Cloud setup

What you need

• A VPSFrom any provider you like.
• Ubuntu 24.04 LTSThe steps below are written for it.
• 4 cores, 8 GB RAM, 50 GB diskOr more. One job with its tests fits easily.
• A Tailscale accountFree. It keeps the server off the public internet.
• Orca on your computerIt becomes your window onto the server.
• The usual kitGit, Node, Python, the agents: see Requirements.

Six steps

1. 1

   Lock it down

   SSH keys only, a user of your own, the firewall closed to everything, then SSH only over Tailscale. Test each change in a second terminal before you close the first.

   sudo ufw allow in on tailscale0 to any port 22 proto tcp
2. 2

   Install Orca

   Orca's Linux package, plus xvfb so its browser has a screen. Open Orca's port on Tailscale only, and turn on linger so it keeps running after you log out. On Linux the command is orca-ide.

   sudo apt-get install -y xvfb ./orca-ide_<version>_amd64.deb
3. 3

   Pair your computer

   Run it once in the foreground: it prints a pairing link (a secret, like a password). Paste it into Orca on your computer, under Settings, Remote Orca Servers. Then install it as a service, and set Orca's browser to Server (streamed).

   orca-ide serve --port 6768 --pairing-address <tailscale-ip>
4. 4

   Add the agents

   Node, gh, Claude Code, codex and Pi go under your home folder, no sudo. Sign each agent in through Orca; each prints a link to open on your computer.

   orca-ide account add --agent claude
5. 5

   Bring your repo

   Clone it, install Topping Out as usual, and register it with Orca. In the repo profile, set Runs on to the server, so every foreman knows where it is.

   orca-ide repo add --path <repo> --kind git
6. 6

   Start work

   Open the server's workspace in Orca on your computer and start a job or a night shift. Then close your computer: the work carries on.

   /goal night shift: 2 jobs, auto-pick, until done or stopped

Good to know

• Agents never use sudoIf a job needs a system package, the foreman stops and asks you. You run it.
• The codex sandboxOn Ubuntu 24.04 the independent review's read-only sandbox needs bubblewrap and a small AppArmor profile. A one-time fix, in SETUP.md.
• Browser workWalkthroughs use Orca's own browser on the server. No browser extension, no Playwright.
• API keysKeep them in a file only you can read, with Unix line endings: a key copied from Windows can carry a hidden carriage return.
• Watching itfree -h and uptime over SSH, or your provider's dashboard.
• Your phoneOrca Mobile can pair with the server too, with the phone on Tailscale.