August 23, 2026

Termix: Terminal and Remote Desktop in the Browser

Termix centralizes SSH, RDP, and VNC in one web dashboard built on Apache Guacamole: multi-panel terminal, SFTP file manager, tunnels, and Docker management without a desktop client.

Managing a homelab usually means juggling tools: an SSH client on the laptop, an RDP app on the desktop, and a browser for admin panels. That falls apart when all you have is a tablet or someone else’s browser — no client installed. Termix exists to fix that: a self-hosted application that puts SSH, remote desktops, file transfer, tunnels, and Docker management into one browser dashboard.

Why Termix

The original need was simple: one place to open SSH terminals and remote desktop sessions from a browser, without local client software. Termix is an open source, self-hosted alternative to Termius, free with no subscription. Instead of maintaining several client applications, you get a single web UI for host profiles, saved credentials, and active sessions.

What sets it apart from a plain web SSH client: besides the terminal there is in-browser RDP, VNC, and Telnet, an SFTP file manager, local/remote/SOCKS SSH tunnels, and Docker and Podman container control. “Access from anywhere” becomes a browser tab, not an install.

Architecture: Termix + guacd

Termix does not speak remote desktop protocols itself. That part is delegated to guacd (Guacamole Daemon), the proxy from the Apache Guacamole project that translates native RDP/VNC/SSH protocols into HTML5/WebSocket streams:

  1. Termix Web UI/API: React interface for managing hosts, credentials, and sessions, running as a Node.js container.
  2. guacd (Guacamole Daemon): encodes native protocols into streams the browser can render.

The two talk over port 4822, guacd’s default port, configured through the GUACD_HOST and GUACD_PORT environment variables. Because of this split, only one HTTP port needs to be exposed; remote desktop traffic stays behind the scenes.

Deployment via Docker Compose

This Compose setup runs Termix alongside guacd. Termix is published on host port 8081, while guacd intentionally gets no host port mapping — the internal Docker network is enough:

services:
  guacd:
    image: apache/guacd:latest
    container_name: guacd
    restart: unless-stopped

  termix:
    image: ghcr.io/lukegus/termix:latest
    container_name: termix
    restart: unless-stopped
    ports:
      - "8081:8080"
    environment:
      - GUACD_HOST=guacd
      - GUACD_PORT=4822
    volumes:
      - ./termix-data:/app/data
    depends_on:
      - guacd

After docker compose up -d, the UI is reachable on the mapped port; the guided setup walks through presets, theme, and the first host. For production, pin :latest to a specific release such as :2.4.0 so new releases do not surprise you. Data — the SQLite database, configuration, and encrypted credentials — lives in the ./termix-data volume; PostgreSQL and MySQL are supported for an external database.

Security and Operations

  • Authentication: local accounts plus OIDC, LDAP, GitHub, and Google, with TOTP 2FA and passkey (WebAuthn) support. Enable these before exposing the UI to a wider network.
  • Per-user encrypted credentials: passwords and SSH keys are encrypted per user, and the database file itself can be encrypted on disk.
  • Never expose guacd: the daemon accepts connections without its own authentication; keep it on the internal Docker network and do not map its port to the host.
  • TLS: automatic certificates with HTTPS redirect, or a reverse proxy (Caddy, Nginx) in front of the HTTP port.
  • Telemetry: a small anonymous ping once a day by default; disable with ENABLE_TELEMETRY=false before first start if unwanted.

What stands out in practice

  • Multi-tab terminal with split screen — up to six panels at once, with a toolbar showing host CPU, memory, and disk.
  • Remote desktop (RDP/VNC) in the same tab, plus an RDP drive file browser and drag-and-drop upload.
  • SFTP file manager for browsing, editing, uploading/downloading, and copying files between servers.
  • SSH tunnels — local, remote, and dynamic SOCKS with auto-reconnect.
  • Docker/Podman container management — start, stop, shell — without leaving the dashboard.
  • Session recording for terminal, RDP, and VNC, with playback and per-session connection logs.

Honest limitations

  • A single concentration point for credentials. Every host password and key lives in one application; compromising the web UI means access to everything. Per-user encryption helps, but the risk stays centralized.
  • Dependency on guacd. RDP/VNC/Telnet need the external daemon; if guacd is down, remote desktop stops even though the terminal still works.
  • A very large feature set. The flip side is a learning curve and a dense UI; automations, fleets, and the AI assistant may never get used in a small setup.
  • One machine, one failure domain. In a single-host homelab, Termix and the servers it manages often share storage and network; if the machine dies, the tool to fix it dies with it. The docs suggest running Termix outside the network it manages (for example on a VPS).
  • Telemetry on by default and an optional AI assistant; both deserve a check and a conscious off switch.

Conclusion

Termix solves a real problem: SSH and remote desktop access from the browser, in one tidy dashboard, without extra clients. For a single-machine homelab it is a comfortable fit for terminals, file management, and occasional RDP/VNC sessions — provided credentials are guarded, the UI sits behind strong authentication and TLS, and guacd stays internal. It is not a VPN replacement, and its credential concentration has to be acknowledged; with those mitigations, Termix is one of the most practical remote access gateways around.

References

Back to all posts