New here? You've got a computer or two and something you'd like to put online, and you don't fancy a weekend of server setup. These four guides, from us at Earnest Ventures (the people who make Orchy), take you from nothing to an app with its own web address. Each one is a handful of commands you can copy, and by the end you'll know how to start your orchy (that's what we call your joined-up group of computers), put an app on it, add a second device, and let visitors in.
Orchy joins your laptops, home servers and rented cloud machines into one small cloud that looks after itself. It's a single program. There's nothing else to install first, it doesn't need administrator (root) rights to run, and it can wake a sleeping app in under a second. If you've ever given up on Kubernetes (the heavyweight tool big companies use to run apps on servers) halfway through the install guide, you'll find this a lot shorter.
$ mkdir -p ~/.local/bin && curl -fsSL https://orchy.p6m.onl/releases/orchy-linux-amd64 -o ~/.local/bin/orchy$ chmod +x ~/.local/bin/orchy$ orchy versionorchy (CLI) v0.1.0 (91c79ec)orchyd (daemon) v0.1.0 (91c79ec)✦ your orchy · ready
orchy up. That device becomes your brain: it keeps the records and decides which device runs which app. It also opens the front door, where visitors from the internet arrive, and gives you a join code. That's a one-time password your other devices use to get in:$ orchy up --name orchystra✦ orchy [orchystra] ✦ your orchy is ready 🪐╭────────────────────────────────────────────────────────────────────────────╮│ ✨ Your orchy starts on epic-nas ││ ││ ● Device: epic-nas (linux/amd64 · 16 GB · ⚡ uptime 14d) ││ ● Role: 🧠 brain · always on ⚡ (scheduling, data, control) ││ ● Fabric store: 🔮 kept in ~/.local/share/orchy/store │╰────────────────────────────────────────────────────────────────────────────╯✦ Discovered Network Reachability:📡 Local Network (LAN): 192.168.1.50:7946 (Same local Wi-Fi network only)✦ Ready-to-Share Join Invitations:(Each ticket bundles all network routes and sets the right permissions automatically)👑 1. Your own device:orchy up orchy1_AgAE4WPWrAkVUteChY3…(Grants: co-brain · shared storage · a full vote)join other devices: orchy join orchy1_AgAE4WPWrAkVUteChY3…web console: http://localhost:8888/dashboardepic-nas ▸ brain · healthy
orchy doctor checks your orchy over, tells you what's wrong in plain words, and offers to fix it. If you'd rather click than type, orchy web opens a dashboard in your browser:$ orchy doctor✦ orchy doctor ✦ Your orchy health scan 🪐──────────────────────────────────────────────────────────────────────────────✓ daemon socket: connected (~/.local/share/orchy/orchy.sock)✓ node identity: valid (role: brain)✦ warp tunnel: not configured (local front door only)✓ router upnp: mapped ✦ (:7946 → 198.51.100.1:7946)✓ fabric store: online (only brain so far; invite friends to reach 2 copies)──────────────────────────────────────────────────────────────────────────────✨ Your orchy is healthy and running smoothly!$ orchy web✦ Orchy Web Dashboard ✦▶ URL: http://localhost:8888/dashboardRole-aware interface: active features dynamically adapt to this device's authority.
Say you've written a little recipe site for your family (a made-up example, but you get the idea). You don't have to explain it to Orchy. Orchy reads the project folder, and it knows its way around Go, Node.js, Python, Ruby, Rust and Dockerfiles (the recipe files Docker uses to build an app). It works out which port your app listens on (a port is a numbered door on a computer that a program answers at), bundles the app into one package it can check hasn't been tampered with, and sets up HTTPS, the padlock in the browser, at the front door for you.
orchy deploy. Orchy shows you its plan before it does anything: the port, the health check (a page Orchy can ask "are you OK?"), how many copies of the app to run, the memory and CPU limits, and how boxed-in the app is. Every line has a number. Don't like one? Type its number and change it. Two defaults to know about: sleep-when-idle starts off, and the app runs raw (owner isolation), which means there's no sandbox fencing it off from the rest of the machine. Change lines 9 and 17, or pass --isolation, if you want something else:$ cd ~/repos/studio && orchy deploy✓ analyzed: go · entrypoint: ./studio · port 8080orchy deploy — proposalI read the codebase; here's the plan. Disagree with any line?(type a line number to change it, then hit enter to accept)📡 REACHABILITY2 port 8080 default convention · also read from $PORT env var3 health /healthz source: route registered in main.go:5💾 STATE4 storage none (stateless)🚀 DEPLOYMENT7 entrypoint ./studio main pkg convention → ./studio8 copies 1 how many devices run the app at once9 sleep when idle no stop the process when idle; the next request starts it15 memory 384Mi memory limit16 cpu 300m cpu limit17 isolation owner owner (raw), soft (guarded), strong (jailed), max (sealed)accept: [enter] · change: `orchy deploy <n> <val>` · reset: `reset <n>` · quit: `q`
orchy.json (optional)orchy.json file at the top of your project folder (your repository, if you use git) and orchy deploy will follow it instead of asking. It also means a teammate, or you in six months, gets exactly the same setup:{"apiVersion": "orchy/v1alpha1","kind": "Session","metadata": { "name": "writing-studio", "tenant": "default" },"spec": {"artifact": { "entrypoint": ["./studio"] },"resources": { "cpu": "300m", "memory": "384Mi" },"scaleToZero": true,"volumes": [{ "name": "state", "mount": "/data", "replication": 2 }],"health": { "http": { "path": "/healthz", "interval": "10s" } },"routes": [{ "domain": "studio.example.com", "tls": "acme", "port": 8080 }]}}
orchy ps lists your apps and whether they're healthy. orchy logs shows what an app is printing, as it happens:$ orchy psNAME SUITE TENANT PID STATE ISOLATION PORT DEVICES / DOMAINstudio default 14812 healthy raw :0 epic-nas · studio.example.com$ orchy logs writing-studio -f2026-09-06T12:00:01Z [studio] HTTP server listening on :80802026-09-06T12:00:05Z [front door] fast-wake cold launch in 19.2ms • 200 OK GET /
One device is fine for trying things out. Two or more is where it gets good. Add the desktop at home, a laptop, that Raspberry Pi (a tiny, cheap computer) in the drawer, a cheap cloud server. Orchy links them over a private, encrypted network that only your devices can join. We call it the mesh, and the technique behind it is mutual TLS (mTLS): both ends prove who they are before they talk. So an app can run on whichever device suits it and your data stays in 2 live copies. If one machine dies, you don't lose your stuff.
$ orchy join-codeorchy1_AgAE4WPWrAkVUteChY3…"
orchy up with the join code:$ orchy up "orchy1_AgAE4WPWrAkVUteChY3…" --device laptop-pro✓ connected to your orchy "orchystra" · daemon online✓ joined your orchy "orchystra" · laptop-pro · linux/arm64✓ classified: whenever on → worker✦ brain authority: connected to your brain, epic-nas✦ granted roles: worker (tenant: default)
always on. A work desktop is part-time. A laptop that sleeps when you shut the lid is whenever on: it helps while it's awake, and Orchy plans around its naps. Here's how to see what you've got:$ orchy device status● epic-nas always on linux/amd64 brain healthy● laptop-pro whenever on linux/arm64 worker healthy
Home internet wasn't built for hosting. Your provider may share one address between a whole street (that's CGNAT), block incoming connections, or change your address whenever it feels like it. So Orchy turns the problem around. Your device opens an encrypted connection outwards, called a tunnel, to a company that passes visitors along it. Cloudflare, Tailscale and ngrok each offer one. Visitors come in through the tunnel, so you never have to open ports on your router (the usual way to let the internet in, and an easy one to get wrong).
cloudflared, for you. You can use your own domain (a web address like example.com), including the bare one with no www, and Cloudflare soaks up attack traffic before it gets to you.tskey-....cloudflared connector and copy the tunnel token it gives you (a long string of letters and numbers). Then start Orchy with it:$ orchy up --tunnel cloudflare --tunnel-token "eyJhIjoiY2YxM..." --domain mydomain.com✦ orchy [orchystra] ✦ your orchy is ready 🪐╭────────────────────────────────────────────────────────────────────────────╮│ ✨ Your orchy starts on epic-nas ││ ● Warp Tunnel: 🌌 cloudflare (f-1a2b3c4d5e6f.mesh.mydomain.com) · connected ● │╰────────────────────────────────────────────────────────────────────────────╯✦ Discovered Network Reachability:🌌 Internet (Tunnel): f-1a2b3c4d5e6f.mesh.mydomain.com (Reachable worldwide)📡 Local Network (LAN): 192.168.1.50:7946 (Same local Wi-Fi network only)epic-nas ▸ brain · healthy
orchy expose hands out an address under the domain you started Orchy with (that's the --domain you passed to orchy up). Want a specific name of your own instead? That's orchy domain add:$ orchy expose 3000✓ exposed port 3000 on https://…$ orchy domain add studio.mydomain.com --port 3000✓ domain studio.mydomain.com registered (TLS: acme)