poc-embedded-terminal

POC: a browser terminal (ghostty-web) into docker "machines", with SSH authorized exclusively by Vault-signed OpenSSH certificates.

Run

docker compose up -d --build

Open http://localhost:5173, pick a machine, Connect.

API

• GET localhost:8080/api/machines — list ssh targets
• GET localhost:8080/api/sessions — list active terminal sessions
• DELETE localhost:8080/api/sessions/{id} — kill a session (tmux teardown + disconnect)

Notable behaviors

• Shell state survives backend restarts (tmux on target + auto-reconnect).
• Targets have no authorized_keys: auth is cert-only, CA fetched from Vault at boot.
• Design: docs/superpowers/specs/2026-06-06-embedded-terminal-poc-design.md