ohd) runs the same sync engine as the desktop app,
headless: workspaces, rules, and live values served to the browser
extension, desktop app, web app, and CLI over one WebSocket/HTTP bind.
Your machine, your LAN, a Raspberry Pi/NAS, or a VM you rent. No
account, no cloud relay, no telemetry, no phone-home — the daemon makes
zero outbound connections except ones you configure (an OIDC identity
provider for SSO login, if you set one up).
The book
Install & lifecycle
Install the binaries, run the daemon as a user service, and
understand where configuration, state, and logs live.
LAN vs TLS proxy
The one decision every deployment makes: how connections to the
daemon are protected once it leaves loopback.
Docker & Compose
Run the daemon as a container: volumes, ports, version pinning,
and a Compose file.
Tokens & pairing
Mint the first token, join clients, and understand the admission
rules every route enforces.
Users, seats & SSO
The user directory, workspace grants, seat limits, passwords, and
OpenID Connect login for the served web app.
Backup & restore
Checksummed snapshots of the daemon’s state, and how a restore
behaves.
Upgrade
Move to the newest release with one command, or opt into
unattended upgrades.
Observability
The audit log, the /metrics snapshot, and the daemon’s log format.