Shellmin

The Thin, High-Performance Orchestrator for Sysadmins.

Shellmin is an agentless, parallel Linux server orchestrator built for sysadmins. It requires zero remote Python or agent runtimes—operating purely over native SSH using standard POSIX shell tools (sh, bash, sudo).

🔥 Key Architectural Features

⚡ Zero Remote Footprint: Connects over native SSH. No remote agents, no pip, no Python runtime on target nodes.
🚀 Polyglot Modules: Write modules in any language you know—Bash, Python, Ruby, Perl, or compiled Go/Rust binaries.
🧬 Layered Config "Onion": Merges defaults, global /etc/shellmin/config.yaml, project ./config/config.yaml, and CLI flags seamlessly.
🔒 Zero-Trust Security: MITM host key verification, input null-byte guards, and command audit regex checks.
🛡️ Native SELinux Support: Primitives for managing SELinux booleans, persistent file contexts (fcontext), and user role mappings.
⚡ Blazing M:N Concurrency: Leverages Crystal 1.21.0 parallel fibers (Fiber::ExecutionContext::Parallel) to manage thousands of servers with minimal RAM footprint.

📚 Documentation & Manuals

📦 Essential Core Modules

Module	Description	Actions
`user`	Provisions system users, groups, shells, and SELinux user roles	`create`, `remove`, `status`
`package`	Package management (`dnf`, `apt`, `apk`, `pacman`, `emerge`)	`install`, `remove`
`service`	Controls init system daemons (`systemd`, `openrc`)	`start`, `stop`, `restart`, `enable`, `status`
`selinux`	Manages SELinux booleans (`setsebool -P`) & file contexts (`restorecon`)	`setbool`, `fcontext`
`firewall`	Manages system firewall rules (`firewalld`, `ufw`, `nftables`)	`enable`, `disable`, `add_rule`

🚀 Quick Start

# 1. Install dependencies & build binary
shards install
make build

# 2. Run unit specs & static linters (Ameba & Flaw)
make test
make lint

# 3. Run Podman integration test suite
./test/run_matrix.bash

# 4. Execute a module command
bin/shellmin module user create deployer wheel /bin/bash -H web-server