Forty legacy servers, forty URLs, zero keys on laptops

The company still runs forty servers that predate everything: old VPSes, on-prem boxes, the database host nobody dares migrate.

One Hoody container holds the SSH keys. Each server becomes a bookmark: the terminal URL with ?ssh_host=db-primary.internal&ssh_user=admin&ssh_key=/keys/db.pem. The container makes the SSH hop; the operator's browser only ever speaks HTTPS. Open the URL, you're on the box. Proxy permissions: IP whitelist, JWT: decide who can open which URL.

Nobody's laptop holds a private key. Offboarding an engineer means revoking their access at the proxy, not rotating forty servers' authorized_keys.