HHostSSH

Glossary

Every HostSSH term in one place — the quick definition plus a link to the full guide.

Glossary

Quick definitions. Concepts & vocabulary is the canonical narrative; this page is the lookup index. Terms are grouped by area.

Fleet & machines

  • Node — one machine running the HostSSH agent (VPS, bare metal, office box, GPU rental), with or without a public IP. See Concepts.
  • Fleet — all your nodes together, shown on the dashboard fleet map. See Fleet & Nodes.
  • Agent — the single Go binary on each node: builds/runs apps, manages the proxy, runs backups, reports heartbeats. See Concepts.
  • Control Plane — the SaaS brain (app.hostssh.com): licensing, jobs, telemetry, alerts, copilot. Never handles app traffic. See Concepts.
  • Heartbeat — the agent's ~60 s report (version, load, containers, backup health). Missing heartbeats drive degraded (>3 min) / offline (>15 min).
  • Fingerprint — a node's stable hardware+key identity across reboots; jobs are pinned to it.
  • Mesh — the private WireGuard network linking your nodes; apps reach databases over private IPs. See Mesh.
  • Job — one unit of work handed to an agent (deploy, backup, restore, firewall apply…) with a live log.

Apps & serving

  • App — one deployable unit (site, API, worker) with a name, source, env, and lifecycle. Identity survives redeploys; only the container is replaced.
  • Builder — how source becomes an image: hostpack (auto-detect), dockerfile (your recipe), image (prebuilt). See Deploying apps.
  • Size — the resource envelope an app may use: s / m / l / xl (CPU share + burst, memory, PID cap). See Concepts.
  • Slot — a placement unit of node capacity an app runs in. See Capacity.
  • Managed proxy — the agent-run Traefik on ports 80/443: automatic Let's Encrypt certs, domain routing. See Domains & TLS.
  • Readiness gate — the HTTP probe (--readiness-path) a deploy must pass; failure rolls back to the previous version.
  • Worker — an app with an overridden start command (--command): no proxy, no port. See Deploying apps.
  • Sealed secret — an env value encrypted end to end, decrypted only inside the agent at deploy time. See Secrets & environment.
  • Cutover — pointing a real domain's DNS at a HostSSH node (cert pre-issued via DNS-01 for zero downtime). See Migrating to HostSSH.
  • Tunnel-first — serving from a no-public-IP node via Cloudflare Tunnel. See Tunnel-first join.

Data protection

  • .hsi image — one encrypted, signed file holding a whole server (brain, databases, volumes, system, manifest). The unit of backup, restore, clone, and relocate. See Backups & recovery.
  • Capture — hostssh capture: build a fresh .hsi and write it to your storage. Incremental and deduplicated after the first.
  • Restore — roll the same server back to an image, staged and confirmed before anything live is swapped.
  • Clone — reproduce a server elsewhere without touching the original (staging from prod; WireGuard stays off unless --activate-wg).
  • Relocate / migrate — stand up on a fresh VPS with automatic public-IP rewrite (hostssh migrate --new-ip).
  • Transfer key — a one-time, expiring, scope-locked key authorizing a single peer image pull. See Backups & recovery.
  • Restore-drill — a scheduled prove-it run: restore the latest image to a throwaway target, verify, tear down. See Backups & recovery.
  • Retention — per-target keep policy; default keep_all (no silent deletion; every prune previewable). See Backups & recovery.
  • Connection — one BYO credential (storage backend or platform integration: DNS, alerts, metrics, git). See Connections (BYOK).
  • Custody — who holds the image encryption key: agent_local, zero_knowledge, or escrow. See Connections (BYOK).

Platform & AI

  • License / seat — a signed key (HSSH-XXXX-XXXX-XXXX) entitling node seats; verified offline with a grace clock. See Licensing.
  • Fleet Copilot — the AI diagnostician over live fleet state; proposes confirmable actions, never auto-executes. See Copilot.
  • MCP — the Model Context Protocol surface (hostssh mcp) letting AI hosts operate HostSSH as a tool. See Add-ons.
  • Inference gateway — the OpenAI-compatible API face of fleet capacity; apps send Bearer [REDACTED] + model names, never box IPs. See GPU workloads.
  • Monitor / alert — uptime, DNS, blacklist, and disk watchers with notification delivery. See Monitoring & alerts.
  • Web-SSH — browser shells with ephemeral short-TTL keys, no open :22. See Web-SSH.