sudo systemctl restart nginxReloads nginx with the fixed config. About a second of downtime.
SSH with a guru on the line.
Tell it what's wrong. It looks, explains, and proposes one command at a time. Nothing runs until you click, and your keys never leave your browser.
- Keys encrypted in your browser
- Every command needs your click
- Free for 3 servers
Works whatever your server sits behind
- Home router
- Starlink or 5G
- Office firewall
- Phone hotspot
- Someone else's router
Three steps, then you're talking to it.
Add a serverHost, user, and a key or password. The key is encrypted in your browser with a passphrase we never see.
Say what's wrong"The site is slow." "Disk is full." The Guru looks first with read-only commands and tells you what it finds.
Tier 1 · changes state Approve, or don'tEach command arrives as a card with a risk tier set by fixed rules. Destructive ones make you type the hostname.
Bridges
A $5 board reaches everything behind your router.
Flash an ESP32-S3 from the browser and plug it in near the router. It dials out, so nothing changes on your router and nothing listens on your network. It only reaches the addresses you wrote to it over USB.
- No port forwarding, no VPN, works behind CGNAT
- Rules live on the board, changed only over the cable
- Unplug it and the way in is gone
What you need
Two parts, about fifteen minutes of setup.
SSH Guru flashes the board from your browser in about a minute. After that it only needs power near your router.
The bridge
ESP32-S3 SuperMini
- ESP32-S3
- USB-C
- Wi-Fi
- 4 MB flash
Any ESP32-S3 with native USB-C works: SuperMini, Zero, or the XIAO ESP32-S3, which adds PSRAM and an antenna connector.
For the setup
USB-C data cable
- USB-C
- data + charge
Needed once, to flash the board. A charge-only cable is the usual reason a board is not seen.
Watches new
It keeps an eye on things while you sleep.
Pick a check, pick a server. The Guru installs a small read-only watcher with one command you approve. It reports out on a schedule, and if something looks wrong, or the server goes quiet, you hear about it in Telegram.
- Disk space
- CPU, memory, load
- Failed logins
- Security updates
- Certificates
- AI log watch
- Docker health
- Backups fresh
SSH Guru still never holds a key. The watcher can only report; it takes no commands.
SSH Guru
web-01: disk / is at 91% and grew 6 GB since yesterday, mostly /var/log/journal.
Open watchesMute 24 h
03:12
Start free. Pay when it earns it.
Free
$0
- 3 servers
- 30 Guru messages a day on house models
- 3 watches
- 1 bridge
Pro
$9/month
- Unlimited servers and watches, down to every minute
- Your own AI: ChatGPT sign-in, API keys
- Read-only autopilot, runbooks, jump hosts
- AI log watch on the model you chose
- 5 bridges
Team
$29/month
- Everything in Pro for five people
- Audit log of every approval
- 25 bridges
Questions people ask first.
Can SSH Guru log in to my servers?
No. The SSH client runs inside your browser. The relay forwards encrypted bytes to your host and never holds a key, a password or a session. There is no path from our side into your machine.
What if I lose my vault passphrase?
Your saved keys and passwords are gone. We cannot recover them, because we never had them. Your server list, host-key pins and history stay. You add the secrets again.
Does the model see everything in my terminal?
It sees the output of the commands it proposed, after a secret scanner has replaced tokens, passwords and keys with placeholders. What you type yourself stays out unless you share it.
Can it reach servers on my home or office LAN?
Yes, with a bridge: a $5 ESP32-S3 board you flash from the browser. It dials out, so nothing is opened inbound, and it only dials the addresses and ports you wrote to it over the USB cable. The SSH session stays encrypted end to end.
How do watches work if you never log in?
The Guru proposes one command that installs a small read-only script and a timer on your server. It collects numbers, posts them to SSH Guru on a schedule and accepts nothing back. If a server stops reporting, that is the alert.
Can it work through a jump host?
Yes, on Pro. The client in your browser dials the bastion and opens the inner connection through it, so the jump host never sees your credentials for the target.
Is the ChatGPT sign-in allowed?
It uses the same device sign-in the Codex CLI uses, under your own subscription and limits. If that ever stops working, your own keys and the house models keep working.
