Skip to content

v0.3.0 public preview

Try a personal AI assistant
on this device. Yours forever.

Run it on your laptop now. Move it to a Pi 5, a NUC, or a $5 cloud VPS when you're ready — same image, same wizard. Apache-2.0, no telemetry, air-gapped tier included.

Try on this device → Move it to a Pi 5 later →

Apache-2.0 · works offline (air-gapped tier) · no telemetry · 15 hardware targets · or pick dedicated hardware →

Try here — 2 minutes

On the machine you're reading this on.

Not your OS? →

Detected: linux

Linux — local VM in 2 minutes

  1. Install qemu/KVM: sudo apt install qemu-system-x86 qemu-utils (or your distro's equivalent).
  2. Run the launcher:
curl -fsSL https://www.deputyos.com/try.sh | bash

Downloads the qemu-x86_64 qcow2, boots it on KVM, forwards the wizard to http://localhost:8088.

Move it permanently → Pi 5 · DigitalOcean

Detected: macos

macOS — UTM VM in 2 minutes

  1. Install UTM (free, App Store).
  2. Run the launcher:
curl -fsSL https://www.deputyos.com/try.sh | bash

Downloads the macos-qemu qcow2, walks you through the UTM import dialog, opens the wizard in your browser. A signed .dmg launcher is in flight (pending Apple Developer ID notarization).

Move it permanently → Pi 5 · DigitalOcean

Detected: windows

Windows — WSL2 in 2 minutes

  1. Open PowerShell as Administrator.
  2. Run:
wsl --install -d deputyos

Then visit http://localhost:8088/wizard. WSL2 required (Win10 21H2+ or Win11). A signed .exe launcher is in flight (pending Windows EV cert).

Move it permanently → Pi 5 · DigitalOcean

Detected: android

On your Android? deputyOS lives on a server.

Easiest path: install on your nearest laptop now, then talk to your assistant from your phone (Telegram, Signal, WhatsApp, or the PWA).

Read the laptop guide → Or €4/mo on Hetzner

Flash to online in about ten minutes

Flash the image, boot the device, finish the wizard in a browser, and the assistant is online Flash ~2 min Boot ~3 min Wizard ~5 min Online done

Where to run it

Try locally first. Commit when you're ready.

One image, three deployment paths. Start on the laptop you're reading this on — when you outgrow it, move to a Pi or a cloud VPS without re-learning anything.

  • ~2 min

    Try now on this device

    Local VM via UTM (macOS), WSL2 (Windows), or qemu/KVM (Linux). No SD card, no flashing, no monthly bill. Throw it away with one command if you don't like it.

    Jump to the install card →

  • ~15 min

    Move it to a Pi / NUC

    Flash an SD card, boot, scan the QR on HDMI. Permanent home for ~$80 once. Quiet, low-power, always on.

    10-minute Pi 5 walkthrough →

  • ~4 min

    Or a $5 cloud VPS

    DigitalOcean / Hetzner / Linode / Oracle (free tier). Always-on without owning hardware; delete the droplet anytime.

    $4/mo DigitalOcean walkthrough →

What you get

An appliance, not a fragile install

Zero first-boot installs. Security baseline on by default. Signed, atomic updates with watchdog rollback. Three profiles ship today.

The first-boot wizard runs in a browser at deputyos.local, reached by scanning a QR code shown on HDMI deputyos.local Choose profile Add API key Link account Finish setup QR on HDMI

First-boot wizard

mDNS publishes deputyos.local on first boot. Scan the QR shown on HDMI; finish the setup on your phone. No SSH, no terminal.

Read the walkthrough →

The dashboard shows device status, spend, mounts and CVE state across every linked device Fleet 3 Devices 3 Online $0.42 Today pi5-study up to date nuc-office up to date hetzner-01 up to date

Always-on PWA

A small Progressive Web App for status, logs, key rotation, cost graphs, audit evidence, and CVE status across linked deputyOS devices.

How drive mounting works →

Choosing hardware, profile and tier resolves a signed image from the manifest, with checksum and attestation Hardware rpi5 Profile openclaw Tier standard manifest deputyos-rpi5 v0.3.0 · img.xz SHA256 verified minisign signature SLSA attestation Download signed image Checksum and signature published alongside every artefact

Picker + signed manifest

The picker reads the signed manifest from cdn.deputyos.com. Pick hardware, profile, tier, channel — get a verified download link.

Trust chain explained →

One or many

One machine or ten, from one console

Home-server operating systems assume a single box, so running five means five browser tabs and five upgrade decisions. deputyOS treats the fleet as the unit: live status, updates pushed to a selection, allow-listed commands across a group, and per-device spend — with nothing forwarded on any router. Tracking every device you run is free; paid plans cover the ones you want us to host.

Three devices on separate networks — a Raspberry Pi behind home NAT, a mini-PC behind office NAT, and a cloud VPS — each hold an outbound tunnel to the deputyOS control plane, which a single console queries to manage all of them Home network · behind NAT Raspberry Pi 5 deputyd · agent running Office network · behind NAT Mini-PC deputyd · agent running Cloud VPS · public IP Hetzner CX22 deputyd · agent running outbound only — no ports forwarded api.deputyos.com tunnel relay · control plane console.deputyos.com one view · status, updates, spend
Each device opens the connection outward and holds it, so nothing needs forwarding at any of the three sites. Requests from the console travel back down a connection that already exists.

How this compares with Umbrel, Proxmox and CasaOS →

Why deputyOS

A real alternative to SaaS assistants

Batteries included

Every runtime, native module, model file, and signature DB lives in the image. No first-boot apt, npm, pip, or git clone ever runs on your device. Why this matters →

Air-gapped tier

Build with AIRGAP=1. The image bakes LFM2 via llama.cpp, locks egress at nftables, works with -net none.

Your files, the agent's hands

Mount host folders, auto-mount USB on bare metal, attach SMB / NFS shares — every mount is reviewable + revocable in one click. Drive-mount system →

Security on by default

AppArmor enforce, ufw default-deny, fail2ban, hardened sysctls, ClamAV signatures pre-loaded, Magika hooked into the agent's file-upload path. No checkbox required.

Three profiles

Pick the assistant that matches your job

Switch between them with deputyctl profile switch <id>. Memory persists per profile. Adding a fourth requires no Rust changes — just a manifest + a bake recipe.

Full comparison: pick the right one for your use case →

From the blog

Read more

All posts →

Search

Search index isn't built yet. Run npm run build to generate it (Pagefind writes to dist/pagefind/).