Install on a Linux server

Connect to the server over SSH

Open a command window on your PC: PowerShell on Windows or Terminal on Mac. Replace USERNAME and SERVER_ADDRESS with your server’s values, then run the command.

ssh USERNAME@SERVER_ADDRESS

If you received an SSH key file, specify it with -i, as in ssh -i KEY_FILE_PATH USERNAME@SERVER_ADDRESS. You can also use a window opened with the SSH button in your cloud console.

On your first connection, you will see Are you sure you want to continue connecting (yes/no/[fingerprint])?. Type yes and press Enter. Password characters are not displayed as you type.

✓You see a prompt like USERNAME@SERVER_NAME:~$. Run all remaining commands in this guide in this window.

Check that your server supports installation

Print the CPU architecture, Ubuntu version, and current username in order.

uname -m
grep PRETTY_NAME /etc/os-release
whoami

adduser orke

usermod -aG sudo orke

mkdir -p /home/orke/.ssh && \
  cp ~/.ssh/authorized_keys /home/orke/.ssh/ && \
  chown -R orke:orke /home/orke/.ssh

✓You see x86_64, Ubuntu 24.04, and a username other than root.

Install required programs

First refresh the list of available packages. The first use of sudo may ask for your password.

sudo apt-get update

Next, install the packages orke uses. This is one command spread across several lines, so copy and paste it all at once.

sudo apt-get install -y libicu74 ca-certificates procps curl git tar gzip coreutils \
  xvfb libnss3 libgtk-3-0t64 libatk1.0-0t64 libatk-bridge2.0-0t64 \
  libcups2t64 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 \
  libxrandr2 libgbm1 libasound2t64

This includes packages for the web window feature, which opens web pages on the server. The orke installer checks the entire list, so install them even if you only plan to use terminals.

✓The prompt returns without errors. If a purple notice screen appears along the way, see When you get stuck.

Install orke

Run as the user who will use orke, without sudo. The installer downloads and verifies the latest Linux version, then installs it in your home folder. The program goes in ~/.local/share/orke; settings and history go in ~/.orke.

curl -fsSL https://orke.bomtobe.com/install.sh | bash

After installation, you will see lines like these. The version number is the latest available at the time you install.

Installed orke 3.4.10: /home/USERNAME/.local/share/orke
Command: /home/USERNAME/.local/bin/orke → /home/USERNAME/.local/share/orke/orke

On Ubuntu 24.04, two lines starting with Warning: and a virtual browser notice follow. They concern the web window feature and do not affect terminals, AI, or remote access, so you can continue for now. The Next steps that follow cover the same material as the next steps in this guide.

If you see Error: Required packages are missing, copy and run the sudo apt-get … command below it, then run the installation command again.

✓You see a line starting with Installed orke.

Make the orke command available now

The orke command is in ~/.local/bin. This folder is used automatically from your next sign-in. To use it in this window immediately, run this once.

export PATH="$HOME/.local/bin:$PATH"

Check that the orke command can be found.

command -v orke

✓The output is /home/USERNAME/.local/bin/orke.

Start the service as the same user

orke service install
orke service status

Keep using the same installation user and ORKE_HOME. A running service does not mean an external connection has succeeded.

Connect your Google account

orke login

Open the displayed https://api.orke.bomtobe.com/activate approval URL in a browser on your PC or phone, confirm the code, and sign in with Google. The account is remembered for future launches.

Prepare a certificate and enable access

First allow TCP 48650 through cloud, router, and server firewalls. Prepare a certificate using either option A or B below.

A. Have orke obtain one automatically from Let’s Encrypt

orke obtains a certificate for your public IPv4 address (valid for 160 hours) and renews it automatically before expiration. Let’s Encrypt verifies the address through external TCP 80, so port 80 must reach the server for each renewal. orke runs as a regular user and cannot open port 80 directly. An administrator must forward external port 80 to a local port orke can use, such as 48880. The test server allowed TCP 80 through its cloud firewall and used a NAT rule like the one below. A rule added this way disappears when the server restarts, so persist it with a package such as iptables-persistent.

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 48880

Then enable automatic management and access as the orke user. --agree-ca-terms means you agree to the Let’s Encrypt Subscriber Agreement. The command shows the current agreement URL; read it before proceeding.

orke remote setup --automatic-certificate --agree-ca-terms --http-port 48880 --port 48650 --enable

Issuance attempts are at least 10 minutes apart. For immediate renewal, use orke remote setup --renew-certificate. To disable automatic management, use --manual-certificate. These commands require the service to be running and sign-in in step 7 to be complete.

B. Import a certificate you obtained yourself (PFX)

First follow the IP certificate, PFX conversion, and manual renewal instructions. Replace the path and IP with your actual values. Enter the password through hidden input when the command asks.

orke remote setup --certificate /absolute/path/orke.pfx --ip PUBLIC_IPV4
orke remote setup --port 48650 --enable

For automation, pass the password through standard input with --password-stdin. orke does not renew imported certificates, so import a renewed PFX before expiration.

If orke remote setup returns account_required, complete sign-in in step 7 first, then run the same command again. HTTPS remote access: port 48650, enabled True in orke service status shows only the saved settings. Check an actual connection in step 9.

Open it from another network

Open the current https://PUBLIC_IPV4:48650 address on another device and approve access with the same Google account as the server. The approval page and Google open in the system browser. The original page waits for approval. Only an authenticated external connection confirms that access actually works.