CloudMesh

One Console to Control Them All

Connect multiple devices and servers into one unified resource pool. Monitor, manage, and distribute workloads from a single terminal.

Made By MRSX PRO

Security Badges:

Why CloudMesh?

Managing multiple servers shouldn't mean juggling 10 SSH windows. CloudMesh gives you one command to control everything.

Project Website

The CloudMesh website is published with GitHub Pages at ALI88708.github.io/CloudMesh. To enable the first deployment, open Settings → Pages and set Build and deployment → Source to GitHub Actions. The Deploy CloudMesh website workflow publishes the site/ directory after website changes reach main; it can also be started manually with workflow_dispatch.

The Releases section reads published releases from the GitHub Releases API, so release versions, notes, dates, and downloadable assets appear automatically without rebuilding the site.

Problem	CloudMesh Solution
SSH into each server manually	`cm run "command"` - run on all servers at once
No visibility into resource usage	`cm watch` - real-time monitoring dashboard
GPU servers hard to manage	`cm gpunode` - GPU telemetry from any node
No way to distribute work	`cm slice` - auto-slice tasks across servers by resources
Miss server alerts	`cm notify` - Telegram/Discord alerts
Docker scattered across servers	`cm docker` - manage containers on any node
Tamper-prone logs	`cm cmdlog --verify` - immutable hash chain detects tampering
Compromised keys	`cm panic` - rotate ALL keys (local + remote) in one command
Reactive scheduling	`cm weather` - predictive resource forecasting
Single-point trust	`cm trust` - distributed trust evaluation
Jobs lost on crash	`cm node job recover` - checkpoint & auto-recover jobs
TCP ports visible to scanners	`python3 cloudmesh_node.py start --spa` - Ghost Ports (SPA) hide your services
No SSH key management	`cm keys` - generate, list, deploy SSH keys
Batch command execution	`cm exec --all "cmd"` - run on all nodes at once
DDoS on your API	Built-in DDoS protection (rate limiting, banning, slowloris guard)

Quick Start

GitHub release (Recommended)

Download Python 3.11+ for Linux or Windows, then install the verified release wheel:

pip install https://github.com/ALI88708/CloudMesh/releases/download/v4.2.6/cloudmesh-4.2.6-py3-none-any.whl
cm --help

CloudMesh is distributed through GitHub Releases. The cloudmesh name on PyPI belongs to a different project and is not this tool.

Windows (Installer)

Download Python and install it
Download cm_for-windows.bat from this repo
Double-click to run it
Done! Use cm --help in PowerShell

Linux (Installer)

Download Python and install it first, then:

curl -sL https://raw.githubusercontent.com/ALI88708/CloudMesh/main/cm_for-linux.sh -o cm.sh
chmod +x cm.sh && ./cm.sh

The installer also runs unattended, which is how CI verifies it on every pull request:

./cm.sh --yes                # install with no prompts, then self-verify
./cm.sh --verify-only        # re-run the checks on an existing install
./cm.sh --yes --source=.     # install from this checkout instead of downloading
./cm.sh --yes --skip-node --skip-systemd   # controller only, no root needed

cm_for-windows.bat accepts the same switches as /Y, /VERIFYONLY, and /S=DIR.

FreeBSD / OpenBSD / NetBSD (Installer)

cm_for-bsd.sh is POSIX sh, so it runs on a stock base system that has no bash:

curl -sL https://raw.githubusercontent.com/ALI88708/CloudMesh/main/cm_for-bsd.sh -o cm-bsd.sh
sh cm-bsd.sh                      # asks once, then installs
sh cm-bsd.sh --yes                # unattended, used by CI
sh cm-bsd.sh --verify-only        # re-run the checks on an existing install
sh cm-bsd.sh --yes --source=.     # install from this checkout

It installs python3 with pkg (FreeBSD) or pkg_add (OpenBSD/NetBSD), keeps the controller in ~/.cloudmesh with its own virtual environment, and then runs the node installer, which writes the native boot unit: service cloudmesh_node start on FreeBSD, rcctl start cloudmesh_node on OpenBSD, and /etc/rc.d/cloudmesh_node start on NetBSD.

Supported Platforms

Platform	Controller	Node agent	Installer
Linux	Yes	Yes	`cm_for-linux.sh`
Windows	Yes	Yes	`cm_for-windows.bat`
FreeBSD	Yes	Yes	`cm_for-bsd.sh`
OpenBSD	Yes	Yes	`cm_for-bsd.sh`
NetBSD	Yes	Yes	`cm_for-bsd.sh`

FreeBSD is verified end to end in CI by .github/workflows/bsd.yml, which runs the whole suite and scripts/bsd_e2e.sh inside a FreeBSD VM. OpenBSD and NetBSD share the same POSIX code paths and are covered by the profile tests, but their pkg_add and rc.d branches are not exercised by CI.

Update

cm update              # Self-update a source checkout from GitHub
cm update --pip        # Download, verify, and install the GitHub release wheel

cm update --pip checks the release's SHA256SUMS before installing the local wheel. It never installs the unrelated PyPI cloudmesh package.

First Steps

cm --help              # Show all 286 commands
cm status              # Quick overview of all servers/nodes
cm interactive         # Interactive TUI menu
cm mon --local         # Monitor this machine
cm watch               # Real-time monitoring dashboard
cm discover 192.168.1  # Scan your network for nodes
cm doctor              # Security & health check (15 checks)
cm exec --all "uptime" # Run command on all nodes
cm panic --dry-run     # Preview emergency key rotation
cm completions --shell bash    # Enable shell completions

Architecture

                        +-----------------+
                        |   YOUR LAPTOP   |
                        |   (Controller)  |
                        +--------+--------+
                                 |
                  +--------------+--------------+
                  |              |              |
            SSH |         TCP 9999 |      TCP 9999 |
                  |              |              |
          +-------v--+    +-----v----+   +-----v----+
          |  Linux   |    | Windows  |   |   GPU    |
          |  Server  |    |  Server  |   |  Server  |
          +----------+    +----------+   +----------+

Two ways to connect:

SSH - For any server with SSH access
TCP Node - Lightweight agent on any device (with optional Ghost Ports / SPA)

Versioning Policy

CloudMesh follows Semantic Versioning:

Type	Format	When	Example
Patch	`2.1.x`	Bug fixes and security fixes, without new features	2.1.1, 2.1.2
Minor	`2.x.0`	New features added on a stable base	2.2.0, 2.3.0
Major	`x.0.0`	Major or fundamental changes, which may include breaking changes	3.0.0

Rule of thumb: Patches ship when ready. Minors ship with new features. Majors only when absolutely necessary.

Changelog - All Versions

v4.2.6 (Latest)

Corrupt state is reported: a config, command ledger or drain file that cannot be read is named instead of being treated as empty, and a damaged ledger is never rewritten from scratch.
Concurrent writes stay consistent: the command ledger serializes appends, so two writers cannot drop each other's entries.
Honest coverage gate: cm test --coverage measures core, node and main.py, and fails below 45% against a measured 48%.

v4.2.5

Complete checksums: SHA256SUMS now names sbom.cdx.json as well, so every asset on the release page can be verified instead of all but one.
Pre-publish guard: the release job verifies the checksum file and fails if any attached asset is missing from it, while the release still does not exist.

v4.2.4

Installers on the release page: cm_for-linux.sh, cm_for-windows.bat and cm_for-bsd.sh are attached to the release, and SHA256SUMS covers them.
Honest banner: every installer menu now states the version it installs instead of v2.0, derived from pyproject.toml so it cannot drift again.

v4.2.3

cm wait: blocks until CPU, RAM and disk fall below the thresholds you pass, with exit codes a script can gate on (0 met, 1 timeout, 2 nothing to wait for).
cm node drain / cm node undrain: takes a node out of queue scheduling without deleting it, keeping its auth key and job history; cm node list shows ACTIVE or DRAINED.
--json output: cm monitor, cm disk and cm ping emit plain JSON on stdout, with an error entry for a target that could not be reached.

v3.1.0

Transactional queue storage: jobs are stored in SQLite with full synchronous commits and database locking; existing JSON job records are imported automatically on first startup.
Safer queue state: the SQLite database is created with private POSIX permissions, and malformed legacy job records stop migration with an actionable error instead of being silently lost.
Existing queue CLI commands and worker coordination behavior remain unchanged.

v3.0.2

Safer configuration persistence: encrypted settings and keys are written atomically; backup names are reserved safely during concurrent saves.
Stronger SSH reliability: remote stdout and stderr are drained concurrently, with clearer exit-status, stderr, and timeout diagnostics.
More accurate operation results: server OS tests show the live detection result, and failed remote database operations are no longer reported as empty success.
Explicit queue resource claims: jobs can reserve CPU, RAM, and disk independently of node eligibility thresholds; omitted claims preserve prior behavior.
TLS configuration guard: Node TLS startup rejects a certificate or key supplied without its matching pair.

v3.0.1

Crash-safe state: queue and node job records are written atomically to avoid partial JSON files after interruption.
Restart recovery: stale queue dispatches are reconciled by the worker, and node jobs interrupted by an agent restart are reported as unknown rather than left misleadingly running.
Invalid persisted node-job records are reported in the agent log.

v3.0.0

Adaptive scheduling: rank nodes by CPU, RAM, and disk headroom; jobs can require minimum free resources across all three.
Smart failover: retry only when a request is known not to have been sent. Running jobs are retried once after an outage only when submitted with --idempotent; otherwise they become unknown rather than risk duplicate work.
Headless coordination: an exclusive worker lock prevents duplicate dispatch. Set CLOUDMESH_QUEUE_DIR to shared queue storage for controllers using a filesystem that supports file locking.
Lighter node telemetry: short-lived metric caching avoids repeated blocking probes; nodes now report a persistent identity.
Verified TLS: use cm node add ... --tls and optionally --ca-file to validate private CA certificates.

v2.3.2

Test suite runner: run cm test --suite from a source checkout, or add --coverage for a per-file coverage report.
CI now runs the test suite through the CLI and includes coverage reporting.
Existing cm test --name SERVER connection testing remains available.

v2.3.1

Fixed shell completions: Bash, Zsh, and PowerShell now complete nested commands and context-specific options.
Fixed Zsh completions to inspect the actual command word, and added previously missing top-level commands.

v2.3.0

Priority task queue: submit jobs with priorities and minimum free CPU/RAM requirements; the worker dispatches higher priorities first when a matching node is available.
Run cm queue worker to continuously process pending jobs; use cm queue worker --once for one scheduling pass.
Track jobs with cm queue status JOB_ID and cm queue list; stop pending/running work with cm queue cancel JOB_ID.
Dispatch retries move to another node only when the request is confirmed not sent, preventing duplicate command execution.

v2.2.0

Added the initial resource-aware asynchronous task queue.

v2.0.0

New Commands

Command	Description
`cm exec --all "cmd"`	Batch execute command on all nodes at once
`cm watch`	Real-time monitoring dashboard (live CPU/RAM/Disk/GPU per node)
`cm keys generate`	Generate SSH key pair
`cm keys list`	List all managed SSH keys
`cm keys show`	Show public key content
`cm keys deploy`	Deploy public key to all servers
`cm keys remove-managed`	Remove managed key entry
`cm config list`	List all config files
`cm config export -d DIR`	Export all config to directory
`cm config import -d DIR`	Import config from directory
`cm config show`	Show config file contents
`cm completions --shell bash`	Generate bash completions
`cm completions --shell zsh`	Generate zsh completions
`cm completions --shell powershell`	Generate PowerShell completions
`cm status`	Quick overview: servers, nodes, services, alerts
`cm doctor`	15-point security and health check
`cm update`	Self-update from GitHub
`cm panic retry-pending`	Retry rotations that failed (nodes were offline)

Security Patches (v2.0.0)

SPA Ghost Ports: iptables ACCEPT rule now uses -s source_ip -- only the knocker can connect. Fail-closed: SPA mode refuses to start if iptables DROP fails.
Remote Panic Rotation: cm panic now calls rotate_key on remote nodes (not just local). If a node is offline, rotation is saved for later retry with cm panic retry-pending.
SSH Tunnel Unification: build_ssh_cmd() now has strict=True (default: host key verification enabled). Disabling strict mode emits a MITM warning.
DDoS Protection: REST API has built-in rate limiting (30 req/min), connection limits (5 per IP, 100 total), IP auto-banning (5 failures = 5min ban), packet validation, and slowloris guard.

CI/CD

GitHub Actions CI: runs on Python 3.11-3.13
58 security tests all passing

v1.5.0

Command	Description
`cm update`	Self-update CloudMesh from GitHub releases
`cm status`	Quick overview of servers, nodes, services, alerts
`cm doctor`	15-point security and health check

Fixed dead tw and triw aliases for tripwire

v1.4.0 - Security Hardening

Centralized SSH: All SSH connections use ssh_util.py with RejectPolicy (no silent host key acceptance). MITM warnings for disabled host key checking.
Telegram Validation: Validates chat_id format before saving.
Firewall Allowlist: Validates port/protocol inputs.
DB Temp Files: Passwords written to temp files, auto-deleted after use.
Panic Remote Nodes: panic.py connects to nodes for remote key rotation.
TLS/SPA Warnings: Clear warnings when TLS or SPA is disabled.
Plugins Safety: Warning when plugins use shell=True.

v1.3.0 - Ghost Ports and Tripwire

New Commands

Command	Description
`python3 cloudmesh_node.py start --spa`	Start node with SPA (Single Packet Authorization)
`python3 cloudmesh_node.py start --spa --spa-port 9998`	Custom UDP port for SPA
`python3 cloudmesh_node.py start --spa --spa-window 10`	TCP stays open N seconds after knock
`cm tripwire plant --node NAME --host HOST`	Plant a tripwire trap key
`cm tripwire list`	List all planted tripwires
`cm tripwire check`	Check if any tripwire was triggered
`cm tripwire remove --node NAME`	Remove a tripwire
`cm panic setup`	Split panic key into 3 Shamir shares
`cm panic execute --share 1 --share 2`	Execute panic with 2-of-3 shares
`cm panic shares`	View current share status

Ghost Ports (SPA): Node listens on UDP silently. Controller sends a signed HMAC packet (knock). Node opens TCP for N seconds. Port scanners see nothing. iptables rules are added/removed automatically. Only the knocker IP can connect (source IP binding).

Tripwire Keys: Plant fake keys on honeypot servers. If anyone uses a tripwire key, you get an immediate alert. Zero false positives.

Shamir Panic: Panic key is split into 3 shares using Shamir's Secret Sharing over GF(p). Any 2 shares can execute panic. A single compromised device cannot trigger it alone.

v1.2.0 - Security and Intelligence

New Commands

Command	Description
`cm cmdlog --verify`	Verify command log chain integrity (SHA-256 hash chain)
`cm panic`	Emergency: rotate ALL encryption keys and node auth keys
`cm panic --dry-run`	Preview what panic would do
`cm weather`	Resource weather forecast for all servers
`cm weather --learn`	Record current resource snapshot
`cm weather -s SERVER`	Hourly CPU/RAM forecast for specific server
`cm weather --clear`	Clear all weather data
`cm trust`	Distributed trust status for all nodes
`cm trust --scan`	Scan nodes and evaluate trust
`cm node job checkpoint -n NAME -j JOB_ID`	Save checkpoint of a running job
`cm node job recover`	List jobs that can be recovered
`cm node job recover --relaunch`	Auto-relaunch recoverable jobs
`cm node job checkpoints`	List all saved job checkpoints

Immutable Command Ledger: Every command is logged with a SHA-256 hash chain. Any tampering breaks the chain and is detected instantly.

Resource Weather: Records CPU/RAM/Disk snapshots over time. Predicts when resources will be exhausted.

Distributed Trust: Controller pings all nodes and compares self-reported metrics vs actual measurements. Catches compromised or malfunctioning nodes.

Job Checkpointing: Running jobs can be checkpointed. If a node crashes, jobs are recovered from the last checkpoint.

Complete Command Reference

Server Management

Command	Alias	Description
`cm server add -n NAME -H HOST -u USER -k KEY`	`cm add`	Add server via SSH
`cm server remove -n NAME`	`cm rm`	Remove server
`cm server list`	`cm ls`	List all servers
`cm server test -n NAME`	`cm test`	Test connection
`cm server info -n NAME`	`cm info`	Server details
`cm run "cmd"`	-	Run on all servers
`cm plan "cmd"`	-	Distribution plan

Monitoring

Command	Alias	Description
`cm monitor`	`cm mon`	CPU/RAM/Disk live view (`--json` for automation)
`cm dashboard`	`cm dash`	Live dashboard
`cm watch`	-	Real-time monitoring dashboard (v2.0.0)
`cm wait --cpu-below 40 --timeout 900`	-	Block until CPU/RAM/disk drop below the thresholds
`cm uptime`	`cm up`	System uptime
`cm disk`	`cm df`	Disk usage per mount (`--json` for automation)
`cm network`	`cm net`	Network interfaces
`cm top`	-	Top processes
`cm who`	-	Logged-in users
`cm ping`	-	Ping all servers/nodes (`--json` for automation)
`cm compare`	-	Compare devices

Node Management

Command	Alias	Description
`cm node add -n NAME -H HOST -p 9999 -k KEY [--tls] [--ca-file CA.pem]`	-	Add node (optionally with verified TLS)
`cm node remove -n NAME`	`cm rmnode`	Remove node
`cm node list`	-	List all nodes
`cm node test -n NAME`	-	Test node connection
`cm node info -n NAME`	-	Node details
`cm node install -H HOST -u USER -k KEY`	`cm nodeinstall`	Install node agent
`cm node monitor -n NAME`	`cm monnode`	Monitor node
`cm node exec -n NAME "cmd"`	`cm exec`	Execute on node
`cm exec --all "cmd"`	-	Execute on all nodes (v2.0.0)
`cm node gpu -n NAME`	`cm gpunode`	GPU telemetry
`cm node dashboard`	-	Node dashboard
`cm node drain -n NAME [--reason TEXT]`	-	Stop queue jobs on a node, keeping its key and history
`cm node undrain -n NAME`	-	Return a drained node to scheduling

Node Jobs

Command	Description
`cm node job start -n NAME "cmd"`	Start async job
`cm node job status -n NAME -j ID`	Check job status
`cm node job list -n NAME`	List jobs
`cm node job kill -n NAME -j ID`	Kill a job
`cm node job checkpoint -n NAME -j ID`	Save job checkpoint
`cm node job checkpoints`	List all checkpoints
`cm node job recover`	List recoverable jobs
`cm node job recover --relaunch`	Auto-relaunch failed jobs

Smart Task Queue

Command	Description
`cm queue submit "cmd"`	Add an async job to the persistent queue
`cm queue submit -p 9 --min-cpu-free 30 --min-ram-free 8 --min-disk-free 20 "cmd"`	Set priority and minimum free CPU/RAM/disk requirements
`cm queue submit --cpu-claim 30 --ram-claim 8 --disk-claim 20 "cmd"`	Reserve expected CPU percentage and RAM/disk GB for this job during each scheduling pass
`cm queue submit --idempotent "cmd"`	Permit one retry if a running node is unreachable
`cm queue worker`	Keep dispatching jobs in priority order as suitable resources become available
`cm queue worker --once`	Run a single scheduling pass
`cm queue status JOB_ID`	Refresh and show a submitted job's status
`cm queue list --refresh`	List submitted jobs and refresh running statuses
`cm queue cancel JOB_ID`	Cancel a pending or running queued job

Docker

Command	Alias	Description
`cm docker list-servers`	-	List servers with Docker
`cm docker containers -s SERVER`	`cm dcls`	List containers
`cm docker stats -s SERVER`	`cm dcstats`	Container stats
`cm docker exec CONTAINER "cmd"`	`cm dcexec`	Exec in container
`cm docker logs CONTAINER -s SERVER`	`cm dclogs`	Container logs
`cm docker images -s SERVER`	-	List images
`cm docker pull IMAGE -s SERVER`	-	Pull image
`cm docker compose PATH -s SERVER`	-	Run docker-compose
`cm docker cleanup -s SERVER`	-	Cleanup Docker
`cm docker prune -s SERVER`	-	Prune everything

Firewall

Command	Alias	Description
`cm firewall status`	`cm fw`	Firewall status
`cm firewall add-rule --port PORT --proto PROTO --action ACT`	`cm fwadd`	Add firewall rule
`cm firewall remove-rule --port PORT`	-	Remove rule
`cm firewall list-rules`	-	List rules
`cm firewall check-port --port PORT`	-	Check if port open
`cm firewall backup`	-	Backup rules
`cm firewall load -f FILE`	-	Load rules from file

SSL Monitoring

Command	Alias	Description
`cm ssl check DOMAIN`	`cm sslchk DOMAIN`	Check SSL certificate
`cm ssl check-all`	`cm sslall`	Check all domains
`cm ssl add DOMAIN`	-	Add domain
`cm ssl remove DOMAIN`	-	Remove domain
`cm ssl domains`	-	List domains
`cm ssl history`	-	Expiry history
`cm ssl renew-check`	-	Check renewal status

Logs

Command	Alias	Description
`cm logs -n NAME`	`cm log -n NAME`	System logs
`cm logagg search -p PATTERN`	`cm logsearch -p PATTERN`	Search logs
`cm logagg filter -l LEVEL`	-	Filter by level
`cm logagg subscribe -s SOURCE`	-	Tail logs live
`cm logagg sources`	-	List sources
`cm logagg add-source --name NAME --path PATH`	-	Add log source
`cm logagg stats`	-	Log statistics
`cm logagg clear`	-	Clear log index

File Operations

Command	Alias	Description
`cm transfer -s SERVER -l LOCAL -r REMOTE`	`cm cp`	Upload/download
`cm sync`	-	Sync directories
`cm find -n NAME -p PATH`	`cm find`	Search files
`cm autosync`	-	Auto-sync local dir to server
`cm backup`	-	Manage backups

SSH Keys (v2.0.0)

Command	Description
`cm keys generate`	Generate SSH key pair
`cm keys list`	List all managed SSH keys
`cm keys show`	Show public key content
`cm keys deploy`	Deploy public key to all servers
`cm keys remove-managed`	Remove managed key entry

Configuration (v2.0.0)

Command	Description
`cm config list`	List all config files
`cm config export -d DIR`	Export all config to directory
`cm config import -d DIR`	Import config from directory
`cm config show`	Show config file contents
`cm profile list`	List profiles
`cm profile save -n NAME`	Save current config as profile
`cm profile load -n NAME`	Load a profile
`cm profile delete -n NAME`	Delete a profile

Shell Completions (v2.0.0)

Command	Description
`cm completions --shell bash`	Generate bash completions
`cm completions --shell zsh`	Generate zsh completions
`cm completions --shell powershell`	Generate PowerShell completions

Webhooks and Alerts

Command	Alias	Description
`cm webhooks add --name NAME --url URL --type TYPE`	-	Add webhook
`cm webhooks send MSG`	`cm whsend MSG`	Send message
`cm webhooks test -n NAME`	-	Test webhook
`cm webhooks list`	-	List webhooks
`cm webhooks log`	-	Webhook log
`cm webhooks enable-all`	-	Enable all webhooks
`cm webhooks disable-all`	-	Disable all webhooks
`cm watcher check`	`cm wtchk`	Check watchers
`cm watcher add --name NAME --cmd CMD`	-	Add process watcher
`cm watcher remove --name NAME`	-	Remove watcher
`cm watcher alerts`	-	Watcher alerts

ACL and Security

Command	Alias	Description
`cm acl users`	`cm aclu`	List users
`cm acl add-user -u USER -p PASS -r ROLE`	`cm acladd`	Add user
`cm acl remove-user -u USER`	`cm aclrm`	Remove user
`cm acl set-role -u USER -r ROLE`	-	Set role
`cm acl enable -u USER`	-	Enable user
`cm acl disable -u USER`	-	Disable user
`cm acl roles`	-	List roles
`cm acl add-role -r ROLE`	-	Add role
`cm acl remove-role -r ROLE`	-	Remove role

SSH Tunnels

Command	Alias	Description
`cm tunnel add --name NAME --host HOST -l LPORT -r RPORT`	`cm tunadd`	Add tunnel
`cm tunnel start -n NAME`	`cm tunstart`	Start tunnel
`cm tunnel stop -n NAME`	`cm tunstop`	Stop tunnel
`cm tunnel quick --host HOST -l PORT -r PORT`	-	Quick tunnel
`cm tunnel list`	-	List tunnels
`cm tunnel status`	-	Tunnel status
`cm tunnel stop-all`	-	Stop all tunnels

Database

Command	Alias	Description
`cm database status -s SERVER -t TYPE -P PASS`	`cm dbstatus`	Database status
`cm database query -s SERVER "SQL"`	`cm dbq`	Run query
`cm database backup -s SERVER -d DB`	`cm dbbak`	Backup database
`cm database list -s SERVER`	-	List databases

Schedule

Command	Description
`cm schedule add -n NAME "CMD" -i SECONDS`	Add schedule
`cm schedule remove -n NAME`	Remove schedule
`cm schedule list`	List schedules
`cm schedule toggle -n NAME`	Toggle schedule

Notifications

Command	Description
`cm notify setup-telegram --token TOKEN --chat-id CHAT_ID`	Setup Telegram
`cm notify setup-discord --webhook URL`	Setup Discord
`cm notify send "MESSAGE"`	Send notification
`cm notify status`	Notification status

Utilities

Command	Alias	Description
`cm encrypt FILE`	`cm enc FILE`	Encrypt file
`cm decrypt FILE`	`cm dec FILE`	Decrypt file
`cm export`	`cm exp`	Export config
`cm import -f FILE`	`cm imp -f FILE`	Import config
`cm cleanup`	-	Remove old files
`cm report`	-	Usage report
`cm speed`	-	Network speed test
`cm scan SUBNET`	-	Scan subnet for nodes
`cm alias add -n NAME -c CMD`	-	Manage aliases
`cm version`	-	Version info
`cm map`	-	Network map
`cm template add -n NAME -c CMD`	-	Command templates

Advanced

Command	Description
`cm discover SUBNET`	Auto-discover nodes on network
`cm bench -s SERVER`	Benchmark server performance
`cm audit -n NAME`	Security audit (8 checks)
`cm api --port 8080`	Start REST API server
`cm ssh -n NAME`	Quick SSH command
`cm plugin add/run/list/remove`	Custom plugin management
`cm migrate`	Migrate JSON data to SQLite backend
`cm migrate --dry-run`	Preview migration without writing
`cm migrate --verify`	Verify JSON vs SQLite consistency
`cm storage backup/list/restore`	SQLite backend backups
`cm drift snapshot/check/list/clear`	Configuration drift baseline & detection
`cm diagnose`	Smart health diagnostics with fix suggestions

Resource History

Command	Description
`cm reshistory snapshot`	Take resource snapshot
`cm reshistory show`	Show history
`cm reshistory summary`	Summary
`cm reshistory clear`	Clear history

Examples

Add a Server

cm add -n prod-server -H 192.168.1.100 -u root -k ~/.ssh/id_rsa
cm test -n prod-server

Monitor Everything

cm mon           # All servers
cm mon -n prod   # Specific server
cm watch         # Real-time dashboard
cm gpunode       # GPU usage on all nodes

Run Commands Everywhere

cm run "apt update && apt upgrade -y"       # Update all servers
cm run "df -h" --best                        # Run on best server
cm run "docker ps" -s "web,api"             # Specific servers
cm exec --all "uptime"                       # Run on all nodes

Quick Status

cm status       # Overview of servers, nodes, alerts
cm doctor       # 15-point health check

Docker Management

cm dcls -s web-1                  # List containers
cm dcstats -s web-1               # Container stats
cm dcexec web-1-container "ls -la"  # Exec in container
cm docker cleanup -s web-1        # Cleanup unused containers

Firewall Management

cm fwadd --port 443 --proto tcp --action allow
cm fw                              # Check status
cm firewall check-port --port 443  # Check if port open

SSL Monitoring

cm ssl add example.com
cm sslall                          # Check all domains
cm ssl renew-check                 # Check renewal status

Webhooks

cm webhooks add --name alerts --url https://discord.com/api/webhooks/XXX --type discord
cm whsend --name alerts "Server is down!" --event error

SSH Tunnels

cm tunnel quick --host 10.0.0.5 -l 5432 -r 5432    # Quick tunnel
cm tunadd --name db-tunnel --host 10.0.0.5 -l 3306 -r 3306
cm tunstart --name db-tunnel

Database Management

cm dbstatus -s db-1 -t mysql -P root_password
cm dbq -s db-1 "SHOW PROCESSLIST"
cm dbbak -s db-1 -d myapp

Auto-Discovery

cm discover 192.168.1.0          # Find nodes on subnet
cm discover 10.0.0 --port 9999   # Custom port

Notifications

cm notify setup-telegram --token BOT_TOKEN --chat-id CHAT_ID
cm notify setup-discord --webhook WEBHOOK_URL
cm notify send "Server is down!"

Schedule Tasks

cm schedule add -n monitor "cm ping" -i 300           # Every 5 min
cm schedule add -n cleanup "cm cleanup -d 7" -i 86400  # Daily
cm schedule list                                        # View all

Immutable Command Ledger

cm cmdlog --verify           # Check if command log was tampered with
# Chain intact - all 42 entries verified.
# Chain BROKEN at entry #17 - possible tampering detected.

Emergency Panic Button

cm panic --dry-run           # Preview what would happen
cm panic                     # Rotate ALL keys (local + remote)
cm panic setup               # Split into 3 Shamir shares
cm panic execute --share 1 --share 2  # Execute with 2-of-3
cm panic rotate              # Rotate keys on all remote nodes
cm panic retry-pending       # Retry failed rotations (v2.0.0)

Resource Weather Forecast

cm weather --learn           # Record current CPU/RAM (run periodically)
cm weather                   # See forecast for next hour
cm weather -s prod-server    # Hourly profile for one server

Distributed Trust

cm trust --scan              # Ping all nodes and evaluate trust
cm trust                     # View trust status

Job Checkpoint and Recovery

cm node job checkpoint -n gpu-1 -j abc123   # Save job progress
cm node job checkpoints                       # List all checkpoints
cm node job recover --relaunch                # Recover failed jobs

Smart Task Queue

cm queue submit --timeout 3600 --priority 8 --min-cpu-free 30 --min-ram-free 8 --min-disk-free 20 --cpu-claim 30 --ram-claim 8 --disk-claim 20 "python train.py"
cm queue worker
cm queue status JOB_ID
cm queue list --refresh
cm queue cancel JOB_ID

The worker processes higher-priority jobs first, scores available CPU, RAM, and disk headroom, and waits for nodes to meet each job's minimum free-resource thresholds. Queue records are kept in .task_queue/queue.sqlite3; existing JSON records in the selected queue directory are imported automatically at first startup and left in place as migration backups. Stop queue workers before upgrading so a pre-upgrade process cannot write new JSON jobs during migration. --min-cpu-free, --min-ram-free, and --min-disk-free control eligibility; --cpu-claim (percentage), --ram-claim (GB), and --disk-claim (GB) separately describe expected per-job reservations deducted from same-pass capacity after dispatch. To preserve legacy behavior, an omitted claim defaults to its corresponding minimum-free threshold, while a specified claim can differ independently. Start one worker in a terminal and submit jobs from another; the worker lock prevents a second coordinator from dispatching the same queue. Use cm queue worker --once for a single pass. For controllers sharing a filesystem that supports SQLite and file locking, set CLOUDMESH_QUEUE_DIR to the same queue directory on each controller, or use --state-dir consistently on each queue command.

By default, CloudMesh retries only when it can confirm the request was not sent. If a running node becomes unreachable, the job is marked unknown after a 30-second grace period and is not replayed. Add --idempotent only for commands safe to execute more than once; this permits one automatic retry after the outage grace period. If a job remains unknown, check cm node job list -n NODE before taking further action.

Ghost Ports (SPA)

python3 cloudmesh_node.py start --spa                    # Start with SPA mode
python3 cloudmesh_node.py start --spa --spa-port 9998     # Custom UDP port
python3 cloudmesh_node.py start --spa --spa-window 10     # TCP stays open 10s

How it works: Node listens on UDP silently. Controller sends a signed HMAC packet. Node opens TCP for N seconds. Port scanners see nothing. Only the knocker's source IP can connect.

Tripwire Keys

cm tripwire plant --node honeypot --host 10.0.0.99   # Plant trap
cm tripwire list                                     # View tripwires
cm tripwire check                                    # Check if triggered
cm tripwire remove --node honeypot                   # Remove trap

SSH Key Management (v2.0.0)

cm keys generate            # Generate new key pair
cm keys list                # List all managed keys
cm keys show KEY             # Show public key
cm keys deploy KEY           # Deploy to all servers

Shell Completions (v2.0.0)

cm completions --shell bash         # Bash completions
cm completions --shell zsh          # Zsh completions
cm completions --shell powershell   # PowerShell completions

Self Update (v2.0.0)

cm update                   # Update from GitHub
cm status                   # Quick overview
cm doctor                   # Run health checks

Security

CloudMesh takes security seriously:

DDoS Protection: Rate limiting (30 req/min), connection limits (5 per IP, 100 total), IP auto-banning (5 failures = 5min ban), packet validation, slowloris guard
API Authentication: All REST API endpoints require X-Api-Key header
Node Auth Keys: Per-node HMAC authentication
File Encryption: Fernet encryption for config and sensitive data
SSH Policy: RejectPolicy for unknown hosts (no silent acceptance)
Host Key Verification: Default StrictHostKeyChecking=yes with MITM warnings when disabled
Path Traversal Protection: Sandboxed file operations on nodes
TLS Support: Optional TLS encryption for node connections
ACL System: Role-based access control (admin/viewer/custom roles)
Key Rotation: Rotate .secret.key and node auth keys anytime
Remote Panic Rotation: Panic rotates keys on remote nodes too
Pending Retry: Failed rotations saved and retriable offline
Immutable Command Ledger: SHA-256 hash chain detects any log tampering
Emergency Panic Button: One command rotates all keys and locks down access
Ghost Ports (SPA): TCP port invisible to scanners -- only signed UDP knock opens it
Source IP Binding: SPA ACCEPT rules restricted to knocker IP only
Fail-Closed SPA: Node refuses to start if iptables DROP fails
Tripwire Keys: Fake keys that trigger automatic breach detection (zero false positives)
Shamir Panic 2-of-3: Panic requires 2 of 3 key shares
Distributed Trust: Controller-vs-self-report comparison catches compromised nodes
Job Checkpointing: Save job progress periodically for crash recovery

REST API Security

cm api --port 8080
# Prints API key on startup - use it in all requests

curl -H "X-Api-Key: YOUR_KEY" http://127.0.0.1:8080/api/status
curl -H "X-Api-Key: YOUR_KEY" http://127.0.0.1:8080/api/servers

Installation Options

Option	What it does
GitHub release wheel	Install the verified `cloudmesh-4.2.6-py3-none-any.whl` from GitHub Releases
Fresh Install	Download installer, double-click, done
BSD installer	`sh cm_for-bsd.sh --yes` on FreeBSD, OpenBSD and NetBSD
Update	`cm update` in a checkout, or `cm update --pip` for a verified release wheel
Uninstall	`pip uninstall cloudmesh`

The installer automatically:

Downloads all files from GitHub
Installs Python if missing
Sets up node agent
Creates virtual environment
Installs all dependencies

Node Installation

On the Same Network

chmod +x cm_for-linux.sh
./cm_for-linux.sh

On FreeBSD, OpenBSD and NetBSD the same installer is POSIX sh, so a base system can run it as is: sh cloudmesh/node/node-install.sh. It writes the native rc.d unit for that system.

Remote (via SSH from Controller)

cm nodeinstall -H SERVER_IP -u root -k ~/.ssh/id_rsa

Node Options

python3 cloudmesh_node.py start --bind 127.0.0.1                     # Bind to specific interface
python3 cloudmesh_node.py start --tls-cert cert.pem --tls-key key.pem  # Enable TLS
python3 cloudmesh_node.py start --spa                              # Enable Ghost Ports (SPA)
python3 cloudmesh_node.py start --spa --spa-port 9998               # Custom UDP port
python3 cloudmesh_node.py start --spa --spa-window 10               # TCP open window in seconds

TLS requires both --tls-cert and --tls-key; the node refuses partial TLS configuration instead of starting without encryption.

What Gets Installed

~/.cloudmesh-node/
  cloudmesh_node.py       # Node agent
  .node_key               # Auth key
  .secret.key             # Encryption key
  start.sh                # Start script
  stop.sh                 # Stop script
  status.sh               # Status script
  cloudmesh-node.service  # Systemd service (auto-created)

Project Structure

cloudmesh/
  main.py              # CLI entry point (286 commands)
  requirements.txt     # Python dependencies
  core/
    server.py          # SSH server management
    monitor.py         # Resource monitoring
    scheduler.py       # Task scheduling
    node_client.py     # TCP node communication
    jobs.py            # Async job system
    gpu.py             # GPU telemetry
    features.py        # 20 utility features
    advanced.py        # 10 advanced features (API, DDoS, scheduler, etc.)
    security.py        # Encryption and audit
    ssh_util.py        # Centralized SSH with host key verification
    transfer.py        # File transfer
    sync.py            # Directory sync
    deploy.py          # Package deployment
    alerts.py          # Threshold alerts
    groups.py          # Device groups
    dashboard.py       # Live dashboard
    tui.py             # Interactive TUI
    history.py         # Command history
    cmdlog.py          # Immutable command ledger (SHA-256 hash chain)
    service.py         # Service management
    docker.py          # Docker management
    firewall.py        # Firewall management
    sslcheck.py        # SSL certificate monitor
    logagg.py          # Log aggregation
    reshistory.py      # Resource history
    plugins.py         # Custom plugins
    acl.py             # Multi-user ACL
    webhooks.py        # Webhook integrations
    watcher.py         # Process watcher
    cost.py            # Cost estimator
    tunnels.py         # SSH tunnel manager
    database.py        # Database manager
    ddos.py            # DDoS protection (rate limiter, ban list, slowloris guard)
    panic.py           # Emergency key rotation + remote rotation + pending retry
    weather.py         # Resource weather forecast
    gossip.py          # Distributed trust evaluation
    checkpoint.py      # Job checkpoint manager
    shamir.py          # Shamir Secret Sharing over GF(p)
  node/
    cloudmesh_node.py  # Standalone node agent (SPA, DDoS, TLS)
  tests/
    test_security.py   # 58 security tests
  data/                # Auto-created config/state files

Requirements

Component	Requirement
Controller	Python 3.8+, SSH client
Node Agent	Python 3.8+ (auto-installed)
OS	Windows 10+, Linux (Ubuntu/Debian/CentOS/Arch)

Dependencies (auto-installed)

rich -- Beautiful terminal UI
paramiko -- SSH connections
psutil -- System monitoring
cryptography -- File encryption

Troubleshooting

Download fails from installer

Make sure you have internet access. The installer downloads from GitHub. If behind a proxy, download the files manually from this repo.

Node not connecting

# Check node is running
~/.cloudmesh-node/status.sh

# Restart node
~/.cloudmesh-node/start.sh

# Check port is open
netstat -tlnp | grep 9999

Auth failed error

# Get the key from the node
cat ~/.cloudmesh-node/.node_key

# Re-add with correct key
cm add -n NAME -H HOST -u root -p 9999 -k YOUR_KEY

Module not found errors

# Reinstall dependencies
cm version    # Shows Python path
pip install -r requirements.txt

API returns 401 Unauthorized

# The API key is printed when starting the API
cm api --port 8080

# Use the key in your requests
curl -H "X-Api-Key: YOUR_KEY" http://127.0.0.1:8080/api/status

SSH connection rejected

CloudMesh uses RejectPolicy for security. Add the host to known_hosts first:

ssh-keyscan -H SERVER_IP >> ~/.ssh/known_hosts

SPA mode: node refuses to start

SPA mode requires iptables. If the DROP rule fails, the node will refuse to start to avoid exposing the TCP port unprotected. Run as root or check iptables permissions.

Panic: some nodes were offline

# Retry pending rotations when nodes come back online
cm panic retry-pending

License

MIT License - Free to use, modify, and distribute.

Created and Developed by MRSX PRO

GitHub: ALI88708

Repository: CloudMesh

Star this repo if CloudMesh helps you! It motivates us to keep building.

Star on GitHub

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
cloudmesh		cloudmesh
docs		docs
scripts		scripts
site		site
.gitattributes		.gitattributes
.gitignore		.gitignore
1.ico		1.ico
1.png		1.png
CHANGELOG.md		CHANGELOG.md
CONTRIBUTING.md		CONTRIBUTING.md
License		License
README.md		README.md
SECURITY.md		SECURITY.md
cm_for-bsd.sh		cm_for-bsd.sh
cm_for-linux.sh		cm_for-linux.sh
cm_for-windows.bat		cm_for-windows.bat
pyproject.toml		pyproject.toml

Latest commit

History

Folders and files

Repository files navigation

CloudMesh

One Console to Control Them All

Made By MRSX PRO

Why CloudMesh?

Project Website

Quick Start

GitHub release (Recommended)

Windows (Installer)

Linux (Installer)

FreeBSD / OpenBSD / NetBSD (Installer)

Supported Platforms

Update

First Steps

Architecture

Versioning Policy

Changelog - All Versions

v4.2.6 (Latest)

v4.2.5

v4.2.4

v4.2.3

v3.1.0

v3.0.2

v3.0.1

v3.0.0

v2.3.2

v2.3.1

v2.3.0

v2.2.0

v2.0.0

New Commands

Security Patches (v2.0.0)

CI/CD

v1.5.0

v1.4.0 - Security Hardening

v1.3.0 - Ghost Ports and Tripwire

New Commands

v1.2.0 - Security and Intelligence

New Commands

Complete Command Reference

Server Management

Monitoring

Node Management

Node Jobs

Smart Task Queue

Docker

Firewall

SSL Monitoring

Logs

File Operations

SSH Keys (v2.0.0)

Configuration (v2.0.0)

Shell Completions (v2.0.0)

Webhooks and Alerts

ACL and Security

SSH Tunnels

Database

Schedule

Notifications

Utilities

Advanced

Resource History

Examples

Add a Server

Monitor Everything

Run Commands Everywhere

Quick Status

Docker Management

Firewall Management

SSL Monitoring

Webhooks

SSH Tunnels

Database Management

Auto-Discovery

Notifications

Schedule Tasks

Immutable Command Ledger