OpenAI Codex
v1.1.1
OpenAI's CLI coding agent with full dev environment
One command turns a fresh Linux VPS into a ready-to-work OpenAI Codex server. The installer sets up OpenAI's CLI coding agent at a pinned, smoke-tested version together with the toolchain agents actually need for real work -- Docker, Go, Rust, Node.js, Python with uv, and Playwright with Chromium and Firefox -- so the agent can build, test, and browse the web out of the box.
The setup is designed for remote, always-on coding. It creates a dedicated non-root user with your SSH keys, and long-running tasks can be supervised with systemd so they keep working after you close your laptop or lose the SSH connection. tmux is installed for interactive sessions.
Security is handled on day one, not left as an exercise: a default-deny firewall with only SSH open, fail2ban against brute-force login attempts, unattended security upgrades, and a nightly backup of the agent state to /var/backups/agent with 7-day rotation. Pins are bumped weekly after smoke tests on fresh VMs, so every install is reproducible.
What's included
- OpenAI Codex 0.144.1 (pinned) -- OpenAI's CLI coding agent
- Docker, Go, Rust, Node.js 22, Python + uv
- Playwright with Chromium and Firefox
- ripgrep, fd, fzf, jq, yq, bat, tmux, htop, btop
- Hardening: ufw (SSH only), fail2ban, unattended security upgrades, nightly state backups -- validated on Ubuntu, best-effort on RHEL
After install
- SSH in and switch to the coder user: su - coder
- Authenticate: codex login (headless: codex login --device-auth)
- Long-running tasks: supervise with systemd (see MOTD); tmux available for interactive sessions
How the install works
Generated from the install script itself -- these are the exact phases it runs on your server.
- 1.Pre-flight checks
- 2.Creating swap
- 3.Creating user
- 4.Installing system dependencies
- 5.Hardening (firewall, fail2ban, auto-updates)
- 6.Installing Node.js
- 7.Installing pnpm
- 8.Installing Docker
- 9.Installing Go
- 10.Installing Rust
- 11.Installing Python + uv
- 12.Installing Playwright
- 13.Installing OpenAI Codex 0.144.1
- 14.Configuring log rotation + nightly backup
Supported Operating Systems
Requirements
- RAM
- 1GB minimum
- Disk
- 10GB minimum
Configuration
| Variable | Default | Description |
|---|---|---|
| VIRTUA_USER | coder | System user for the agent |
| VIRTUA_PASS | random 24-char | User password (for su - coder). Auto-generated if not set. |
Frequently Asked Questions
How do I authenticate Codex after the install?
SSH in, switch to the agent user with "su - coder", then run "codex login" and sign in with your ChatGPT plan or an OpenAI API key. On a headless server use "codex login --device-auth". The exact steps are printed in the MOTD when you log in.
Which servers can I use?
Any fresh Ubuntu 24.04/25.04, Debian 12/13, or Rocky/AlmaLinux 9/10 server with at least 1GB RAM and 10GB disk. Swap is created automatically on small machines, so an entry-level VPS is enough to start.
Does the agent keep running when I disconnect?
Yes. Run tasks under systemd (the MOTD shows a ready-made systemd-run one-liner) and they survive SSH disconnects, logouts, and closed laptops. tmux is also available for interactive sessions you want to re-attach to.
Is the server safe to leave on the internet?
The installer applies a default-deny firewall with only SSH open, enables fail2ban, and turns on unattended security upgrades. Note that ports published by Docker containers you start yourself bypass the host firewall -- bind them to 127.0.0.1 unless you mean to expose them.
Changelog
- OpenAI Codex pinned to 0.144.1 (weekly pin-bump loop)
- OpenAI Codex pinned to 0.142.5 (weekly pin-bump loop, smoke-tested)
- One-click hardening: ufw default-deny (SSH only), fail2ban, unattended security upgrades (Ubuntu-validated)
- Nightly backup of ~/.codex state to /var/backups/agent (7-day rotation) and log rotation
- MOTD documents first-run auth (codex login) and systemd as the supervision path
- Initial release
- Full dev environment: Docker, Go, Rust, Node.js, Python
- Playwright with Chromium and Firefox
- Developer tools: ripgrep, fd, fzf, jq, bat, tmux, htop