webterm

Self-hosted browser terminal with multi-session tabs, modern UI, and cross-platform metrics.

Demo

demo.mov

Features

• Multiple terminal sessions with tabs, detach, and keyboard shortcuts
• Cross-platform CPU/memory/GPU metrics (macOS, Linux, Windows)
• Session snapshots and restore support
• Agent session monitoring dashboard (daemon + SSE)
• Plain password auth + rate limiting
• Mobile-friendly UI

Requirements

• Go 1.26+
• Node 20+ (for frontend build)

Quick Start

Build and run:

make build
./webterm serve --config webterm.yaml

Configuration

Generate a default config:

./webterm config init --path webterm.yaml

Key settings include:

• server.bind / server.port
• auth.mode and auth.password
• terminal.shell and terminal.working_dir
• sessions.max_sessions and snapshot settings
• monitoring.db_path, monitoring.sample_interval, monitoring.retention

Authentication

Set a plain password directly in webterm.yaml:

auth:
  mode: password
  password: "your-password"

Password auth only.

CLI Commands

• webterm serve / webterm up — start the server
• webterm status — show monitoring summary
• webterm notify SESSION --title "MESSAGE" — send monitoring notification
• webterm agent-setup — install agent helper script
• webterm doctor — environment diagnostics
• webterm config init — create config template
• webterm version — build metadata
• webterm completion [bash|zsh|fish] — shell completions

Monitoring

The monitoring daemon runs automatically when you start the server. Use webterm status for a CLI overview, or open the Monitor panel in the UI.

Example config:

monitoring:
  enabled: true
  db_path: "~/.webterm/monitoring.db"
  sample_interval: 10s
  retention: 168h

Development

make test

Expose It (Tunnel Options)

Cloudflare Tunnel:

cloudflared tunnel --url http://localhost:8080

ngrok:

ngrok http 8080

Tailscale Serve:

tailscale serve --http=8080 8080

Notes

sessions.snapshot_key accepts a simple string; it is derived into an encryption key automatically. Leave it empty to disable snapshot encryption. The frontend build output is served from frontend/out and embedded into the Go binary at build time.