Works on Raspberry Pi, Mac Mini, old laptops — anything running Linux. From a blank SD card or an existing machine to a small platform you operate from the browser.
Setup
Setup is a download, a drag, and a power cable — for SD-card devices. On an existing Linux machine (Mac Mini, old laptop, server), a single install command does the same. No shell expertise required.
You're handing out devices in a workshop, or you don't have a keyboard and screen for the Pi.
Download the bootfs install bundle for the device, drop it onto the boot partition of a fresh Raspberry Pi OS SD card, and power on. Within minutes the agent is installed and the device appears in your project.
On first boot a thin Go bootstrap fetches and starts the agent. The agent opens an outbound, encrypted connection to the gateway. There is nothing to forward, nothing public.
Drag-and-drop bootfs bundle, persistent retry on first boot, signed agent installation.
obacht-pi-install.zip
4.2 MB · ready
Raspberry Pi OS · /boot
Install
Pick a template from the registry, configure it through a schema-driven UI, install it. The agent verifies the signature before materialising the service. Secrets are marked and redacted; data paths are user-overridable.
You want to host a small web app, a CMS, a kiosk, or an internal tool — and still be able to change config later.
Open the install panel for the device, pick a template, fill in the configSchema, click install. Edit config later from the same UI. Every change goes into the audit log.
Signed manifest v2 templates, configSchema-driven install, secret redaction, user-overridable data paths.
Self-hosted web app
manifest v2 · containerised · v1.4.0
Operate
A real shell on the device, in your browser. Browse and edit files on running template instances. Restricted-mode by default; power-mode unlock recorded in the on-device audit log.
Something looks off. You want to inspect logs, restart a service, or tweak a config file — without an SSH client or a port forward.
Open the device in the dashboard, click terminal or files. In restricted-mode you can read; unlock power-mode to act. Every command and file change is recorded.
Browser terminal, WS file browser, restricted vs power mode, on-device audit log.
Monitor
Live host metrics (CPU, RAM, disk, temperature) and per-instance status. Email alerts when a device goes offline or a service stops.
A device runs unattended for weeks. You don't want to watch a dashboard — you want a notification when something actually breaks.
Configure alerts for the metrics that matter. When something trips, you get an email with enough context to act — then you fix it from the dashboard.
Host metrics, per-instance status, last-seen, email alerts, audit log.
Obacht Alert
⚠️ pi-01 service crashed
Get notified instantly when something goes wrong — fix it remotely before anyone notices
Set up event monitoring for disk space, temperature, or memory. For ESP32 devices, trigger alerts on variable changes or thresholds — like when a sensor value exceeds limits.
Publish
Connect a domain you own, point it at a service running on your device, and the Obacht proxy issues and renews the certificate. Nothing is exposed unless you choose to expose it.
You have a Pi at home running a service, and you want it reachable as `your-project.com` over HTTPS — without a static IP or a router config session.
Add the domain in the app, follow the DNS instructions, then bind a local port on the device to that hostname. Unbind or unclaim the domain at any time.
Custom domains with automatic Let's Encrypt HTTPS, local-port reverse-proxy bindings, no port forwarding required.
DNS check
A · 203.0.113.42 · matches obacht proxy
Bind to local port
pi-01 · :3000 → studio-tools.example
Issue Let's Encrypt certificate
ACME · auto-renew
Obacht is the operating layer. The hardware, the data, and the services are yours — we don't host your content, back it up, or guarantee uptime.
What Obacht does not do
Obacht is the operating layer. Your hardware, data and services remain yours.
Browse the template catalogue or connect a device and start.