PMSS Fleet Manager

pmss-fleet-manager shows the Pulsed Media seedboxes and storage boxes you add to it on one web page: disk against quota, upload over the rolling 30-day window, torrents, containers, plan prices and renewal dates. It needs no root access: PMSS, the open-source software on every Pulsed Media seedbox and storage box, already gives your own login enough to read, and the Pulsed Media customer API returns the plan, renewal date and recorded usage of every service on the account. It is a community-made, open-source dashboard by GitHub user AlteredParadox and is not part of PMSS; Pulsed Media did not create it and does not maintain it.

What it does

One program runs on a computer you control, such as a home server, a NAS or a small VPS, and polls each box you add. The fleet view shows every box as a card or table row:

disk used against quota, and upload for the rolling 30-day window that PMSS tracks
live upload and download rates, torrent count and share ratio
CPU and memory used by your account
the qBittorrent version, with a flag when a newer release exists
plan name, price and next due date, when a Pulsed Media API key is set

Headline tiles add up storage, upload, bandwidth, torrents, containers, the next renewal and the monthly cost across all boxes.

Each box also has its own tabs: daily traffic bars, the qBittorrent torrent list, rootless Docker containers, disk use by top-level directory, and host load and memory. A fleet-wide torrents table lists every box's torrents in one place, busiest first.

Alerts fire for an unreachable box, a suspended account, disk or traffic at a threshold, a throttled account, qBittorrent or Docker down, a container that exited with an error, memory near the account limit, and a renewal that is close or overdue. Alerts resolve themselves when the cause clears.

How it connects

SSH as your own user

The dashboard logs in to each box over SSH with your box username and an SSH key, an ssh-agent or a password, and reads what your own account can read: your quota, traffic counters, processes, home directory and the server's load and memory. Monitoring installs nothing on the boxes and leaves only short-lived scratch files; it changes your files only when you use one of its actions. Host keys are trusted on first connect and pinned after that, so a changed key stops the connection instead of being accepted silently. The SSH page shows how to create a key and copy it to a box.

qBittorrent and Docker through the same connection

The dashboard reaches the qBittorrent WebUI and the rootless Docker socket through that SSH connection. Neither has to be opened to the internet. qBittorrent needs its WebUI username and password entered in the dashboard. Keep the WebUI login enabled, and do not tick either "Bypass authentication for clients on localhost" or "Bypass authentication for clients in whitelisted IP subnets" in qBittorrent's settings.

qBittorrent blocks an address after repeated failed logins, so the dashboard never retries a rejected password. It tries again once you re-save the password, or after you restart qBittorrent from the dashboard.

Installing

The project publishes Linux binaries for amd64 and arm64, with a SHA256SUMS file, and a container image for the same two architectures. There are no Windows or macOS binaries; there the container image is the published option. Use release 1.3.0 or later: it takes in the fixes described under Fixes submitted by Pulsed Media. The commands below install 1.3.0; the project's releases page lists any newer version, and its project page lists every flag and environment variable.

The binary

On a Linux machine you control, download the binary and the checksum file, check the download, and start it with a login of your own choosing (the command is saved in your shell history, so use a password you use nowhere else):

curl -fLO https://github.com/AlteredParadox/pmss-fleet-manager/releases/download/v1.3.0/pmss-fleet-manager-linux-amd64
curl -fLO https://github.com/AlteredParadox/pmss-fleet-manager/releases/download/v1.3.0/SHA256SUMS
grep linux-amd64 SHA256SUMS | sha256sum -c - &&
  chmod +x pmss-fleet-manager-linux-amd64 &&
  PMSS_AUTH='you:choose-a-long-password' ./pmss-fleet-manager-linux-amd64 -data "$HOME/pmss-fleet-manager-data"

On an ARM machine, write linux-arm64 wherever the commands say linux-amd64. The last three steps are joined with &&, so the file is only made executable and started when sha256sum prints OK for it. The dashboard then answers on http://127.0.0.1:8080 on the same machine and keeps its database, which holds your box logins, in the data directory; always start it with the same -data path, or it opens a new, empty database. It runs in the foreground and stops with Ctrl+C or when the terminal closes, so on a server run it inside screen or tmux, or as a systemd service.

The binary serves on 127.0.0.1:8080 by default, reachable only from the same machine. If it runs on a home server or a VPS, the simplest safe way to open it from your desktop is an SSH tunnel, a standard OpenSSH feature rather than part of the project: ssh -L 8080:127.0.0.1:8080 you@your-server, then browse to http://127.0.0.1:8080 on the desktop. For permanent access, put a reverse proxy with TLS in front of it; the proxy must pass the client's Host header through, port included (nginx: proxy_set_header Host $http_host;), and that name must be given to -allowed-hosts. On a home network you trust you can instead add the machine's own address with -listen, for example -listen 127.0.0.1:8080,192.168.1.10:8080; without TLS the dashboard's login then crosses the network unencrypted. From release 1.3.0 a login needs both a user and a password.

To upgrade, stop the dashboard, download the newer file the same way and start it with the same -data path. --version prints the version a file contains.

The container

docker run -d --name pmss-fleet-manager --restart unless-stopped \
  -p 127.0.0.1:8080:8080 \
  -v pmss-data:/data \
  -e TZ=Europe/Helsinki \
  -e PMSS_AUTH='you:choose-a-long-password' \
  ghcr.io/alteredparadox/pmss-fleet-manager:1.3.0

Set TZ to your own time zone: renewal days are counted in it, and without it the container uses UTC. --restart unless-stopped is a standard Docker option that starts the container again after a reboot. To upgrade, remove the container and run the same command with the newer tag; the pmss-data volume keeps the database. The container listens on all of its interfaces, so:

publish its port on 127.0.0.1 only, as above, and put a reverse proxy with TLS in front if you want to reach it from elsewhere; a hostname the proxy uses has to be listed, for example -e PMSS_ALLOWED_HOSTS=dash.example.com
it runs as uid 65532; a named volume works as is, while a bind-mounted data directory must be writable by that uid (chown 65532:65532 ./data), or start the container with --user "$(id -u)"
an SSH key must be readable by that uid. Copy the key, give the copy to uid 65532 and mount it read-only: mkdir -p ~/fleet-key && cp ~/.ssh/id_ed25519 ~/fleet-key/ && chmod 600 ~/fleet-key/id_ed25519 && sudo chown 65532:65532 ~/fleet-key/id_ed25519, then add -v ~/fleet-key/id_ed25519:/home/nonroot/.ssh/id_ed25519:ro to the command. A key with a passphrase works only through your ssh-agent; the project page says to mount the agent socket and pass SSH_AUTH_SOCK

Boxes are added in the web interface. Each box needs its hostname, your username and a way to log in; the SSH page shows how to put your public key on a box first. The add-box wizard connects, pins the host key and shows the quota, traffic limit, qBittorrent port and Docker socket it found before you confirm.

Using it safely

The dashboard holds the keys to every box you add and acts with your full account rights on each of them. Run it on a computer you control, not on a seedbox or any other shared server.

What	Details
Reads from each box	Quota, traffic counters, process and memory use, directory sizes, qBittorrent and Docker state, all through your own SSH login
Can change on each box, when you use the action	Add, stop, start and remove torrents (with or without their files), pause or resume all torrents, switch DHT, PeX and local peer discovery, start, stop and restart containers and qBittorrent, run the start command you set for a box, and, for autostart, write `~/bin/qbt-start` if it is missing and set crontab lines that run it at boot and every five minutes, replacing earlier lines that run only that helper and saving the previous crontab to `~/.config/pmss-fleet-manager/crontab.bak` first
Installs on each box, when you choose install client or update client	A third-party static qBittorrent build in `~/bin`, downloaded by the box from a GitHub release by default and checked against the sha256 GitHub publishes for that file; from a download URL outside GitHub it is installed without a checksum check
Stores on its own machine	Box credentials and the API key in plain text in its SQLite file (mode 0600, directory 0700)
Contacts elsewhere	GitHub, every six hours and when you install or update qBittorrent, and the Pulsed Media customer API, when a key is set

Always set a dashboard login with -auth user:password (PMSS_AUTH in the container), even on a computer only you use. If you reach it from another machine, serve it over TLS through a reverse proxy; the proxy does not add a login by itself.
In the container, list host names in PMSS_ALLOWED_HOSTS. The container serves localhost and IP addresses; a host name you open it by, such as a reverse proxy's, is refused until it is listed.
Use an SSH key made for the dashboard instead of a box password. On a Pulsed Media service, SSH uses the same service login as the web dashboard and SFTP, so a saved box password opens all three. A key with a passphrase works through an ssh-agent, not from a key file.
Remove with files deletes the data from the box.

Troubleshooting

The container exits at start. Its data directory is not writable by uid 65532. Change the directory's owner or start the container with --user.
SSH key login fails only in the container. The mounted key file is not readable by the uid the container runs as.
Opening the dashboard by name is refused. Add that host name to -allowed-hosts (PMSS_ALLOWED_HOSTS). Behind a proxy, also check that the proxy passes the original Host header through unchanged.
A box reports a changed host key. This usually follows a reinstall or a move to another server, but it can also mean a different machine is answering at that address. Before telling the dashboard to forget the old key, compare the new key's fingerprint with the one your own SSH client shows when you log in from another network. After a forget, the next connect trusts whatever key answers, and a box that logs in with a saved box password sends it to that key's server, so move such a box to key login first, or change the box password afterwards.
qBittorrent shows a rejected login. Enter the correct WebUI username and password in the dashboard. If qBittorrent has blocked logins after repeated failures, the dashboard waits about an hour before it tries again.
A box stays offline. Failed polls back off up to every ten minutes. "Retry now" on the box card reconnects at once.
Plan and renewal data never appear. Check that the API key was copied in full, and that the box's hostname and username in the dashboard match the service. Releases before 1.3.0 reject the whole Pulsed Media feed when a CPU-hours value has a decimal; update to 1.3.0 or later.

License and source

pmss-fleet-manager is released under the GNU Affero General Public License, version 3 or later. Source, releases and the issue tracker are at github.com/AlteredParadox/pmss-fleet-manager. Report bugs and feature requests there, not to Pulsed Media support.

At Pulsed Media

Pulsed Media seedboxes and storage boxes give SSH access as your own user and appear in the same customer API answer, so one dashboard can cover a mix of them.

The Pulsed Media API key

Plan, price and renewal data come from the Pulsed Media customer API. Only the account owner can create a key, in the client area at https://pulsedmedia.com/clients/index.php?m=pmapi. Leave the box that lets the key place orders unticked: a key that is not allowed to order cannot change anything. The key flow and the fields it returns are described in the knowledgebase article Does Pulsed Media offer public data feeds or an open API?

The dashboard matches services to boxes by hostname and username and refreshes the feed every six hours or on demand.

qBittorrent enabled in your box's web panel

When qBittorrent is enabled for an account in the box's own web panel, PMSS starts it, keeps it running and applies its settings. From release 1.3.0 the dashboard shows such an account as panel-managed, keeps monitoring it, and declines to install or autostart a second qBittorrent. Manage it from the web panel, including restarts; after a restart there, save the WebUI login in the dashboard again if it shows a rejected login.

Fixes submitted by Pulsed Media

In October 2026 Pulsed Media read the project's source and submitted fixes as pull request #72, including fractional CPU-hour values in the feed, the container's host-name check, autostart's crontab handling, panel-managed qBittorrent, https-only downloads for the qBittorrent installer, and the host-key forget flow. The author merged them, with changes, into release 1.3.0. Pulsed Media has not run the dashboard against its servers, and submitting fixes is not an endorsement.

Plans with SSH access as your own user are listed on the seedbox and storage box pages.