Self-hosted apt fleet manager — one dashboard, every server, real terminal output.
A focused alternative to AWX / Ansible Tower for Ubuntu, Debian, Raspbian, and Proxmox fleets.

📐 Architecture · 🔒 Security · 📋 Changelog · 📦 Releases

🤖 This project was entirely written by Claude (Anthropic's AI assistant) via Claude Code. All code, configuration, and documentation — from the FastAPI backend and asyncssh integration to the React frontend and Docker setup — was generated through an iterative, conversation-driven development process with no manual coding.

The fleet is the unit, not the host. Most apt UIs are per-server. apt-ui treats your Ubuntu / Debian / Raspbian / Proxmox fleet as one thing — Check All, Upgrade All, Reboot All, Autoremove All all multiplexed into one terminal stream with per-server filter chips and live status. No more SSH'ing to twelve boxes to roll a security patch.

One container, zero agents. Single Docker image (under 250 MB). Talks to managed servers over plain SSH — no daemons on the targets, no message bus, no Postgres, no Redis. The whole control plane is FastAPI + SQLite + APScheduler, designed to run on a Pi 4 and manage 50 servers comfortably.

Built for staged rollouts. Tag servers with ring:test / ring:prod and auto-upgrade promotes through them in alphabetical ring order, aborting the rollout if any host fails. Maintenance windows block scheduled work outside approved hours. Pre/post-upgrade hooks let you take a BTRFS / ZFS snapshot first. Rolling reboot orchestrates kernel reboots in batches with reachability checks between them.

Security-aware, not just scheduling. A daily CVE matcher annotates every pending package with USN / CVE-IDs sourced from the Ubuntu USN database. The fleet-wide CVE inventory pivots that data into "which hosts are exposed to CVE-2025-XXXXX." A Prometheus /metrics endpoint feeds Grafana. Notifications cover daily summaries, weekly digests, security alerts, and reboot-required events across email / Telegram / Slack / webhook. Auth includes TOTP 2FA, scrypt-hashed API tokens, and admin / read-only RBAC.

One single-container control plane for an apt fleet — fleet-wide actions, scheduled automation, security visibility, and integrations to keep it honest.

Each managed server gets its own page with tabs:

Packages · Upgrade · Health · Apt Repos · dpkg Log · History · Stats · Shell

⚠️ Requires Docker + Docker Compose v2 and SSH access to the target servers.

cat > .env <<EOF
SSH_PRIVATE_KEY="$(cat ~/.ssh/id_ed25519)"

# Optional but recommended — fixes JWT secret so sessions survive restarts
JWT_SECRET=$(openssl rand -hex 32)

# Optional overrides
# TZ=America/Montreal
# LOG_LEVEL=INFO
EOF

The key must be inside double quotes with literal newlines preserved (the heredoc above handles this).

docker compose -f docker-compose.ghcr.yml up -d

To pin to a specific release instead of latest, edit docker-compose.ghcr.yml and change the image tag, e.g. ghcr.io/mzac/apt-ui:2026.05.01-03.

./build-run.sh

The app will be available at http://localhost:8111.

Default login: admin / admin — change this immediately via Settings → Account.

Two approaches. Pick whichever fits your setup.

If root has a password set the account is active and you can add your public key:

# Run on each managed server
sudo mkdir -p /root/.ssh
sudo cat ~/.ssh/id_ed25519.pub >> /root/.ssh/authorized_keys
sudo chmod 600 /root/.ssh/authorized_keys

Then set username = root when adding each server in the dashboard. No sudo configuration required.

# Run on each managed server
echo  Read the rest on GitHub