poim v1.4 - stable

Manage every VPS from one terminal

poim gives a growing fleet one control surface. A small agent enrols each VPS once, and from then on every host answers to the same commands: poim vps list, poim tail, poim deploy. No SSH tunnels, no per-host credential files, no dashboard clicking.

Install

curl -sSL https://poim-5vk.pages.dev/install | bash

Download Read the docs

Linux, macOS, Windows, Termux Single static binary Apache-2.0 No telemetry

zsh - fleet

$ poim vps list --group production
NAME          GROUP        PLAN     CPU   MEM    UPTIME     STATUS
web-01        production   2c/4g     8%    31%   41d 03h    online
web-02        production   2c/4g     6%    28%   41d 03h    online
api-01        production   4c/8g    22%    57%   12d 18h    online
db-01         production   8c/32g   74%    82%    2d 07h    degraded
mail-01       production   1c/1g     3%    18%   96d 21h    online

$ poim tail db-01 --since 10m --grep slow
10:42:11 [warn] checkpoint 18422 took 41.2s
10:42:53 [warn] checkpoint 18423 took 39.8s
10:43:30 [warn] checkpoint 18424 took 44.1s

$ poim rollout status --watch
[OK] 5 of 5 hosts on build 2026.09.3

What you get

Built for the awkward parts of running a fleet

The pieces that usually break first: onboarding a new box, knowing what it is doing, finding the one host that is not answering, and proving who changed what.

Terminal first

Every capability in the panel exists as a command with the same flags, so scripts and shell history stay useful. Output switches between a table, JSON and a quiet single value for piping.

Fleet inventory

Hosts, groups, tags, plan sizes and enrolment state in one table. Filter by anything you have tagged, then act on the result rather than on a host list you keep by hand.

One relay, many agents

Agents dial out through a single authenticated relay over WebSocket. Hosts sit behind NAT and private networks without opening a single inbound port.

Least privilege by default

The panel stores no VPS credentials. Each agent enrols with a single-use code, pins the relay certificate, and receives only the scope you grant it.

Tokens and two factor

Argon2id password hashing with a per-user cost policy, TOTP with encrypted secrets, hashed refresh tokens, and API tokens that are shown exactly once and stored only as a SHA-256 digest.

Metrics and alert rules

CPU, memory, disk and load samples stream from every agent. Thresholds become alert rules, alert rules become notifications, and the whole history is queryable from the CLI.

A panel when you want one

The same backend powers a browser dashboard for the times you are not in a terminal: fleet health, alert rules, notification channels and the audit log.

Reproducible builds

Tagged releases, published checksums for every artefact, and Go modules you can pin with go install if you would rather build the CLI yourself.

Nothing phoned home

No telemetry, no usage reporting, no crash upload. The agent and the CLI talk to your relay and to the API, and to nothing else.

Architecture

Four layers, one narrow waist

Everything a command needs travels the same path: your prompt, the CLI, the relay, and the agent that actually touches the machine.

Browser The optional panel. Same API as the CLI, for when you are not in a shell.
Terminal CLI Holds your session or API token. Signs every request and renders every response.
Panel Relay Authenticates agents, matches commands to hosts and streams output back in order.
Agent on customer VPS Dials out, never in. Runs the command, streams stdout and stderr, then exits.

How it works

From zero to a managed fleet in four steps

Nothing here needs a dashboard account or a support ticket.

Install the CLI

One static binary, no runtime to install. The installer picks the right archive for your architecture and puts it on your path.
```
curl -sSL https://poim-5vk.pages.dev/install | bash
```
Sign in

The device flow prints a short code and opens your browser. It works over SSH on a headless box, which is where you usually need it.
```
poim login --relay https://relay.poim-5vk.pages.dev
```
Enrol a VPS

Create a one-time enrolment code, paste it on the host, and the agent registers itself. The code is consumed on first use.
```
poim enrol create --group production
poim enrol run --code poim_enrol_... --name web-01
```
Drive the fleet

From now on the host is addressable. Target a group, a tag, or one named machine, and the same commands keep working.
```
poim vps list
poim exec web-01 -- systemctl restart nginx
poim rollout status --watch
```

Questions

Before you install

The short answers. Longer versions live in the documentation.

Do I have to keep SSH open?

No. The agent opens an outbound WebSocket to the relay and holds it. Your servers do not need a public IP, a forwarded port, or an inbound firewall rule for poim.

Where are my VPS credentials stored?

Nowhere. The panel stores opaque enrolment codes and the agent public key used for TLS pinning. Your agent holds nothing that could be replayed against the panel, and we never see a root password or an SSH key.

What does the agent do when I am not looking?

It samples CPU, memory, disk and load on a schedule, holds the relay connection open, and applies whatever alert and maintenance policy you configured. It does not execute anything on its own initiative.

Can I use an API token instead of a browser session?

Yes, and you should in CI. Tokens carry explicit scopes, are shown once at creation, and are stored only as a SHA-256 digest. Each distinct source IP seen for a token is recorded so a leak is visible in the audit log.

export POIM_TOKEN=poim_pat_...
poim vps list --format json | jq '.[].name'

What are the actual requirements?

Linux, macOS or Windows on the workstation, and a 64-bit Linux host with systemd for the agent. Roughly 18 MB of disk and under 12 MB of resident memory. Full details are on the download page.

Is there a self-hosted relay?

The relay is a Cloudflare Worker with Durable Objects for connection fan-out, and the panel API is a Worker against D1. Both are deployable from the source in this repository if you would rather run them inside your own account.

How do I remove it?

Detach the host from the panel, then run the uninstall script on the VPS. It stops and removes the agent unit and leaves the rest of the system alone.

curl -sSL https://poim-5vk.pages.dev/uninstall | bash

Does poim phone home?

No. There is no telemetry, no usage ping and no crash upload. The CLI and the agent talk to your relay and the API, and to nothing else. The panel is static assets, so the marketing site itself is just files.

Ready when you are

One command, one static binary, no runtime to manage. Read the docs first if you like, or skip straight to the download page.

Download Read the docs Status