zones and DNS records without opening external browser dashboards. When Cloudflare is connected, ServerDeck automates pointing new websites to your server IP, solving DNS-01 challenges for wildcard SSL certificates, and provisioning complete mail DNS records.
Cloudflare IntegrationConnect API tokens stored in Keychain to manage zones and records.
Automated Site PointingAutomatically creates A/AAAA records when creating websites or projects.
DNS-01 ACME ChallengeIssues certificates for proxied sites or wildcards (*.example.com).
1-Click Mail RecordsProvisions MX, SPF, DKIM, and DMARC TXT records automatically.
Features & Functions
Cloudflare API Integration: Connect a Cloudflare API token (stored securely per server in the Apple Keychain) to manage DNS zones.
DNS Record Management: Create, view, edit, and delete A, AAAA, CNAME, TXT, MX, and SRV records.
Automated Website Pointing: When creating new websites or Node/Python projects, ServerDeck can automatically create matching A and AAAA records pointing to your server's public IP, proxied through Cloudflare.
DNS-01 Challenge Automation: Automatically publishes DNS TXT records to solve ACME DNS-01 challenges when issuing SSL certificates for domains behind Cloudflare proxies or requesting wildcard certificates (*.domain.com).
Automated Mail DNS Provisioning: 1-click generation and publication of mail records (MX, SPF, DKIM, DMARC TXT) to Cloudflare DNS.
Security Token Isolation. The DNS editing token resides exclusively in your device's Keychain. Tokens used by WordPress plugins for cache purging are separate, restricted-scope tokens — ensuring PHP scripts never hold DNS editing credentials.
Root-capable file manager and code editor for site document roots and system configuration, built with strict path safety.
Overview
The Files module is a built-in file manager and code editor designed for server administration. It allows you to navigate website document roots (/var/www/) and guarded system configuration areas (/etc/nginx, /etc/php, /etc/postfix, etc.). You can edit code in-place while preserving file permissions, upload files, compress and extract archives, batch-manage permissions/ownership, and restore deleted files from a server trash bin.
In-Place Code EditorEdit text and configuration files with syntax highlighting while preserving POSIX permissions.
Archive OperationsCompress files into .zip, .tar.gz, or .tar.bz2 archives and extract them in-place.
Batch File OperationsApply chmod permissions, chown ownership, or deletion across selections.
Manage Docker containers, images, and Compose stacks, and deploy containerized apps from an integrated catalogue.
Overview
The Containers module brings container management to your server. You can inspect running and stopped Docker containers, view live container logs, manage local Docker images, control Docker Compose projects (docker-compose.yml), and install pre-configured applications from a curated container app catalogue.
Container ControlsList, start, stop, restart, pause, and remove containers with resource stats.
Live Log StreamingInspect container stdout and stderr streams directly in the app.
Compose Stack ManagerDiscover, inspect, and manage Docker Compose stacks.
Container App CatalogueDeploy curated container apps (Redis, Postgres, Adminer, Plausible) in one click.
Features & Functions
Container Inventory & Resource Stats: Overview of active and stopped Docker containers displaying container IDs, images, uptime, CPU percentage, and RAM usage.
Live Container Logs: Stream real-time stdout and stderr output logs from any container.
Docker Image Manager: View local Docker images, inspect image tags and sizes, and prune unused dangling images.
Docker Compose Stacks: List and manage Docker Compose projects running on the host.
App Catalogue: 1-click deployment of pre-configured Docker applications (such as Redis, PostgreSQL, Adminer, Nginx Proxy Manager, Plausible Analytics, etc.) with sensible default port bindings and volume mounts.
If Docker is not yet installed on your server, install it from Software first.
Operate
Backups
Scheduled and manual site/server backups verified against SHA-256 checksums, with 1-click restore and off-server export.
Overview
The Backups module provides automated and manual backup creation, verification, and restoration for your server. Backups can be site-scoped (single site files + database) or server-scoped (all sites + server configurations). Crucially, every backup archive is verified against a SHA-256 checksum prior to restoration, ensuring corrupted files are detected before they can alter live data.
SHA-256 Integrity VerificationValidates backup checksums before restoring to prevent data corruption.
Automated SchedulingConfigure daily execution hours and retention pruning limits.
Archive Content PreviewInspect database dumps and file trees inside backup archives before restoring.
Off-Server ExportDownload backup bundles (.sdsite / .sdbackup) to local Mac or iPad storage.
Features & Functions
Automated Daily Backup Scheduler: Set a daily execution hour and maximum retention count. ServerDeck automatically prunes older backups beyond the retention limit.
Backup Scopes:
Site-Scoped Backup: Packages a single website's document root files and database dump.
Server-Scoped Backup: Packages all hosted websites, databases, Nginx configurations, and system settings.
SHA-256 Integrity Verification: Every backup is written with a SHA-256 checksum. Before any restoration, ServerDeck recalculates and verifies the archive checksum over SSH.
Archive Content Preview: Inspect the contents of a backup bundle (database SQL dumps, configuration manifests, file counts) before triggering a restore.
1-Click Restoration: Restore a site or server configuration state in a single action with automatic rollback safety checks.
Off-Server Archive Export: Download .sdsite or .sdbackup archives off the server directly to your local device storage.
Legacy Archive Compatibility: Pre-verification legacy backups remain listed and downloadable with clear diagnostic status notes.
Legacy archives stay visible. Pre-verification archives remain accessible for download, displaying explicit status messages if automated restoration is unavailable.
Operate
Disk Cleanup
Scan and reclaim disk space from APT caches, rotated logs, Docker resources, and interrupted operation staging.
Overview
The Disk Cleanup module scans your server to locate and reclaim wasted disk space before full disk utilization causes database crashes or server outages. It targets APT package caches, rotated log files, systemd journal logs, unused Docker resources, and leftover staging files from interrupted operations.
APT Cache & AutoremoveClears /var/cache/apt/archives and purges orphaned packages.
Docker System PruneReclaims space from stopped containers, unused networks, and dangling build cache.
Staging CleanupRemoves leftover temporary files from interrupted uploads or exports.
Features & Functions
APT Package Cache Reclamation: Scans `/var/cache/apt/archives` and identifies unused packages eligible for automatic removal (`apt autoremove`).
Log & Journal Trimming: Removes compressed, rotated historical log files (`*.gz`, `*.1`) and trims `systemd` journal logs while preserving active live log files.
Docker Resource Reclaim: Reclaims disk space by purging stopped containers, unreferenced networks, dangling Docker images, and build caches (`docker system prune`).
Interrupted Operation Staging Cleanup: Cleans temporary directories left behind by interrupted uploads, downloads, site clones, or backup exports.
Per-Category Space Previews: Displays exact reclaimable megabytes/gigabytes for each category before you confirm cleanup.
Automated Background Housekeeping: ServerDeck maintenance sweeps automatically clear staging files on schedule and before large operations.
Housekeeping runs automatically. Maintenance sweeps clear abandoned staging files before major operations, ensuring sufficient disk space is available when needed.
Operate
Cron
View and manage scheduled cron jobs across system crontabs, user crontabs, and isolated ServerDeck job files.
Overview
The Cron module provides system-wide visibility into scheduled cron tasks. It discovers jobs from /etc/crontab, /etc/cron.d/, and user crontabs (/var/spool/cron/crontabs/). ServerDeck isolates jobs you create inside dedicated files to prevent accidental modification of system tasks.
System-Wide DiscoveryAggregates jobs from /etc/crontab, /etc/cron.d, and user crontabs.
Syntax ValidationValidates minute, hour, day, month, and weekday syntax before writing.
Managed Job IsolationJobs created in ServerDeck are stored safely in /etc/cron.d/serverdeck.
Conflict DetectionWarns if crontab files were modified externally prior to saving edits.
Features & Functions
Crontab Discovery: Scans and aggregates scheduled jobs across system crontabs (/etc/crontab, /etc/cron.d/*) and individual user crontabs.
Job Parameter Display: Displays minute, hour, day of month, month, day of week schedule syntax alongside the target execution user and command line string.
Add Scheduled Job: Add new cron tasks with field-by-field validation of standard 5-part cron expressions.
Isolated Managed Jobs: Jobs created in ServerDeck are written to /etc/cron.d/serverdeck, ensuring custom jobs are clean to find and never overwrite OS crontabs.
Edit & Delete Managed Jobs: Modify or delete created scheduled tasks.
External Change Safety: If a crontab file is edited externally while loaded in ServerDeck, the app prompts you to refresh rather than overwriting changes blindly.
Managed jobs are kept apart. Jobs created in ServerDeck live in /etc/cron.d/serverdeck, making them easy to identify and safely delete.
Operate
Monitoring
Real-time and historical monitoring of CPU, memory, load average, disk I/O, network throughput, top processes, and listening ports.
Overview
The Monitoring module provides detailed insight into your server's live performance and historical trends. It measures CPU utilization (including iowait and hypervisor steal time), memory pressure, system load averages, disk I/O throughput, per-interface network bandwidth, top process consumption, and active listening network ports.
CPU BreakdownTracks overall CPU load, system/user usage, iowait latency, and steal time.
Memory & Load AveragesMonitors RAM/swap utilization and 1m/5m/15m load average trends.
Disk & Network ThroughputPer-filesystem I/O and network transfer rates per interface.
Processes & PortsTop CPU/RAM processes and active listening network sockets.
Features & Functions
Detailed CPU Metrics: Measures overall CPU busy percentage and breaks down user, system, iowait (disk bottleneck indicator), and steal time (hypervisor contention on shared cloud instances).
Memory & System Load: Real-time tracking of active RAM, buffers, cache, swap usage, and 1-minute, 5-minute, and 15-minute load averages.
Disk I/O & Network Throughput: Displays disk usage per filesystem, read/write I/O transfer rates, and network bandwidth (inbound/outbound bytes/sec) per interface (`eth0`, `wg0`, etc.).
Top Process Inspector: Real-time list of top server processes sorted by CPU and memory consumption.
Listening Ports Audit: Lists all open listening TCP and UDP sockets along with their bound process names and PIDs.
Resource Threshold Alerts: Flags visual warnings when disk storage, memory pressure, or iowait metrics exceed safe operating parameters.
Jail Management: Enable and tune Fail2ban jails for SSH, Nginx, WordPress, Postfix, and Dovecot services.
Banned IP Inspector: View active banned IP addresses per jail and unban IPs with 1 click.
Jail Tuning: Adjust max retry attempts, find time window, and ban duration parameters.
SSH Server Hardening:
Root Login Control: Permit or disable root SSH login (`PermitRootLogin`).
Password Authentication: Enable or disable SSH password authentication (`PasswordAuthentication`) to enforce SSH key-based authentication.
Pre-Flight Syntax Validation: Validates `sshd_config` syntax before restarting the SSH daemon to ensure invalid configurations never lock you out.
System Updates & Unattended Upgrades: Review available package security updates, apply updates, and toggle automatic OS unattended security updates (`unattended-upgrades`).
Inspect centralized systemd journal logs for any installed service or application without opening an SSH terminal.
Overview
The Logs module provides a quick, centralized log viewer for systemd services installed on your server. You can select any service (Nginx, PHP-FPM, MySQL, Postfix, Dovecot, Redis, WireGuard, Docker, Node/Python apps), set line limits, and read journal output directly within the app.
Service Log SelectorRead output from Nginx, PHP-FPM, MySQL, Postfix, Dovecot, Redis, and apps.
Configurable Line CountAdjust line buffer limits (50, 100, 500, 1000 lines) to pull relevant context.
Log Level FilterFilter log streams by severity (Info, Warning, Error).
Instant RefreshFetch live updated logs on demand over SSH.
Features & Functions
Installed Service Selector: Dropdown selector populating all installed system services (Nginx, PHP-FPM, MariaDB/MySQL, Postfix, Dovecot, Redis, WireGuard, Docker, Node/Python applications).
Line Buffer Adjustment: Select line depth (50, 100, 500, or 1000 lines) to retrieve shallow or deep log context.
Log Severity Filtering: Filter journal output by severity levels.
1-Click Refresh: Re-fetch live systemd journal entries over SSH without opening a command prompt.
For deeper terminal work, there's CMD. When you need to follow a log live (`tail -f`) or grep through multi-gigabyte log archives, open CMD — Logs is designed for rapid reading.
Operate
CMD — the terminal
Full interactive root shell with pseudo-terminal (PTY) allocation — enabling terminal tools like top, nano, vim, and mysql.
Overview
The CMD module provides an interactive terminal emulator inside ServerDeck. Unlike standard command execution channels, CMD allocates a real pseudo-terminal (PTY) over SSH. Interactive terminal programs (`top`, `htop`, `nano`, `vim`, `less`, `mysql` CLI, `tmux`) draw, resize, and respond to keyboard input as expected.
Real PTY AllocationAllocates a pseudo-terminal so interactive tools (nano, vim, top, mysql) work.
ANSI Colors & Window ResizingFull terminal emulation with color schemes, window resize, and copy/paste.
Audit Trail RecordingEvery opened CMD session logs an entry in /var/log/serverdeck/audit.jsonl.
Features & Functions
Pseudo-Terminal (PTY) Allocation: Spawns an interactive shell with true PTY allocation, allowing full-screen terminal programs like top, htop, nano, vim, less, and the mysql interactive prompt to render correctly.
Full Terminal Emulation: Renders ANSI color schemes, handles window size changes, supports text selection/copy/paste, and handles control key combinations (Ctrl, Alt, Esc, Arrow keys).
Session Per Server: Terminal sessions are tied to the selected server, ensuring switching servers opens a new shell context.
Safety Confirmation Gate: Gated behind an explicit confirmation dialog warning that CMD opens a direct root shell on your live server.
Audit Trail Logging: Opening a CMD session records an entry in the server's audit log at /var/log/serverdeck/audit.jsonl.
This is the deliberate exception. CMD is a root shell on a live server. It is the one place ServerDeck's strict validation doesn't restrict user input — so it is gated behind an explicit acknowledgement, and the server records every session opened in its audit log.