I wanted a Web bastion host years ago — to stop wrestling with servers and databases every day

I wanted a Web bastion host years ago — to stop wrestling with servers and databases every day

The annoying part of operations is not the commands. It is how scattered the entry points are. One SSH client, another database GUI, passwords sitting in notes or shared docs — and when something goes wrong, nobody can say who connected to which machine, and when. I wanted all of that in a single browser page: after login you can reach assets, edit files, query databases, and every session leaves a trail.

That is STARBUCKET CloudTerminal, part of the STARBUCKET family. Assets, credentials, SSH, databases, and session audit can all be managed online. No more installing a different client for every protocol.

What problem does it solve?

Traditional bastion hosts are heavy. Local tools are fragmented. CloudTerminal sits in the middle: one person or a small team can do daily ops in the browser, with access control and audit on top.

It mainly covers:

• Account login with admin / operator roles
• Asset types: SSH, MySQL / PostgreSQL / Redis / MongoDB
• Credential vault: AES-GCM on the server, no plaintext to the browser
• Per-user, per-asset authorization: connect, list files, upload, download
• Web SSH, plus SFTP to edit remote files
• Database Web GUI and Web CLI
• SSH session recording with compatible replay
• TOTP MFA, security alert email, probe-path IP bans
• Web asset health checks and reverse proxy
• User management

RDP / VNC, command filtering, and approval tickets come later. First: connect, change, and inspect with a clear trail.

What does the console look like?

What does the workspace look like?

Tech stack

Layer	Choice
Frontend	Vue 3 / Nuxt 3 / Tailwind
Terminal & editor	xterm.js, Monaco
Backend	Nitro (including WebSocket)
SSH / SFTP	ssh2
Data	MySQL + Drizzle
Validation	Zod

SSH does not poll over HTTP. Nitro WebSocket bridges the browser to the remote shell. Recordings are asciinema cast v2 JSON lines under .data/recordings/. Replay uses the same format, so exporting to a standard player later is straightforward.

Credentials never reach the frontend. The browser only says which credential to use. The server unwraps the password or key and hands it to SSH or the database driver. Secrets are encrypted with a master key using AES-GCM.

Sessions are HttpOnly cookies, 24 hours by default, with sliding renewal. Admins can enable TOTP so login requires a second MFA step.

Security I refused to treat as an add-on

If a bastion host is only “SSH in a webpage”, you just moved the risk. Security is a core part of the product.

Credentials are not downloaded. Being able to use a machine is not the same as copying the private key off it.

Permissions are split. Connect, list, upload, and download are separate. A read-only terminal and full SFTP are not the same switch.

Sessions can be replayed. SSH I/O goes into a recording. When something happens, watch the replay instead of relying on memory.

Logins and anomalies can notify. Failed logins, brute force, password changes, and user mutations land in security events. Admins can configure SMTP and get alerts by mail.

Probe paths get the IP banned. Scanning .env, .git, and similar paths bans a public IP for a while. A banned IP is rejected on any further request.

Who is it for?

• Small ops teams with many machines and databases
• Teams that do not want a local SSH config and database GUI for every colleague
• Anyone who needs operation logs: who connected, and to which host

Do not put CloudTerminal on the public internet as the only gate. It is a bastion layer. Put HTTPS, network isolation, and your own access control in front. The default admin exists only for bootstrap — change it as soon as you go live.