Overview · Ajo Server docs

A small lighthouse whose tower is made of server racks, keeping watch over the sea.

Ajo Server is an Alpine Linux host image and a set of administration tools for running Ajo Kit applications on Ajo Engine. It is a single-host system operated by a trusted owner: one machine, rootless containers, an administration App in the browser and a deploy command on the developer’s side. The project is experimental, and this section is explicit about where it stops.

What is included

A network-isolated image build from a reviewed Alpine package lock, published as signed releases.
Hosts made from a release with kit host create, on this machine or on DigitalOcean.
First boot, SSH access, nginx and TLS, rootless Podman and resource limits.
An administration App with passkeys, live host data, typed operations and alerts.
Deployment over SSH or with an App-scoped token, with named versions and rollback.
Local App-data backups and a separate encrypted SQLite backup coordinator.

Two separate builds

The host and the Apps it runs are built independently. The HostImage supplies the operating system and the host tools; each App is its own artifact, deployed later into a rootless container.

Build	Produced on	Contains
HostImage	A dedicated, disposable Alpine builder with a verified input cache, published as a signed release	The operating system, first boot, SSH, nginx and TLS, rootless Podman, the deployment supervisor, the host programs and the administration App.
App image	The developer’s Linux x64 machine, by `kit deploy`	An OCI image holding the ajo-engine binary and one sealed App.

The administration App is itself an App. The HostImage carries the one from its own release and installs it at first boot, so a new host starts with its admin running and ready to be claimed. The image has no configured backup destination.

The engine is the only App runtime

Every App on the host, including the administration App and the backup coordinator, runs on Ajo Engine. Node runs development, build tools and JavaScript tests on the developer’s machine and the builder; it is not installed on the host as an App runtime. An App image contains the engine binary and a sealed artifact, and runs as UID and GID 1000.

Packages

Only the deployment plugin is published to npm. The administration App ships in each release, and the other workspace packages are private parts of the host and its administration App.

Package	Distribution	Responsibility
`ajo-kit-server`	npm, 0.3.1	The `kit host` and `kit deploy` commands, token transport and SSH helper.
`admin`	Each release, inside the HostImage and on its own	The host administration UI and its server handlers.
`admin-host`	Private	The admin’s access to engine capabilities, with a development adapter.
`backup`	Private	SQLite capture, encryption, remote verification and restore tooling.

Releases

You do not build a host yourself. kit host create makes one from the latest release, on this machine with QEMU or on DigitalOcean, and kit deploy ships Apps to it; Deploy your first App walks through both. Each release holds the HostImage as image.raw.bz2, the administration App on its own, a manifest and one checksum file, signed with ssh-keygen -Y. Before it uses anything, kit host create verifies that signature against the release key the plugin pins, and from then on downloads only that release’s versioned files. kit host update installs a newer administration App from a later release; Update or delete a host describes it.

If a required first-boot step fails, the host keeps access closed, and kit host create never gets past waiting for it. Do not bypass the access gate.

Status and release limits

You can create a host from a signed release, deploy Apps to it and back up their data, but there is no automated host replacement. DigitalOcean is the only cloud provider today.

Area	Where it stands
Token deployment for external developers	Partial. It works, but is not yet proven outside the maintainer’s environments.
Backup and recovery	Partial. You can archive App data on the host and restore it, or upload encrypted snapshots; the backup coordinator has no supported packaging yet, and recovery from a lost host is unproven.
Host provisioning	Partial. kit host create makes a local host or a DigitalOcean Droplet from a verified release; you create the DNS records.
Host updates	Partial. kit host update installs a newer administration App; a newer HostImage needs a new host.
Safe host replacement	Planned. You cannot yet replace a host safely.
Unattended operation	Partial. TLS renewal is automatic but unproven on a long-lived host.
Development platforms	Linux only. Deploying needs Linux x64, and a local host Linux x86_64 with KVM; macOS and Windows are not supported, and WSL is not verified.