Saiph

Run Saiph on hardware you own.

The Hub runs on a Raspberry Pi or small Linux server. Free, no account.

Packages aren't released yet. The GitHub repository is private for now.

How it fits together

Your devices join a private WireGuard mesh (Tailscale or Headscale). The Hub listens only there.

YOUR PRIVATE MESH · WIREGUARD-ENCRYPTED Phone Laptop Desktop Saiph Hub Pi or Linux server at home or anywhere signed events ● no public ports open

What you need

A server for the Hub

  • Ubuntu 22.04 / 24.04 or Debian 12 / 13
  • amd64 or arm64 (Raspberry Pi 4/5 works)
  • systemd and Python 3.12
  • 512 MB RAM and 1 GB disk free

Your devices

  • An Android phone
  • Windows 10/11 or a Linux desktop (Ubuntu tested)
  • Tailscale (free) or your own Headscale
  • About 20 minutes

Set it up

  1. Download the server package

    Get orion-server.tar.gz from the latest release and check its checksum.

    sha256sum orion-server.tar.gz   # compare with the release page
tar -xzf orion-server.tar.gz

  2. Run the installer

    sudo python3 orion-server/install.py

    It sets up a sandboxed service, plus Tailscale if needed, and opens no ports. For Headscale:

    sudo python3 orion-server/install.py --mesh-login-server https://headscale.example.com

  3. Pair your first computer

    Copy the printed .orion-enrollment file privately to your computer, install Saiph and open it.

    Treat invitations like a key. They work once, then expire.

  4. Add your phone and other devices

    On the computer: Phone → Add a device → Show pairing QR. Scan it with the phone within ten minutes.

  5. Keep it updated

    Computers: Settings → General → Check for updates. Hub: run the newer installer. It backs up first and rolls back on failure.

Extras

Headscale

Your own mesh controller. No third party.

Cloud folder

Seafile sync across your computers.

Encrypted backups

Daily restic backups of the Hub.

Phone webcam & mic

Via OBS or V4L2. Mic is experimental.

Keep your Hub safe

  • Never expose port 8765 outside your mesh.
  • One invitation per device.
  • Revoke lost devices from Settings.
  • Keep the server patched (unattended-upgrades).
  • Your Hub can read your messages. Protect it like your phone.

Common questions

Does my Hub need a public IP address?
No. The mesh works through NAT.
Can I pair a phone without a computer?
Yes. Run sudo orion-server enroll --output /var/lib/orion-server/enrollments/phone.orion-enrollment and scan the phone.svg QR it writes beside it.
Can I run the Hub on my desktop PC?
The installer targets always-on Ubuntu/Debian servers with systemd, so a Pi or small server fits better.
Do I need an account with you?
No account, licence key or subscription. Tailscale has its own sign-in; Headscale removes it.
Can I move to Hosted later?
That's planned, in both directions. Export and migration are Hosted launch requirements.
Where do I report a bug or a security issue?
Bugs: GitHub issues. Security issues: GitHub's private security advisory form, not a public issue.