LibrePortal for your computer

Your servers, one window. The LibrePortal app for your computer (formerly called LibrePortal): the servers you run, the servers you belong to, SSH, remote disk unlock, provider consoles and notes in one place. Desktop now; a phone preview is built from the same code.

It is for people who run their own servers (a home box, a rented VPS, a backup machine) and are tired of remembering addresses, ports and half a dozen login pages, and for people who just belong to a friend's server. The LibrePortal on a server looks after what runs on it; this app looks after the machine itself and gives you one place to reach every server.

Renamed in 0.14.0. The package is now libreportal-desktop and replaces the old libreadmin package. On first start your servers, vault and keys move from ~/.config/libreadmin to ~/.config/libreportal-desktop by themselves. Your Vaultwarden folder is renamed from LibreAdmin to LibrePortal at the next sync; its items stay in it.

Early work in progress: the Linux desktop app works, but expect rough edges and changes. An Android preview builds from the same code (see below); it is not the phone app yet.

What you get

• All your servers in one list, grouped the way you like, with a dot that shows whether each one is online, waiting for its disk to be unlocked, or out of reach.
• SSH in the app: one click opens a terminal tab right inside LibrePortal (several at once), using the SSH setup and agent you already have, including the Bitwarden one. LibrePortal never stores private keys. Prefer your own terminal window? It is one click away too.
• Live health at a glance: disk, memory, load, waiting updates, restarts and unhealthy containers for each server, checked about once a minute over a single quiet SSH connection that never asks for a password and stops at the first refused login. A small warning mark shows in the list when something needs a look.
• Notifications when something changes: a server goes offline or comes back, waits for its disk password, runs out of disk space, needs a restart, or has a failing container. Once per change, never repeated, and every kind can be switched off.
• A read-only key if you like: let LibrePortal look at a server with a key that can only read its status, so even a stolen copy can't do anything else.
• Unlock after a restart, in the app: when an encrypted server is waiting for its disk password, type it into LibrePortal and press Enter. You watch it connect, unlock and come back online. The password goes straight to the server and is never written to a log; it is only saved if you choose to keep it in your vault. The first time, you are shown the unlock address's fingerprint to trust, and you are warned loudly if it ever changes.
• Quick actions: restart a server (it first checks that no backup or update is running, then follows it back up and opens the unlock box when it asks for its disk password), run the system updates in a live terminal tab, update LibrePortal, or shut it down behind a typed confirmation (with OVH connected you can turn it on again from the app).
• Connect OVH: make your own OVH application once, approve a key in a browser window (your password manager fills the sign-in; LibrePortal never sees your OVH password), and LibrePortal can restart a server through OVH when SSH is down, turn it off and on again, show when it renews, import your OVH servers and open its console. You see the exact list of rights before you agree, and Disconnect deletes the key at OVH.
• Set up a new server: a guided path from nothing to an encrypted LibrePortal server. Compare OVH's plans side by side (price a month without VAT, size, places, and whether they fit LibrePortal), buy one with the exact total in front of you, or pick one you already rent; reinstall it with Debian 13 and your SSH key (you type its name first, and a server that looks in use gets a loud warning); encrypt its disk with LibrePortal's own signed script, which LibrePortal checks against LibrePortal's release key before it runs; unlock it; and, if you like, install LibrePortal. Nothing is bought, wiped or encrypted without its own button and its own confirmation.
• What is using the CPU: the Health card draws the last fifteen minutes of CPU and says what is busiest right now, and you get a notification if a server has been working flat out for ten minutes.
• Provider consoles and panels: a fresh console link for supported providers (OVH today), and a shortcut to your hosting account page for the rest.
• Links and notes for each server, such as its own web panels and a reminder of what it does.
• Open in LibrePortal for servers that run it.
• Vaultwarden as your one real vault: your servers, disk passwords, keys, VPN configs and company logins live in a folder called LibrePortal in your Vaultwarden (or bitwarden.com). The app talks to it itself, on a computer or a phone, and keeps an encrypted offline copy opened with the same master password, so everything still works when Vaultwarden is down. On a new computer or phone, sign in with the master password and your servers are there; the device then gets its own SSH key and VPN connection on each server by itself.
• Servers and keys: every server is checked against one standard (LibrePortal set up, the disk unlock saved, root's key saved, this device's own key, VPN configs, who can log in), on its Safety tab and on one page for all servers. Each check can be Automatic, Check only or Manual. Keys on your servers and this computer are recorded and sorted (LibrePortal, your devices, others, unknown); weak or unknown keys and password logins are pointed out, and nothing is removed without a preview and your yes.
• Health and Security at a glance: each server's Health is one line of small chips (disk, memory, CPU, load, uptime) that turn amber or red when something needs a look, and a Security card shows waiting updates, restarts, automatic updates, CrowdSec and which SSH key is used. Open either for the detail.
• Servers first: the front page is your servers and a clear Add a server; nothing is asked up front. Each server has its own page with Overview, Setup, Domains, Devices & VPN, SSH keys, Costs, Safety check and Backups. Settings keeps only what is app-wide (the vault, the company logins, notifications, checks, appearance).
• The records each server wants: each server's Domains tab lists the DNS records it needs (its domains, one name for all its apps, a certificate rule and, for mail, the mail set), checked against live DNS. Missing ones are set up for you when the domain's DNS company is connected; otherwise each line shows exactly what to add and where, and ticks itself once DNS shows it.
• A Domains page: your domains from deSEC, OVH and Namecheap (or added by hand), who registered each one, who answers its DNS, DNSSEC, renewal dates and which servers use it. See and change records with a preview first, a backup in your vault before every change, a check against the domain's own name servers afterwards and one-tap undo. Ready-made setups for mail (MX, SPF, DKIM, DMARC, MTA-STS and more, with the DKIM key read from your server) and for an app's address, a mail check that sends nothing, reverse DNS at OVH, and buying a domain at OVH with the first-year and renewal price shown.
• Setup, a section of every server's page: the steps of that server (reach it, SSH key, vault, recovery kit, disk encryption and unlock, LibrePortal, pairing, safer logins, domain, devices, backups), each Done, Found, Skipped or To do. Tapping one opens just that step on its own page to do or redo it. Found and Skipped are quiet notes, never warnings.
• Bring a server you set up by hand up to standard: Finish setup first takes a read-only look (SSH, the disk-unlock server, CrowdSec, the name, the private network), then offers what is missing. Set it all up for me runs the safe steps by itself and lists what is done; anything that could lock you out (keys, the unlock, SSH settings, the name) shows a preview first. LibrePortal makes a key of its own for each server, kept in your vault and handed to ssh from its own key holder (never a file on disk); it is added next to your old keys and proved with a login of its own before anything depends on it, and old keys only go when you tick them. The disk-unlock key is added the same way and proved by a real unlock. A disk that isn't encrypted is told, never changed.
• Get me back in: when a server won't let LibrePortal in, it looks at what answers and lists the ways back, gentlest first: the unlock port, the key from your vault, a changed identity (never trusted by a button), then the company's restart, rescue mode and console.
• Add a server, one question per page: Buy a server, Use a rented server (OVH for now), Connect an existing server (a LibrePortal server by pairing link or address and code, or a plain server by address and SSH, with a read-only look first) or Join a server. A slim progress line shows where you are; Back returns one page. Every optional step has Skip for now.
• A Safety check: does your server, its domain and its backups all depend on one company? It says so in plain words, and a "What if…" picker shows what you would lose, and what would still work, if any one company went away. It only looks at what the app already knows and calls nobody.
• Costs & renewals: your OVH servers and your domains are found by themselves with their renewal dates; you add the price (the app can't read what a company charges you) and anything else you pay for. Monthly and yearly totals per currency, and a reminder 30, 14, 7 and 1 days before anything renews or ends, saying whether it renews by itself.
• Networks: your VPNs run by the app itself: every server's private network, a VPN company for everything else (Mullvad, or any WireGuard config you import) and other WireGuard configs from your vault, several at once, on a computer and on Android (where the app is the phone's one VPN). Each shows its range, whether it is up, its last handshake and its traffic, with a switch. Your servers always go through their own networks, the local network stays local, and DNS follows your choice per network (off, names only, or all). Automatic networks come up whenever the app runs; Check only and Manual are one tap away. On Linux a small helper installed with the .deb runs them (the system's own VPN settings are never changed); Windows and macOS are not supported yet.
• Devices & VPN: give each phone or computer one WireGuard connection that reaches every server you pick (and, if you like, sends everything else through Mullvad). The device's key is made here and kept in your vault; servers only get its public half, through LibrePortal's own device commands (so the device keeps one address everywhere), or through the app route on a server you are a member of. You get a QR code for the official WireGuard app, a file, or a one-click add to this computer's network menu; a check for two servers using the same addresses; "add to another server"; and "remove from every server", which tells you about any server it couldn't reach and tries again later.
• The panel and the apps inside the app on a phone: the server's panel and its app tiles open full screen in the app, each server with its own private browser profile, so the Authelia sign-in and the panel's session are kept between launches. Back goes back a page; links to other sites open in the browser; only the certificate trusted at pairing is accepted.
• Notifications from your servers: a bell lists each server's notifications, newest first; tap one to open its page, dismiss one or clear them all (with Undo). On a phone, alerts arrive even with the app closed, through your own server's ntfy and the app's own UnifiedPush connection: no Google service in between. Pause them for an hour, until 08:00 or until you turn them back on; one quiet summary says how many came in meanwhile.
• For members, on a phone: the apps you were given open inside the app, signed in; the phone apps your server offers (LibreSync, LibreMoney) open with one tap or show where to get them; shared folders open in LibreSync. A phone makes its own private-network connection (its own key, made on the phone) and hands it to the WireGuard app; pairing links and invitations can be scanned with the camera.
• On a phone, Settings has: App updates (checked only if you say yes; every download is checked against its published checksum and must be this app with the same signature before Android's installer opens), Permissions (each with Android's own switch one tap away) and Privacy. A server page with a certificate no authority vouches for shows its fingerprint to trust once; a certificate that changes later is refused.
• The vault, browsable; a terminal on the phone: Settings, Vault items lists what the vault holds (servers, disk and root passwords, keys, VPN, company logins), with a password shown or copied only when you ask. On a phone, a server's Terminal opens a shell over the phone's own key, with Ctrl-C, Tab and the arrow keys a phone keyboard lacks.
• Continue as, for the other LibrePortal apps: on a phone, LibreSync, LibreMoney and the other LibrePortal apps sign in through this app with one tap. Only those apps, checked by their signature, can ask; the first time you allow each one; Settings lists them and signs one out.
• The server's own panel as a tab: "Open panel" shows the LibrePortal panel inside the window (a built-in Chromium, fetched the first time you use it: about 120 MB to download, 500 MB on disk, kept for next time), already signed in for admins, with its own private profile apart from your other browsers. If the built-in browser can't start, "Open in my browser instead" is on the same page.
• A tidier sidebar: servers are grouped by what they do (LibrePortal, Backup, Other), search is an icon, and a + next to refresh adds a server. An Installed card shows whether LibrePortal, a Backup Server and LibrePost are on a server and installs them in a terminal tab you can watch.
• Settings in sub-pages: vault, provider accounts, notifications, checks, SSH, export, appearance and about, each on its own page.
• More than one account per company: for example a personal and a work deSEC. Each has its own name and its own key in the vault.
• Scrollbars you can grab on every long page and list.
• Company logos: each hosting, DNS and storage company shows its logo (bundled, never fetched); see shared/src/commonMain/resources/provider-logos/NOTICE.md.
• Hosting & DNS companies (in Settings): OVH, Hetzner Cloud, DigitalOcean, deSEC, Namecheap, Hetzner Storage Box, Backblaze B2, Mullvad and Vaultwarden, each with what it is good for, where it is based and a plain note on privacy. Pressing Connect walks you through it in numbered steps: it opens the right page, shows the exact names and rights to choose, and you paste the key. LibrePortal makes one read-only check and only then keeps the key, in your vault and nowhere else.
• Private by design: no account, no cloud, nothing leaves your computer. Your provider keys, and any disk passwords you choose to keep, live in an encrypted vault of LibrePortal's own (and, if you connect one, your Vaultwarden): the local file is opened with a master password only you know, with a recovery key for emergencies. It locks itself when you are away.

Android preview

The same app builds for Android (0.31.0). It shows the step-by-step Add a server installer, your server list and each server's card, pairing, the member view, Devices & VPN, Domains & DNS, Costs, the Safety check, the vault and Settings, one screen at a time with the system Back button. A phone has no ssh program, so the app speaks SSH itself with a key made on the phone (never leaves it): health checks and the read-only key, remote disk unlock, Finish setup, Get me back in, Installed and the full Set up my own server wizard all work, and long jobs keep running with a notification while the screen is off. The interactive terminal and Import from SSH config are not on the phone yet. It installs beside the LibrePortal phone app (as "LibrePortal (preview)", org.libreportal.app.preview, debug-signed) and uses none of its data. It is not published; build it yourself with tools/run.sh ./gradlew --no-daemon :androidApp:assembleDebug. Details: androidApp/README.md and "Android" in docs/design.md.

Get started

There is no download yet. For now, build it from source: see Building from source in the guide.

Learn more

• The LibrePortal guide
• libreportal.org

For developers

• Design notes: how the app is put together and where the phone version fits.
• Building from source

Contributing and reporting problems

Found a bug or have an idea? Open an issue. Please never post passwords, keys or other secrets in an issue; describe the problem and we will say what to share. Pull requests are welcome.

Licence

GNU AGPL-3.0-or-later.