Integration

SSH keys, hosts, and files

fd0 stores SSH keys and host entries as scope-shared secrets. The agent serves keys over the standard ssh-agent protocol. Host entries render to ~/.ssh/fd0.conf.

Enable native ssh

$ fd0 ssh enable
$ export SSH_AUTH_SOCK="$(fd0 ssh sock)"

fd0 ssh enable writes the fd0 config file and adds an Include line to ~/.ssh/config with confirmation. After that, normal ssh, git, scp, and compatible tools can use fd0 keys.

Add a key and host

$ fd0 key add laptop --scope work
$ fd0 ssh add prod-db app@db.internal --key laptop --scope work
$ fd0 sync

$ fd0 ssh prod-db
$ ssh prod-db

fd0 key add <name> [--import <path>]

Generate an ed25519 key, or import an existing OpenSSH key. Private bytes stay encrypted in fd0.

fd0 ssh add <alias> [user@]host[:port] --key <name>

Create a structured host entry and re-render ~/.ssh/fd0.conf.

fd0 ssh ls

List host aliases.

fd0 ssh show <alias>

Show the host record and rendered ssh_config block.

fd0 ssh rm <alias>

Remove the host entry and re-render the config.

Browse and transfer files

In fd0 Desktop, open an SSH host and choose Browse files. The dedicated Files window supports navigation, drag-and-drop uploads, downloads, folders, rename, delete, progress, and cancellation. It uses the same host, key, jump host, and strict host verification as fd0 ssh.

$ fd0 sftp prod-db
$ fd0 sftp ls prod-db /var/log
$ fd0 sftp tree prod-db /srv/app --depth 2
$ fd0 sftp cp prod-db ./release.tar remote:/tmp/release.tar
$ fd0 sftp cp prod-db remote:/var/log/app.log ./app.log

fd0 sftp <host>

Open the native interactive SFTP client with fd0's exact rendered SSH configuration.

fd0 sftp ls <host> [path] [--json]

List a remote directory. Use --json for scripts.

fd0 sftp tree <host> [path] [--depth N]

Print a bounded remote tree. The default depth is 3.

fd0 sftp cp <host> <source> <dest>

Upload or download. Mark exactly one side with remote:, and add --recursive for directories.

fd0 sftp mkdir|mv|rm …

Manage remote paths. Non-interactive recursive delete requires both --recursive and --yes.

Transfers do not weaken host verification and never follow remote symlinks recursively. Existing destinations require an explicit --force; existing directory trees are never replaced implicitly.

Desktop file sessions are non-interactive: unlock fd0 first and assign a usable key to the host. If a host is new, open it in Terminal and verify its fingerprint before browsing files. A server without an enabled SFTP subsystem can still work in Terminal, but not in the Files window. Transfers stop when that window closes; fd0 is a file browser, not a background synchronization service.

Team sharing

Keys and hosts belong to scopes. Add a teammate to the scope and their next fd0 sync pulls the same key and host inventory. Nativessh works after that teammate enables fd0 SSH once on their device so their SSH config includes fd0 and SSH_AUTH_SOCK points at the fd0 agent. Remove them and the scope key rotates for future changes.

What fd0 does not do

fd0 does not edit remote sshd_config, deployauthorized_keys, or run ssh-copy-id. Use your normal provisioning tool for remote machines.

← Previous

Browser extension

Talos & Kube