Appearance
Introduction
SeyalRun is a standalone Privileged Access Management (PAM) and automation solution for DevOps teams managing servers. It runs completely on its own — no monitoring stack or third-party console required — and it can also integrate directly into Zabbix for teams who already live there.
It gives you a browser-based SSH terminal, a credential vault, session recording, and job automation for your fleet, with every action gated by role-based access control. Used standalone, it's a self-contained console for host access and automation. Used alongside Zabbix, its frontend module surfaces that same access directly inside the Zabbix UI instead of a separate console.
What problem it solves
Most teams end up with SSH credentials scattered across password managers, shared ~/.ssh/config files, or worse — memorized. SeyalRun centralizes that: credentials live in an encrypted vault, access is granted per-user per-host, every session is recorded, and every job run is audited — as a complete, standalone platform. If your monitoring already lives in Zabbix, SeyalRun's frontend module puts a one-click terminal icon directly on the hosts you're already looking at, so it's additive rather than a replacement for how you already work.
Architecture at a glance
SeyalRun is split into small, single-purpose services, each with its own database tables and its own /health + /metrics endpoint:
| Service | Responsibility |
|---|---|
edge-proxy | The only service published to the host. Terminates TLS, redirects HTTP → HTTPS. |
api-gateway | Public API surface, session handling, CORS, per-IP/user rate limiting (via Redis). |
identity-service | Users, auth, sessions, RBAC, Zabbix SSO exchange. Internal-only. |
inventory-service | Hosts, credential vault (AES-256-GCM), host groups. Internal-only. |
terminal-service | Browser SSH terminal sessions. |
recording-service | Session recording storage and replay. |
automation-service | Scripted job execution across managed hosts, Zabbix-trigger bindings. |
metrics-service | Aggregated platform metrics. |
zabbix-integration-service | Serves the agentless self-monitoring webhook and Zabbix event integration. |
mcp-server | Publishes SeyalRun as Model Context Protocol tools for AI agents. Internal-only. |
frontend | The Vue single-page app served to the browser. |
identity-service and inventory-service are internal-only — every call from api-gateway carries a short-lived X-Service-Token (HS256, signed with SERVICE_JWT_SECRET) that the receiving service verifies before doing any work. See Architecture for the full trust model, and Security Model for how credentials and sessions are protected.
Who uses it
People, through the console or the Zabbix module — and increasingly, software: CI jobs and AI agents, through a scoped API token or the MCP server. Both go through the same gate and land in the same audit log; an agent's access is always a subset of its owner's.
Two ways to run SeyalRun
- Standalone (default) — log in directly at SeyalRun's own URL, and manage hosts, credentials, sessions, and jobs entirely from its own console. No Zabbix required.
- Integrated with Zabbix (optional) — install the Zabbix frontend module, and SeyalRun appears as a menu inside Zabbix itself, with SSO so users never see a second login screen.
These aren't mutually exclusive — most deployments run the standalone console for admins and enable the Zabbix integration for day-to-day host access.
Next steps
- Quick Install — one command, prebuilt images, running in minutes.
- Manual Setup — build from source, bring your own database.
- Configuration Reference — every
.envvariable explained. - Access Control — roles, authorizations, MFA, and login restrictions.
- AI Agents & MCP — driving SeyalRun from a script or an agent.