Your own server · Ovenlight docs

Ovenlight opens your apps only while the computer that runs them is on, awake and online. A laptop serves from any network while it's plugged in and awake, and once you change one setting it keeps serving with its lid closed (how). For apps that open any time, run them on your own server: a computer that stays on at home, such as a Mac mini, a spare PC or a Raspberry Pi. If you can't keep one at home, rent one in the cloud. The connector runs on it as connector.md describes, over your own tailnet.

Choose your setup

Pick where your server lives, then how you'll work with it. Not sure? Use a spare PC on Ubuntu or Debian, or a Raspberry Pi 5 with 4 GB, and send apps to it from your laptop. A Mac or Windows PC you already have works too, if you build on it.

Where it lives	Send apps from your laptop	Build on it
A spare PC or old laptop on Ubuntu or Debian	Yes	Yes
A Raspberry Pi	Pi 5 or Pi 4 with 4 GB	Pi 5 with 8 GB
A Mac or Windows PC	No	Yes, at the computer itself
Rented on AWS Lightsail	$12 a month (2 GB)	$24 a month (4 GB)

Send apps from your laptop (most people): keep building where you do now. Your coding agent (Claude Code, Codex and others) copies each app to the server and publishes it there, and the server only serves your apps.
Build on it: your coding agent runs on the server, and you work there over SSH from your laptop. It needs more memory, since Claude Code and Codex each ask for 4 GB.

At home, your data stays in your house, and the server stays up while your power and internet do. A rented server is the provider's computer: your apps and their data sit on its disk, in its data center, under its terms, and it stays up while you keep paying. Ovenlight still reaches it over your tailnet, and nothing passes through our servers.

Either way, your laptop needs Tailscale, signed in with the account you use for Ovenlight, with MagicDNS and HTTPS certificates on (in the admin console, under DNS).

At home

A computer you have

A mini PC or an old laptop on Ubuntu or Debian makes a good server, and you can set it up at its own keyboard or over SSH. On Debian, if you set a root password at install, sudo isn't installed and your user can't use it yet: install sudo and add yourself to the sudo group first. On a laptop, leave it plugged in. On a desktop or mini PC, turn on Restore on AC Power Loss (or a setting like it) in its BIOS, which a key such as F2 or Delete opens at startup, so it starts again by itself after a power cut. Then run these, which install curl for the steps that follow and keep the computer awake, even with a laptop's lid closed:

sudo apt-get update
sudo apt-get install -y curl
sudo mkdir -p /etc/systemd/sleep.conf.d
printf '[Sleep]\nAllowSuspend=no\nAllowHibernation=no\n' | sudo tee /etc/systemd/sleep.conf.d/stay-awake.conf

Then set it up as a server.

A Mac or Windows PC

A Mac or a Windows PC can run your apps too, even one you use every day: build on it and install the connector there. Keep it awake and, on a Mac, logged in, as What the computer needs says. A laptop also needs one setting to serve with its lid closed. On a desktop, have it start again by itself after a power cut. On a Mac, that's Start up automatically after a power failure in System Settings, under Energy. On a PC, it's Restore on AC Power Loss in its BIOS, as above.

ovenlight doctor then confirms that the computer won't sleep on its own. That's all the setup it needs: publish apps on it yourself or with your coding agent. The rest of this page is for Linux servers.

A Raspberry Pi

No spare computer? A Raspberry Pi costs once, draws a few watts, starts again by itself after a power cut and keeps your data at home. Get:

A Raspberry Pi 5 with 4 GB or more, or 8 GB or more to build on it too. A Raspberry Pi 4 with 4 GB or more works for sending apps to.
Its official power supply (the 27W USB-C Power Supply for a Pi 5) and, for a Pi 5, the Active Cooler.
A microSD card of 32 GB or more, rated A2, from a known brand, such as Raspberry Pi's own. For more speed, a Pi 5 can boot from an NVMe SSD on the M.2 HAT+ instead.

On your laptop, write the card with Raspberry Pi Imager:

Choose your Pi, then Raspberry Pi OS (other), then Raspberry Pi OS Lite (64-bit), then the card.
Under Customisation, set the hostname to oven and the username to pi, with a password of your own. Enter your Wi-Fi, unless the Pi will use a network cable. Under Remote access, turn on Enable SSH, with Use password authentication.
Choose Write, then I understand, erase and write.

Put the card in the Pi, plug it in and give it a minute to start. Then, on your laptop, in Terminal (PowerShell on Windows), connect over your home network with the password you chose, answering yes when ssh asks whether to trust the Pi:

ssh pi@oven.local

Then set up the server.

Rented in the cloud

Create the server on AWS Lightsail

Lightsail is AWS's fixed-price server. In the Lightsail console:

Choose Create instance.
Choose a location near you with Change AWS Region and Availability Zone. The price is the same in each, though a few regions include half the transfer.
Choose Linux/Unix, then OS Only, then Ubuntu 24.04 LTS.
Choose Dual-stack, then a plan. As Lightsail's pricing page lists them on October 25, 2026:
- To send apps to it: the $12 USD plan, with 2 GB memory, 2 vCPUs, 60 GB SSD and 3 TB transfer.
- To build on it: the $24 USD plan, with 4 GB memory, 2 vCPUs, 80 GB SSD and 4 TB transfer.
Name the instance oven and choose Create instance.
Once it shows Running, open it, choose the Connect tab, then Connect using SSH. A terminal opens in your browser, logged in as ubuntu.

Lightsail charges by the hour up to the plan's monthly price, and a stopped instance still costs: delete it to stop paying. To keep a copy of everything on it, turn on Automatic snapshots in the instance's Snapshots tab: Lightsail keeps the last seven daily copies of the whole server, at $0.05 per GB a month, and deletes them with the instance.

In the browser terminal, set the server's clock to your time zone, choosing your region and city from the menus, so its restarts for updates come at night for you:

sudo dpkg-reconfigure tzdata

On the 2 GB plan, also add a swap file, which gives a busy moment room:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Then, in the browser terminal, set up the server.

Set up the server

These steps are the same on a Raspberry Pi, a spare computer and a cloud server, and you run them yourself, since sudo may ask for your password. A Pi's user is pi, a cloud server's is ubuntu and a spare computer's is your own: wherever a command says pi@oven, use yours in place of pi.

1. Install Tailscale

Install Tailscale on the server:

curl -fsSL https://tailscale.com/install.sh | sh

Then sign it in, with Tailscale SSH on:

sudo tailscale up --ssh --hostname=oven

Open the link it prints and sign in with your Tailscale account. Then, in the admin console's Machines page, approve oven if your tailnet requires device approval, then open the menu beside oven and choose Disable Key Expiry. Otherwise the server signs out after 180 days, and you can't reach it until you sign it in again.

2. Connect from your laptop

Now switch to your laptop for good. Type exit (on a cloud server, close the browser terminal), then in Terminal on your laptop (PowerShell on Windows), connect over Tailscale, from anywhere, with no password or SSH keys. If ssh asks whether to trust the computer, answer yes:

ssh pi@oven

The rest of the setup happens in this session. If Tailscale prints a link to confirm it's you, open it, and the connection carries on. It asks again after 12 hours (Troubleshooting has more).

3. Close the other ways in

On a Raspberry Pi or a spare computer, turn off its own SSH. Tailscale SSH doesn't use it, and it would otherwise keep taking passwords from anyone on your home network:

sudo systemctl disable --now ssh.service ssh.socket

If it says a unit doesn't exist, SSH was never on and there's nothing to turn off.

On a cloud server, close the firewall. Tailscale and the connector only dial out, so nothing needs to reach the server from the public internet. In the Lightsail console, open the instance's Networking tab and delete every rule under IPv4 Firewall and IPv6 Firewall (SSH and HTTP). The browser terminal stops working, but ssh ubuntu@oven keeps working.

4. Turn on automatic updates

These let the server install security updates by itself, and restart at 04:00 when one needs it, such as for a new kernel. They also keep Tailscale up to date, and install rsync, which sending apps needs:

sudo apt-get update
sudo apt-get install -y unattended-upgrades rsync
printf 'Unattended-Upgrade::Automatic-Reboot "true";\nUnattended-Upgrade::Automatic-Reboot-Time "04:00";\n' | sudo tee /etc/apt/apt.conf.d/52automatic-reboot
sudo tailscale set --auto-update

A Raspberry Pi's kernel and firmware come from Raspberry Pi's own archive, which these updates leave out, so on a Pi, run sudo apt update and then sudo apt full-upgrade now and then, as Raspberry Pi's docs advise.

5. Install Node and the connector

Node, for the starter app and most apps an agent builds, comes from NodeSource, since the system's own may be too old. The last line adds Node's updates to the nightly ones, within its major version:

curl -fsSL https://deb.nodesource.com/setup_lts.x -o nodesource_setup.sh
sudo -E bash nodesource_setup.sh
sudo apt-get install -y nodejs
echo 'Unattended-Upgrade::Origins-Pattern:: "site=deb.nodesource.com";' | sudo tee /etc/apt/apt.conf.d/52nodesource

Then the folder your apps go in, and the connector, set to keep running with nobody logged in:

mkdir -p ~/apps
curl -fsSL https://ovenlight.app/install.sh | sh
sudo loginctl enable-linger "$USER"

If the installer says the connector runs only while you're logged in, the last line takes care of that. If ~/.local/bin isn't on your PATH yet, the installer adds it in ~/.bashrc, for your next login.

The connector, your apps and Tailscale start again by themselves after a restart. ~/.local/bin/ovenlight doctor checks the setup.

Send apps from your laptop

Your laptop keeps the code. The server runs a copy of each app and keeps what people add to it.

Let your agent send your apps

Paste this into your coding agent (Claude Code, Codex and others) on your laptop, with your server's user in place of pi:

I have an always-on computer for Ovenlight, `oven`, which I reach with
`ssh pi@oven`. Save this in your memory or instructions for every
session: when I ask you to put an app on my phone, or to change one I've
put there, build it here on this computer, then send it to `oven` and
publish it there, as https://ovenlight.app/docs/always-on.md under "Send
an app" describes. Read the building guide with
`ssh pi@oven '~/.local/bin/ovenlight guide'`, and start a new app with
`ssh pi@oven '~/.local/bin/ovenlight new "App Name" --dir ~/apps'`, then
copy it here with rsync to work on (on Windows, where Git Bash has no
rsync, use the tar forms that section gives). Don't publish apps on this
computer. Tell me each step `publish` says only I can take, such as
opening its login link or turning off the app's key expiry. If an ssh
command hangs, or prints that Tailscale SSH requires an additional check,
give me the link it printed (or ask me to run `ssh pi@oven true` in my
own terminal and open its link), then try again.

Paste it even if Claude Code has Ovenlight's plugin: only this note tells the plugin's skill where your server is and how to send your apps there.

Send an app

Your agent takes these steps once it has the note above. To take them yourself, use Terminal on your laptop (on Windows, Git Bash, with the tar forms below). The commands use the starter, Family List, in ~/src/family-list: for your own app, put its folder, name, port and start command in their place.

If the app is published on your laptop now, first move it off your laptop. No app yet? Make the starter on the server, which has the connector, and copy it to your laptop to work on:
```
ssh pi@oven '~/.local/bin/ovenlight new "Family List" --dir ~/apps'
mkdir -p ~/src
rsync -a pi@oven:apps/family-list ~/src/
```
Copy the app's folder to ~/apps on the server. The copy leaves out its top-level data, node_modules and .git, so the server's data stays. First move a database or uploads kept outside data into it, on the server too for an app already there (the app contract). For a Node app with dependencies but no package-lock.json, first run npm install in its folder on your laptop, so the copy carries the lockfile (the starter has no dependencies).
```
rsync -a --exclude /data --exclude /node_modules --exclude /.git ~/src/family-list/ pi@oven:apps/family-list/
```
Install the app's dependencies on the server, so any native ones are built for its system. For a Node app, this runs npm ci:
```
ssh pi@oven 'cd ~/apps/family-list && if [ -f package-lock.json ]; then npm ci; fi'
```
Publish it on the server with its port, name, start command and folder:
```
ssh pi@oven '~/.local/bin/ovenlight publish --port 27748 --name "Family List" --run "npm start" --dir ~/apps/family-list'
```
publish prints a login link: open it on your laptop and sign in with your Tailscale account. Then, on the Machines page, choose Disable Key Expiry for family-list too, as publish reminds you, or the app goes offline after 180 days. (Once you store an API access token, as Share an app shows, the connector does this for each app.) Then open the app on your phone.

To send a new version, copy it, install its dependencies and restart it in one go:

rsync -a --exclude /data --exclude /node_modules --exclude /.git ~/src/family-list/ pi@oven:apps/family-list/
ssh pi@oven 'cd ~/apps/family-list && if [ -f package-lock.json ]; then npm ci; fi && ~/.local/bin/ovenlight restart family-list'

The connector's other commands work over ssh the same way, such as ssh pi@oven '~/.local/bin/ovenlight logs family-list'.

Already published on your laptop

Unpublish the app on your laptop before you publish it on the server, or the server's copy comes up as family-list-1: run ovenlight unpublish family-list on your laptop, and delete its node on the Machines page. People you shared it with need new invites. Then, with everything people add moved into data as step 2 describes, send it once, before step 2:

rsync -a ~/src/family-list/data pi@oven:apps/family-list/

On Windows

Use Git Bash, since Windows PowerShell 5.1 mangles the inner quotes. Git Bash has no rsync, so use tar over ssh in place of each rsync line. To copy an app from the server:

ssh pi@oven 'tar czf - -C apps family-list' | tar xzf - -C ~/src

To send it:

tar czf - --exclude ./data --exclude ./node_modules --exclude ./.git -C ~/src/family-list . | ssh pi@oven 'mkdir -p apps/family-list && tar xzf - -C apps/family-list'

To send its data once:

tar czf - -C ~/src/family-list data | ssh pi@oven 'mkdir -p apps/family-list && tar xzf - -C apps/family-list'

Connect with ssh pi@oven and follow Share an app there, once for each app. Its commands ask questions in a terminal, so they don't work as ssh pi@oven '…'. After that, share from your phone: touch and hold the app in Ovenlight and choose Share.

Build on the server

To work on a Linux server itself, over SSH from your laptop:

Install tmux, so your agent keeps working when your laptop closes:
```
sudo apt-get install -y tmux
```

Install your coding agent. For Claude Code:

curl -fsSL https://claude.ai/install.sh | bash

For Codex:

curl -fsSL https://chatgpt.com/codex/install.sh | sh

Skip any PATH line the installer suggests: log out with exit and run ssh pi@oven again, which adds it. Then run tmux.
In tmux, sign your agent in and connect it to Ovenlight:
- Claude Code: run claude, open the link it prints to sign in, and install Ovenlight's plugin as Connect a coding agent shows.
- Codex: turn on device code login in ChatGPT's security settings (in a workspace, its admin allows it). Then run these. The first prints a link and a code to sign in with, and the last starts Codex:
```
codex login --device-auth
codex mcp add ovenlight -- ~/.local/state/ovenlight/bin/ovenlight mcp
codex
```
Ask your agent to put an app on your phone.

When you come back, ssh pi@oven and tmux attach pick up where you left off. A restart for an update ends tmux and your agent with it, so check on work left running overnight.

Back it up

On a cloud server, Lightsail's automatic snapshots keep a copy once you turn them on, as Create the server shows. At home, what people add to your apps lives only on the server, so copy it to your laptop now and then: your apps, and the connector's own folders, which hold your apps' node keys and your guests. Keep the copy as private as the server. Run this on your laptop (in Git Bash on Windows) at a quiet moment, since a database written to mid-copy may not restore:

ssh pi@oven 'tar czf - apps .config/ovenlight .local/state/ovenlight' > oven-backup.tar.gz

To restore it to a new server:

Turn the old server off if it still runs, and delete only oven on the Machines page, so the new one takes its name. Leave the apps' nodes: the copy brings them back as they were.
On your laptop, forget the old server's keys, or ssh refuses the new one:
```
ssh-keygen -R oven
ssh-keygen -R oven.local
```
Set up the new server through step 4, with the same username as the old one, since each app runs from its folder's full path.
Type exit. Then, on your laptop, in the folder that holds oven-backup.tar.gz, unpack the copy on the new server:
```
ssh pi@oven 'tar xzf -' < oven-backup.tar.gz
```
Connect with ssh pi@oven again and carry on with step 5. On a different kind of server, such as a spare PC in place of a Pi, then install each app's dependencies again, as step 3 of Send an app shows.

Move to a new computer has more on what carries over.

Troubleshooting

ssh pi@oven hangs, or says Tailscale SSH requires an additional check. Tailscale confirms it's you every 12 hours. Open the link it printed. When your coding agent's command hangs, run ssh pi@oven true yourself, open its link, then have the agent try again. On Tailscale's Premium and Enterprise plans, checkPeriod in your tailnet policy's SSH rule stretches the 12 hours up to a week.
ssh is refused. If you've edited your tailnet policy, it needs a rule allowing SSH to your own devices, as Tailscale's default policy has.
You can't reach the server over Tailscale. At a Pi or spare computer, plug in a keyboard and screen, log in and run sudo systemctl enable --now ssh to reach it over your home network. On Lightsail, add the SSH rule back in the Networking tab and use the browser terminal.
An app comes up as family-list-1. Its old node is still in your tailnet: see Already published on your laptop.
An app doesn't appear on your phone. Run ssh pi@oven '~/.local/bin/ovenlight doctor' and follow the fix it gives for each problem. ovenlight check family-list and ovenlight logs family-list, over ssh the same way, show how the app answers and what it printed. Your phone must be signed in to the same Tailscale account, under Use My Own Computers.

For anything else, the connector's Troubleshooting applies on the server too, with each command run over ssh as above.