Install Vulos

On a mini-PC, laptop, or Pi: download the .img.gz from Releases and write it with Balena Etcher (drag, pick drive, flash) — or on the terminal:

dd if=vulos-x86_64.img of=/dev/sdX bs=4M

Then boot from it. No USB stick? Netboot over a phone tether instead. Every artefact is signed and verified before it runs.

Renting a VPS instead? Skip to the next step.

No spare machine? Rent one — Vulos ships a bootable image, not a Linux package, so on all three the trick is writing that image to the server's own disk. Sizing floor for a full box: 2 vCPU, 4 GB RAM, 40 GB disk.

Hetzner Cloud — best price-to-performance

In the Hetzner Cloud console: new project → Add Server → a CX22 (2 vCPU / 4 GB), add your SSH key, and create it. Boot into Rescue, then write the image to the system disk:

wget https://github.com/vul-os/vulos/releases/latest/download/vulos-x86_64.img.gz
gunzip -c vulos-x86_64.img.gz | dd of=/dev/sda bs=4M status=progress
reboot

DigitalOcean — the gentlest console

Upload the raw .img under Images → Custom Images, then create a Droplet from that image (a 2 GB / 2 vCPU Basic Droplet is a fine box). No custom-image support in your region? Create any Droplet, boot the recovery ISO, and dd the image on exactly as with Hetzner above.

Fly.io — best suited to relay duty

Fly is CLI-first and container-shaped, so it fits a relay better than a full desktop box:

fly launch --image ghcr.io/vul-os/vulos:latest --no-deploy
fly ips allocate-v4          # a dedicated public IPv4
fly secrets set VULOS_ROLE=relay
fly deploy

Fly Machines can idle-stop; if this is a relay that must always answer, keep min_machines_running = 1 in fly.toml.

Browse to the machine — http://localhost:8080 on the box itself, or https://<your-server-ip> for a VPS. A fullscreen wizard walks you through it — just pick New:

• A username + a password (no third-party login)
• Your @vulos username
• Apps & optional backup bucket
• Save your recovery kit

Setup finishes and you land on a real desktop. Three things to try — ⌘K for the command palette, F3 for Mission Control, and Files in the dock for your drive.

Open App Hub to add more: the default install is the full suite — Diwan, Files, the AI assistant — all opt-out. Want your inbox on the box? Add the mail connector and bring your own Gmail/Outlook/IMAP.

Add an A record for a domain you own, pointed at the box’s public IP — Vulos provisions TLS for it automatically, no separate reverse proxy needed for the flashed image or Docker paths.

Building from source and deploying over SSH instead? ./build.sh --deploy <host> --domain <yourdomain> sets up Caddy for you: a dedicated caddy system user, a Caddyfile with site blocks for $DOMAIN and *.$DOMAIN, and a caddy.service systemd unit that terminates TLS and reverse-proxies to the Go backend on :8080. Re-running the same command on an existing deploy just restarts Caddy.

The box owns its own firewall — only the ports Vulos needs are open. Nothing else to harden.

Home internet hides a box behind a router — nothing outside can knock on its door directly (this is NAT). The fix is a relay: your box dials out to a machine with a public IP and holds that line open, so it never has to open a port. Vulos the org runs no relay for you — this is something you stand up yourself, and it’s just Vulos running in relay mode on a box you already know how to boot:

# on a public-IP VPS (see the VPS step above)
vulos relay serve --listen 0.0.0.0:4711 --domain relay.example.org

It prints a relay address. On the box you want reachable, open Settings → Network → Relay & Reachability, choose Vulos relay, and paste it in. Already have a public IP on this box? Pick Direct instead — no relay needed. Want an alternative broker alongside your own relay? Pier is wire-compatible and experimental.

The relay forwards ciphertext between you and your box; it never holds or reads your content.