otty / apps

All apps/Teleport tsh

Teleport tsh

tsh

Teleport provides connectivity, authentication, access controls and audit for infrastructure.

Runs as tsh|macOS, Linux, Windows|goteleport.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

Teleport tsh in your home directory Every rule on this page, by file

· config/config.yaml Sync

· keys/ Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/tsh/otty.tomlThe file this page is generated from

id = "tsh"

name = "Teleport tsh"

homepage = "https://goteleport.com"

description = "Teleport provides connectivity, authentication, access controls and audit for infrastructure."

icon = "theSVG:teleport"

executables = ["tsh"]

[dotfiles]

# tool/tsh/common/tsh.go declares the loaded configuration as

# "TSHConfig is the loaded tsh configuration file ~/.tsh/config/config.yaml",

# and reads command aliases, proxy templates and extra headers out of it. That

# one file is the hand-written part of ~/.tsh.

paths = ["~/.tsh/config/config.yaml"]

exclude = []

# api/profile/profile.go: "Package profile handles management of the Teleport

# profile directory (~/.tsh)", and api/utils/keypaths/keypaths.go puts the

# session keys under it — sessionKeyDir = "keys", holding the user's private

# key, its SSH certificate and the per-cluster TLS certificates. Short-lived,

# but credentials while they live.

# The rest of ~/.tsh is neither config nor secret and is simply not synced:

# `current-profile` and the per-proxy <proxy>.yaml profiles are this login's

# state, and `known_hosts` is per-machine trust state.

secret = ["~/.tsh/keys/"]

# Parsed at the start of a tsh command; the long-lived process is the proxy on

# the other end, not this file's reader.

side_effect = false

# No machine_lines. The config file holds aliases, proxy templates and extra

# headers — things a user sets once and wants on every laptop. What is pinned

# to one machine in ~/.tsh is the certificate material, and that is covered by

# `secret` above rather than by a line rule.

[commands]

format = 1

label = "Teleport tsh"

description = "Log in to a Teleport cluster, list nodes and open SSH sessions. Databases, Kubernetes, apps and access requests are left out."

quality = "ai-draft"

base = "fig:tsh"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/tsh.ts"

license = "MIT"

[[commands.subcommand]]

path = ["login"]

label = "Log in"

description = "Log in to a cluster and fetch a session certificate."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/tsh.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "proxy"

label = "Proxy address"

type = "string"

option = ["--proxy"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "user"

label = "User"

type = "string"

option = ["--user"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "auth"

label = "Auth connector"

type = "string"

option = ["--auth"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "ttl"

label = "Minutes to live"

type = "string"

option = ["--ttl"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "insecure"

label = "Skip certificate verification"

type = "boolean"

option = ["--insecure"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "format"

label = "Output format"

type = "enum"

option = ["-f", "--format"]

choices = [{ value = "text", label = "Text" }, { value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "quiet"

label = "Quiet"

type = "boolean"

option = ["-q", "--quiet"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "login"

label = "Log in to proxy"

fields = ["proxy", "user", "auth"]

required = ["proxy"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["proxy", "user", "auth", "ttl", "format", "quiet", "insecure"]

[[commands.subcommand]]

path = ["ls"]

label = "List nodes"

description = "List remote SSH nodes."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/tsh.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "format"

label = "Output format"

type = "enum"

option = ["-f", "--format"]

choices = [{ value = "text", label = "Text" }, { value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "quiet"

label = "Quiet"

type = "boolean"

option = ["-q", "--quiet"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "proxy"

label = "Proxy address"

type = "string"

option = ["--proxy"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "ls"

label = "List nodes"

fields = ["format"]

required = []

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["format", "quiet", "proxy"]

[[commands.subcommand]]

path = ["ssh"]

label = "SSH to a node"

description = "Run a shell on a node through Teleport. Port forwarding options are left out."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/tsh.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "target"

label = "user@hostname"

type = "string"

position = 0

sources = ["fig"]

[[commands.subcommand.field]]

id = "login"

label = "Login name"

type = "string"

option = ["-l"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "port"

label = "Port"

type = "integer"

option = ["-p"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "agent"

label = "Forward auth agent"

type = "boolean"

option = ["-A"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "identity"

label = "Identity file"

type = "path"

option = ["-i"]

path = { kind = "file", role = "input", must_exist = true }

sources = ["fig"]

[[commands.subcommand.field]]

id = "no_tty"

label = "Disable pseudo-tty"

type = "boolean"

option = ["-T"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "quiet"

label = "Quiet"

type = "boolean"

option = ["-q"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "ssh"

label = "Connect"

fields = ["target"]

required = ["target"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["target", "login", "port", "agent", "identity", "no_tty", "quiet"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/tsh. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps the credential file out.