I built an Android SSH client for reaching my homelab without opening a port — Tailscale/Headscale, jump hosts, hardware-backed keys

I'm the developer of this; mods are welcome to remove it if it breaks the sub's rules. I'll be around all day to answer anything, including the parts that are still rough.

Two things pushed me to build it. First, every mobile SSH app I tried wanted my private key living on the phone. Second, half my boxes are behind CGNAT, so "SSH client" really means "SSH client plus a VPN plus a bastion plus whatever the cloud provider's auth flow is today".

What it does, self-hosting-relevant:
\- An embedded Tailscale node — the app joins your tailnet itself, no second VPN app and no system VPN slot. It also works against Headscale or your own control server.
\- Jump hosts — flag any host as a bastion and reach things behind it in one hop.
\- Cloudflare Access for hosts with no open port; AWS EC2 Instance Connect (per-session keys, dead after a minute) and GCP IAP for the cloud boxes.
\- Keys generated inside the phone's secure element and non-exportable, or a YubiKey over NFC, plus host-key pinning that warns you if a fingerprint changes.
\- Real terminal (xterm-256color — vim/htop/less behave), multiple sessions, SFTP, snippets, encrypted vault behind biometrics, QR host sharing.

Free vs paid, up front: the core is free — terminal, vault, hardware-backed and security keys, Tailscale including Headscale, jump hosts, snippets. Pro is a subscription ($3.99/mo or $39.99/yr) and adds the cloud provider integrations (AWS/GCP/Cloudflare), end-to-end encrypted cloud backup, session recording, unlimited live AI. Security features are free deliberately; I'm not going to charge people to be safer.

What's not good yet, so you don't find out the hard way: Android only (the iPad app is in development and not released); the YubiKey/NFC path is implemented but I have tested that on limited number of keys: Google Titan, Yubikey 5 nano.

On data: there's no analytics and no usage tracking; crash reporting is off by default, and if you switch it on it carries the stack trace and app/device version — never credentials or terminal output.

Play listing: https://play.google.com/store/apps/details?id=com.sshmanager.app
Site with the details: https://sshmanagerpro.app/features/

Tell me what's missing for your setup and I'll say honestly whether it's on the list or not.

Thank you!

https://redd.it/1x6fjkw
@r_SelfHosted