Run a persistent Apus Gateway on a DigitalOcean Droplet (~$6/month for the 1 GB Basic plan).

DigitalOcean is a straightforward paid VPS path. For cheaper or free options:

Prerequisites

Setup

Create a Droplet

Use a clean base image (Ubuntu 24.04 LTS). Avoid third-party Marketplace 1-click images unless you have reviewed their startup scripts and firewall defaults.

1. Log into [DigitalOcean](https://cloud.digitalocean.com/).
2. Click **Create > Droplets**.
3. Choose:
   - **Region:** Closest to you
   - **Image:** Ubuntu 24.04 LTS
   - **Size:** Basic, Regular, 1 vCPU / 1 GB RAM / 25 GB SSD
   - **Authentication:** SSH key (recommended) or password
4. Click **Create Droplet** and note the IP address.

Connect and install

```bash
ssh root@YOUR_DROPLET_IP

apt update && apt upgrade -y

# Install Node.js 24 LTS
curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
apt install -y nodejs

# Install Apus; run onboarding later as the non-root owner.
curl -fsSL https://ami-docs.dev.apuscorp.com/install.sh | bash -s -- --no-onboard

# Create the non-root user that will own Apus state and services.
adduser apus
usermod -aG sudo apus
loginctl enable-linger apus

su - apus
apus --version
```

Use the root shell only for system bootstrap. Run Apus commands as the non-root `apus` user so state lives under `/home/apus/.apus/` and the Gateway installs as that user's systemd `--user` service.

Run onboarding

```bash
apus onboard --install-daemon
```

The wizard walks you through model auth, channel setup, Gateway token generation, and daemon installation (systemd user service).

Add swap (recommended for 1 GB Droplets)

```bash
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
```

Verify the Gateway

```bash
apus status
systemctl --user status apus-gateway.service
journalctl --user -u apus-gateway.service -f
```

Access the Control UI

The Gateway binds to loopback by default. Pick one of these options.

**Option A: SSH tunnel (simplest)**

```bash
# From your local machine
ssh -L 18789:localhost:18789 root@YOUR_DROPLET_IP
```

Then open `http://localhost:18789`.

**Option B: Tailscale Serve**

```bash
curl -fsSL https://tailscale.com/install.sh | sudo sh
sudo tailscale up
apus config set gateway.tailscale.mode serve
apus gateway restart
```

Then open `https://<magicdns>/` from any device on your tailnet.

Tailscale Serve authenticates Control UI and WebSocket traffic via tailnet identity headers, which assumes the Gateway host itself is trusted. HTTP API endpoints still follow the Gateway's normal auth mode (token/password) regardless. To require explicit shared-secret credentials over Serve, set `gateway.auth.allowTailscale: false` and use `gateway.auth.mode: "token"` or `"password"`.

Persistence and backups

Apus state lives under:

These survive Droplet reboots. To create a backup archive:

apus backup create
apus backup restore <archive.tar.gz> --target <fresh-directory>

DigitalOcean snapshots back up the whole Droplet. Apus archives can be transferred to another host. Absolute symbolic links keep their original target locations, including links to separately backed-up config or credentials. Review these links before activating state on another host or at another path; see the backup symbolic-link caveat. Restore verifies and extracts into a fresh staging directory; activation is a separate offline step. See Restore a full archive for the rollback warnings and activation sequence.

1 GB RAM tips

The $6 Droplet only has 1 GB RAM. To keep things smooth:

Troubleshooting

Gateway will not start -- Run apus doctor --non-interactive and check logs with journalctl --user -u apus-gateway.service -n 50.

Port already in use -- Run lsof -i :18789 to find the process, then stop it.

Out of memory -- Verify swap is active with free -h. If still hitting OOM, switch to API-based models (Claude, GPT) rather than local models, or upgrade to a 2 GB Droplet.

Next steps

Related