Secure fleet management for Raspberry Pi clusters — backups, patching, containers, and control with zero plaintext secrets.
After 30+ years as an engineer, senior cybersecurity leader, tinkerer, hacker, and 3D designer/builder, I got tired of brittle bash scripts and manual processes across my Raspberry Pi clusters and homelab.
PiHerder was born the same way many great tools are: scripts that automate the boring stuff so I could focus on building and securing systems. It replaces manual workflows with an auditable web UI while keeping secrets encrypted at rest and never storing plaintext.
Inspired by projects like Nginx Proxy Manager — simple, powerful, self-hosted tools that just make life easier.
- SSH key management with encrypted private keys
- Backups, OS patching (apt), HAOS hosts via SSH +
haCLI check/apply, container patching with schedules - Docker Compose browser, multi-file editing, compose sets (multiple compose files under one project), inventory cache
- Service templates (deploy wizard, variables, preview/confirm)
- Integrations: Uptime Kuma, Grafana, Pi-hole (v6), Nginx Proxy Manager + cert management
- LAN Discovery (opt-in nmap worker, devices, schedules, Hosts map overlay)
- Network Maps (DNS fabric, logical/physical topology, service paths, runtime stack view groups)
- PWA + Web Push notifications
- RBAC, 2FA (TOTP + passkeys), optional SSO/OIDC (v1.2), audit trail, self-backup with full DR
- Token REST API for automation (n8n, Home Assistant, etc.)
See the full Getting Started guide.
- Clone this repo or copy
.env.example→.env - Generate
PIHERDER_MASTER_KEY(critical) - (Recommended) Set hostname + trusted TLS certs for PWA/push
docker compose up -d(pulls multi-archbjorngluck/piherder:latest)- Register first admin user and start adding servers
PiHerder is now open source under the MIT license. Contributions, issues, feature ideas, and PRs are very welcome.
See CONTRIBUTING.md for details.
If you find PiHerder useful, consider sponsoring the project or buying me a coffee — it helps fund continued development and infrastructure.
- Full docs & wiki: piherder-docs.hacknow.info
- Admin guide: docs/ADMIN.md
- Ecosystem roadmap: docs/ROADMAP_ECOSYSTEM.md
- Current production: docs/RELEASE_v1.1.1.md (patch on 1.1 — SSH test / host dependency check); feature notes docs/RELEASE_v1.1.0.md
- Active train: docs/PLAN_v1.2.0.md on
v1.2.0-dev(WebAuthn · SSO · webshell · gated demo · backup retry) - Prior: docs/RELEASE_v1.0.0.md · docs/RELEASE_v0.9.0.md · operator wiki LAN Discovery · HAOS hosts
- Plan (1.1 archive): docs/PLAN_v1.1.0.md
- API reference: docs/API.md
FastAPI + SQLModel + PostgreSQL + Paramiko + cryptography (Fernet) + Jinja2 + Tailwind + HTMX + Alpine + APScheduler + Celery.
Offline / air-gapped ready — Once built, the container has no external CDN dependencies.
MIT — see LICENSE.
Repository: github.com/bjorngluck/piherder