Skip to main content

​
Fased on DigitalOcean

​
Goal

Run a persistent Fased Gateway on a small DigitalOcean Ubuntu droplet. If you prefer a provider-specific ARM path, see the Oracle Cloud guide.

​
Provider fit

DigitalOcean is a straightforward Ubuntu VPS path. Other VPS providers work too when they give you a clean Ubuntu host, SSH access, outbound internet, and enough memory for Node plus the Gateway. Check current provider pricing and limits before creating the server.

​
Prerequisites

  • DigitalOcean account
  • SSH key pair
  • Tailscale account for private remote access
  • ~20 minutes

​
1) Create a Droplet

Use a clean base image (Ubuntu 24.04 LTS). Avoid prebuilt app images unless you have reviewed their startup scripts and firewall defaults.
  1. Log into DigitalOcean
  2. Click Create → Droplets
  3. Choose:
    • Region: Closest to you (or your users)
    • Image: Ubuntu 24.04 LTS
    • Size: Basic Ubuntu droplet with at least 1GB RAM
    • Authentication: SSH key
  4. Click Create Droplet
  5. Note the IP address

​
2) Connect via SSH

​
3) Install Fased with the hosting profile

For hosted deployments, run the standard hosting installer on the VPS itself. It installs missing tools, starts Tailscale when needed, prints the Tailscale login URL, and applies the hosted profile. Run the one-command Hosting installer from the provider’s root console. It verifies the tagged Hosting release before privileged Fased installation. Do not run an app-owned checkout with sudo. The hosting installer runs onboarding and walks you through:
  • Host profile, workspace, Gateway bind/auth, and hosting security
  • Gateway token generation
  • Optional wallet/mining setup if you choose those paths
  • Daemon installation (systemd)
  • Tailscale-only dashboard and SSH access
After the Gateway is online, finish product setup in the Control UI from the selected Agent: Agent > Models, Agent > Channels, Agent > Services, Agent > Skills, Agent > Memory, and Agent > Tasks.

​
4) Verify the Gateway

Leave the root bootstrap shell and reconnect over Tailscale as the application account. Replace the host below with the Droplet’s MagicDNS name or 100.x Tailscale address:
The app account intentionally has no sudo access. For root-owned systemd status or journals, use the DigitalOcean console as the host administrator; never add an app sudo rule to reach the signer or updater.

​
5) Access the Control UI

The hosting path keeps the raw Gateway port private. To access the Control UI: Option A: Tailscale dashboard link Run this on the droplet and open the printed private URL from a device on your tailnet:
Option B: SSH Tunnel
Option C: Tailscale Serve (HTTPS, loopback-only)
Open: https://<magicdns>/ Notes:
  • Serve keeps the Gateway loopback-only and authenticates Control UI/WebSocket traffic through Tailscale headers.
  • Tokenless browser auth assumes a trusted gateway host. HTTP APIs still require token/password.
  • To require token/password instead, set gateway.auth.allowTailscale: false or use gateway.auth.mode: "password".
Option D: Tailnet bind (no Serve)
Open: http://<tailscale-ip>:18789 (token required). Once open, use Dashboard for overview, Chat to test the Agent, Agents for models, channels, skills, tools, memory, services, and tasks, and Advanced for Config, Debug, and Nodes.

​
7) Connect channels

Use Agent > Channels for normal channel setup and routing. See Channels for provider-specific setup, then manage the selected Agent’s account routes in the Control UI.

​
Optimizations for small droplets

If the droplet has 1GB RAM, add swap and use API-based models instead of local models.

​
Use a lighter model

If you’re hitting OOMs, consider:
  • Using API-based models instead of local models
  • Setting agents.defaults.model.primary to a smaller model

​
Monitor memory

​
Persistence and backups

Gateway state lives under /home/app/.fased. Native signer keys, policy, WebAuthn credentials, durable caps, and request records live separately in signer-owned /var/lib/fased-signerd.
  • /home/app/.fased/ — Gateway config, credentials, sessions, and workspace
  • /var/lib/fased-signerd/ — signer-owned encrypted state and audit data
Both survive reboots and normal managed updates. Do not copy a live signer DB, change its ownership, or treat only the public Gateway registry as a wallet backup. Use a host-administrator maintenance window and the documented signer-state backup/recovery procedure, then test recovery by comparing public wallet addresses before funding the restored signer.

​
Oracle Cloud alternative

Oracle Cloud has a provider-specific ARM path. It can be useful if capacity is available and you are comfortable with OCI setup. For the full setup guide, see Oracle Cloud.

​
Troubleshooting

​
Gateway won’t start

​
Port already in use

​
Out of memory

​
See Also