Question 1

Is remote access to my devices secure?

Accepted Answer

Yes. New devices boot in restricted mode by default: only signed templates can be installed and arbitrary commands are blocked. Connections are end-to-end encrypted (WireGuard, SSH public-key auth, encrypted WebSockets), inbound from the device only. Every change is recorded in the on-device audit log. You unlock power-mode explicitly when you want full shell access, and lock it back when you're done.

Question 2

Who has access to my SSH keys?

Accepted Answer

The SSH keys belong exclusively to you. The private key is stored encrypted and can only be decrypted in your browser. The Obacht team, server infrastructure, and administrators have no access to private SSH keys.

Question 3

Can Obacht see what I type in the terminal or execute on the device?

Accepted Answer

Terminal sessions are streamed but never persisted or analysed for content. The on-device audit log records *that* a command was executed (when, by whom, in which mode) but not session input/output content.

Question 4

What happens if my device or account is compromised?

Accepted Answer

We recommend using:

Question 5

What data does Obacht store about my devices?

Accepted Answer

For each device, only operationally necessary information is stored, such as:

Question 6

Is Obacht GDPR compliant?

Accepted Answer

Yes. The service is designed to meet the requirements of the General Data Protection Regulation (GDPR). This includes:

Question 7

Where are the servers operated?

Accepted Answer

The Obacht infrastructure is operated in data centers within the European Union, e.g., at Hetzner Cloud. This enables low latency, high availability, and compliance with European data protection regulations.

Question 8

How do I install Obacht on a Raspberry Pi?

Accepted Answer

There is no curl-pipe-shell command and no SSH session required. After creating a device in the dashboard, you download a drag-and-drop install bundle (a small ZIP) and copy it onto the bootfs partition of a Raspberry Pi OS SD card. On first boot:

Question 9

Do I need to open ports in my router?

Accepted Answer

No. Devices open outbound, encrypted connections. The Obacht proxy handles inbound traffic for any domain you bind to a service, no router config, no static IP, no dynamic DNS.

Question 10

Can Obacht be operated with existing network or VPN infrastructure?

Accepted Answer

Yes. WireGuard connections are outbound, so NAT hole punching isn't required. Obacht can also be operated on-premise via the Enterprise or open-source variants.

Question 11

Which devices are supported?

Accepted Answer

Three device classes: a Raspberry Pi via a drag-and-drop bundle, an existing Linux machine (Ubuntu, mini PC, old laptop) via an install command, and an Apple-silicon Mac (iMac, Mac mini) through the native Obacht Mac app. Intel Macs and mobile MacBooks aren't the target.

Question 12

Can I use my Mac as a device?

Accepted Answer

Yes, an Apple-silicon Mac (M1 or newer, macOS 14 or newer). Instead of a shell install, Obacht runs as a native app: install, sign in, "Use this Mac". Containers run in a bundled Linux VM in the background — alongside your normal use. Meant for always-on devices like the iMac and Mac mini, not mobile MacBooks.

Question 13

Is it safe to run a server on my work machine?

Accepted Answer

Yes. Your templates run in a separate Linux VM rather than on macOS itself. The VM only sees its own data folder, never your files, and can't reach your home network. Plus, as everywhere in Obacht: signed templates, an encrypted tunnel, no open ports, restricted mode by default.

Question 14

Do I need to know Docker?

Accepted Answer

No. Templates abstract everything away. You pick software, Obacht installs it.

Question 15

Is my device secure?

Accepted Answer

Yes. WireGuard encryption, no open ports, template signing (minisign), restricted mode by default.

Question 16

What happens if Obacht goes offline?

Accepted Answer

Your device keeps running. The installed services are local on your hardware. You lose the tunnel and the remote dashboard, but not your data.

Question 17

Can I use Obacht for industrial or safety-critical systems?

Accepted Answer

obacht is designed for makers, small teams, educators, researchers and people building personal or small-scale projects. The service is neither intended nor permitted for critical or safety-relevant systems — such as medical technology, industrial plants, emergency infrastructure, or vehicles. Use is at your own risk.

Question 18

Can I self-host Obacht?

Accepted Answer

Yes. There is an Enterprise variant for hosting the full stack on your own infrastructure, and an open-source variant for self-hosting — useful for education, research and internal lab infrastructure.

Question 19

Is obacht right for self-hosting at home or in a small team?

Accepted Answer

Yes. obacht is designed for exactly this. Some common scenarios:

Question 20

What happens if I stop paying?

Accepted Answer

Your devices keep running — they belong to you. You lose the tunnel and the dashboard access.

Question 21

Is Obacht free right now?

Accepted Answer

Yes — Obacht is currently in closed beta. All features are free. Join the waitlist to get early access.

Question 22

What about projects that cannot take money?

Accepted Answer

Then the template costs nothing. We only charge the template fee where we can forward it. For about a third of the templates there is no payout channel, because a company behind the project finances itself through licences or cloud plans, because a donation channel was never set up, or because the project declines donations. Every template page states which case applies and where the money goes.

Question 23

What happens to my data if I cancel?

Accepted Answer

Your data stays on your hardware. Obacht has no access to the contents of your devices. You lose the tunnel and the dashboard, but your device keeps working.

Question 24

Why pay for free and open-source software?

Accepted Answer

You don't have to. You can install software manually on your device and use obacht purely as a reverse proxy for the port your own installation runs on, no template needed. obacht supports that. But obacht is designed for people who want a complete, simple solution: signed templates, one-click install, config UI, automatic HTTPS, monitoring and updates in one place. The template fee is what funds the open-source developers who built that software, not obacht.

Question 25

Can I bring my own static IP instead of routing through the obacht proxy?

Accepted Answer

Not yet. We're evaluating this for the roadmap. That said: if you're already thinking at that level, you can probably manage your own reverse proxy, DNS, and TLS — and obacht may not be the right tool for your setup. obacht is built for people who want things to just work without managing infrastructure themselves.

Frequently Asked Questions

Security

Data & Privacy

Technical

General