Introduction

SeyalRun is a standalone Privileged Access Management (PAM) and automation solution for DevOps teams managing servers. It runs completely on its own — no monitoring stack or third-party console required — and it can also integrate directly into Zabbix for teams who already live there.

It gives you a browser-based SSH terminal, a credential vault, session recording, and job automation for your fleet, with every action gated by role-based access control. Used standalone, it's a self-contained console for host access and automation. Used alongside Zabbix, its frontend module surfaces that same access directly inside the Zabbix UI instead of a separate console.

What problem it solves

Most teams end up with SSH credentials scattered across password managers, shared ~/.ssh/config files, or worse — memorized. SeyalRun centralizes that: credentials live in an encrypted vault, access is granted per-user per-host, every session is recorded, and every job run is audited — as a complete, standalone platform. If your monitoring already lives in Zabbix, SeyalRun's frontend module puts a one-click terminal icon directly on the hosts you're already looking at, so it's additive rather than a replacement for how you already work.

Architecture at a glance

SeyalRun is split into small, single-purpose services, each with its own database tables and its own /health + /metrics endpoint:

Service	Responsibility
edge-proxy	The only service published to the host. Terminates TLS, redirects HTTP → HTTPS.
api-gateway	Public API surface, session handling, CORS, per-IP/user rate limiting (via Redis).
identity-service	Users, auth, sessions, RBAC, Zabbix SSO exchange. Internal-only.
inventory-service	Hosts, credential vault (AES-256-GCM), host groups. Internal-only.
terminal-service	Browser SSH terminal sessions.
recording-service	Session recording storage and replay.
automation-service	Scripted job execution across managed hosts, Zabbix-trigger bindings.
metrics-service	Aggregated platform metrics.
zabbix-integration-service	Serves the agentless self-monitoring webhook and Zabbix event integration.
frontend	The Vue single-page app served to the browser.

identity-service and inventory-service are internal-only — every call from api-gateway carries a short-lived X-Service-Token (HS256, signed with SERVICE_JWT_SECRET) that the receiving service verifies before doing any work. See Architecture for the full trust model, and Security Model for how credentials and sessions are protected.

Two ways to run SeyalRun

1. Standalone (default) — log in directly at SeyalRun's own URL, and manage hosts, credentials, sessions, and jobs entirely from its own console. No Zabbix required.
2. Integrated with Zabbix (optional) — install the Zabbix frontend module, and SeyalRun appears as a menu inside Zabbix itself, with SSO so users never see a second login screen.

These aren't mutually exclusive — most deployments run the standalone console for admins and enable the Zabbix integration for day-to-day host access.

Next steps

• Quick Install — one command, prebuilt images, running in minutes.
• Manual Setup — build from source, bring your own database.
• Configuration Reference — every .env variable explained.