pyre

README

pyre

A terminal UI for Palo Alto firewalls. Answers the questions you'd otherwise click through thirty tabs of the PAN-OS web UI to find.

Why pyre?

The PAN-OS web interface turns every question into a sequence of clicks — system info, then policies, then sessions, then logs. Each view is a separate page load.

pyre combines those calls into unified terminal views: system health, HA, resource usage, and sessions in one dashboard; instant filter and sort on policies, sessions, and objects; no context switches. Built for network engineers who want answers fast.

Features

• Dashboards — system, network, security, VPN at-a-glance
• Policies, NAT, objects — browse, filter, sort, hit-count analysis, inline detail
• Sessions, routes, interfaces — live state with substring filter and per-view sort
• VPN — IPSec tunnel status + GlobalProtect connected users
• Logs — system / traffic / threat with cycle-on-key
• Panorama — connect to Panorama and target managed firewalls; the same views, scoped per device
• Multi-firewall — connection hub + quick picker (:)
• Command palette — Ctrl+P fuzzy-jumps to any view
• 10 themes — nord, dracula, catppuccin, gruvbox, …

Install

Download a binary from Releases. Archives ship with an SPDX SBOM and a shared checksums.txt.

# macOS / Linux
tar -xzf pyre_<version>_<os>_<arch>.tar.gz
chmod +x pyre
sudo mv pyre /usr/local/bin/pyre

Windows: extract the .zip, drop pyre.exe on your PATH.

Or build from source (Go 1.26+):

go install github.com/jp2195/pyre/cmd/pyre@latest

Verifying releases

Every release is checksummed, signed, and attested at build time:

• checksums.txt — SHA-256 checksums covering every archive.
• checksums.txt.sig / checksums.txt.pem — Sigstore cosign keyless signature, tied to this repo's release workflow identity.
• GitHub build provenance (SLSA) — ties each archive to the exact Actions run that built it.

# 1. Verify the checksum file's signature (requires cosign 2.x)
cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/jp2195/pyre/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

# 2. Verify your downloaded archive against the signed checksums
sha256sum --check --ignore-missing checksums.txt

# 3. (Optional) Verify build provenance with the GitHub CLI
gh attestation verify pyre_<version>_<os>_<arch>.tar.gz --repo jp2195/pyre

Quick start

# one-off
pyre --host firewall.example.com --api-key YOUR_API_KEY

# env var
export PYRE_API_KEY=...
pyre --host firewall.example.com

# saved connection
cat > ~/.pyre.yaml <<'YAML'
default: 10.0.0.1
connections:
  10.0.0.1:
    insecure: true
YAML
pyre -c 10.0.0.1

[!IMPORTANT] pyre does not persist credentials. Supply an API key at each invocation via --api-key, PYRE_API_KEY, or per-host PYRE_<HOST>_API_KEY. If none is provided, pyre prompts for username + password, runs keygen, and uses the resulting key for the current session only. ~/.pyre.yaml never contains credentials.

For private-CA firewalls, use ca_cert_path: /path/to/ca.pem in the connection config instead of --insecure.

What it looks like

Navigation

Three numbered groups: 1 Monitor (dashboards), 2 Analyze (list views), 3 Tools (config). Same number again — or Tab — cycles sub-views in the group. Ctrl+P opens a fuzzy command palette that jumps anywhere.

Inside a list view: / filter, s cycle sort, Enter open detail, r refresh, ? help, q quit.

New to pyre? The "first 60 seconds" section of Getting Started walks the model in one read. Full key reference: docs/keybindings.md.

Documentation

• Getting Started — install, first connection, and a 60-second navigation walkthrough
• Configuration — ~/.pyre.yaml, env vars, CLI flags, credential resolution
• Keybindings & Navigation — every key in every view
• Panorama — managing devices through Panorama
• View reference — what each view shows and how its filter / sort / detail panel work

Contributing

Bug reports, feature ideas, and docs PRs all welcome. See CONTRIBUTING.md for the setup and PR process.

License

Apache 2.0. See LICENSE.