1. Server Setup

Keywords

openme server setup, SPA server Linux, openme daemon, openme init, openme serve

Note

The openme server requires nftables or iptables and is therefore Linux-only. For client-only use on macOS, Windows, iOS or Android see Clients →.

Install

Debian / Ubuntu package (recommended)

Pre-built .deb packages are available for all common architectures.

amd64

curl -LO https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme_0.7.0_amd64.deb
sudo dpkg -i openme_0.7.0_amd64.deb

arm64

curl -LO https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme_0.7.0_arm64.deb
sudo dpkg -i openme_0.7.0_arm64.deb

armhf

curl -LO https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme_0.7.0_armhf.deb
sudo dpkg -i openme_0.7.0_armhf.deb

i386

curl -LO https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme_0.7.0_i386.deb
sudo dpkg -i openme_0.7.0_i386.deb

riscv64

curl -LO https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme_0.7.0_riscv64.deb
sudo dpkg -i openme_0.7.0_riscv64.deb

Tip

The .deb package installs the binary to /usr/bin/openme, creates a openme system user, registers a systemd service, and starts it automatically. You can skip the Start the Server section below and go straight to Add a client →.

Pre-built binary

amd64 (x86-64)

curl -Lo openme https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme-linux-amd64
chmod +x openme
sudo mv openme /usr/local/bin/

arm64

curl -Lo openme https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme-linux-arm64
chmod +x openme
sudo mv openme /usr/local/bin/

armhf

curl -Lo openme https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme-linux-arm
chmod +x openme
sudo mv openme /usr/local/bin/

32-bit (i386)

curl -Lo openme https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme-linux-386
chmod +x openme
sudo mv openme /usr/local/bin/

riscv64

curl -Lo openme https://github.com/merlos/openme/releases/download/cli-v0.7.0/openme-linux-riscv64
chmod +x openme
sudo mv openme /usr/local/bin/

From source

git clone https://github.com/merlos/openme
cd openme/cli
go mod download
go build -o openme ./cmd/openme
sudo mv openme /usr/local/bin/

---

Initialise

openme init generates a fresh Curve25519 keypair and writes the server configuration to /etc/openme/config.yaml.

sudo openme init --server myserver.example.com

Flag	Default	Description
--server	(required)	Public hostname or IP — used in generated client configs
--port	54154	UDP knock port and TCP health port
--firewall	nft	Firewall backend: nft or iptables
--interface	(all interfaces)	Restrict firewall rules to this network interface (e.g. eth0). Useful when the server has multiple NICs and you only want openme to guard the internet-facing one. The server will fail to start if the interface does not exist. Leave unset to apply rules to all interfaces.
--force	false	Overwrite an existing config

The command prints the server’s Curve25519 public key. openme add uses it automatically when provisioning clients.

---

Start the Server

sudo openme serve

For production, enable the systemd service (the .deb package does this automatically):

sudo systemctl enable --now openme
sudo systemctl status openme

Full systemd unit reference and hardening options: Server → Service.

---

Next: Add a client →