qssh 0.5.0

Post-quantum secure shell with NIST PQC algorithms (Falcon, SPHINCS+, ML-KEM), configurable security tiers, and quantum-resistant protocol design
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116

services:
  # ── qsshd server ────────────────────────────────────────────────
  qsshd:
    build:
      context: .
      args:
        FEATURES: "sftp,hybrid-kex"
    container_name: qsshd-server
    ports:
      - "0.0.0.0:22222:22222"
    volumes:
      - qssh_etc:/etc/qssh
      - qssh_home:/home
      - qssh_logs:/var/log/qssh
    environment:
      - QSSH_LOG_LEVEL=info
      - QSSH_MAX_CONNECTIONS=100
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/localhost/22222' 2>/dev/null"]
      interval: 30s
      timeout: 3s
      retries: 3
      start_period: 10s
    networks:
      qssh_network:
        ipv4_address: 172.21.0.10

  # ── qsshd hardened (T3+ only, quantum-native frames) ───────────
  qsshd-hardened:
    build:
      context: .
      args:
        FEATURES: "sftp,quantum-native"
    container_name: qsshd-hardened
    ports:
      - "0.0.0.0:22223:22222"
    volumes:
      - qssh_hardened_etc:/etc/qssh
      - qssh_hardened_home:/home
      - qssh_hardened_logs:/var/log/qssh
    environment:
      - QSSH_LOG_LEVEL=info
    restart: unless-stopped
    networks:
      qssh_network:
        ipv4_address: 172.21.0.11
    profiles:
      - hardened

  # ── Client (for testing) ────────────────────────────────────────
  qssh-client:
    build: .
    container_name: qssh-client
    depends_on:
      qsshd:
        condition: service_healthy
    volumes:
      - qssh_client_keys:/home/qssh/.qssh
    environment:
      - QSSH_LOG_LEVEL=debug
    networks:
      - qssh_network
    entrypoint: ["/bin/bash"]
    command: ["-c", "sleep infinity"]
    profiles:
      - client

  # ── PQTG (Post-Quantum Transport Gateway) ──────────────────────
  # Provides QKD key delivery via ETSI GS QKD 014
  pqtg:
    image: paraxiom/coherence-shield:latest
    container_name: pqtg-gateway
    ports:
      - "127.0.0.1:8443:8443"
    environment:
      - PQTG_MODE=simulator
      - PQTG_KEY_RATE=1000
    networks:
      qssh_network:
        ipv4_address: 172.21.0.20
    profiles:
      - qkd

  # ── Coherence Shield (AI attestation proxy) ─────────────────────
  coherence-shield:
    image: paraxiom/coherence-shield:latest
    container_name: coherence-shield
    ports:
      - "127.0.0.1:3080:3080"
    volumes:
      - shield_keys:/root/.coherence-shield/keys
      - shield_audit:/root/.coherence-shield
    networks:
      qssh_network:
        ipv4_address: 172.21.0.30
    profiles:
      - shield

networks:
  qssh_network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.0.0/16

volumes:
  qssh_etc:
  qssh_home:
  qssh_logs:
  qssh_client_keys:
  qssh_hardened_etc:
  qssh_hardened_home:
  qssh_hardened_logs:
  shield_keys:
  shield_audit: