OpenCode
v1.1.1
Open-source CLI coding agent with full dev environment
One command turns a fresh Linux VPS into a ready-to-work OpenCode server. The installer sets up the open-source CLI coding agent at a pinned, smoke-tested version together with the toolchain agents actually need for real work -- Docker, Go, Rust, Node.js, Python with uv, and Playwright with Chromium and Firefox -- so the agent can build, test, and browse the web out of the box.
The setup is designed for remote, always-on coding. It creates a dedicated non-root user with your SSH keys, and long-running tasks can be supervised with systemd so they keep working after you close your laptop or lose the SSH connection. tmux is installed for interactive sessions.
Security is handled on day one, not left as an exercise: a default-deny firewall with only SSH open, fail2ban against brute-force login attempts, unattended security upgrades, and a nightly backup of the agent state to /var/backups/agent with 7-day rotation. Pins are bumped weekly after smoke tests on fresh VMs, so every install is reproducible.
What's included
- OpenCode 1.17.18 (pinned) -- open-source CLI coding agent
- Docker, Go, Rust, Node.js 22, Python + uv
- Playwright with Chromium and Firefox
- ripgrep, fd, fzf, jq, yq, bat, tmux, htop, btop
- Hardening: ufw (SSH only), fail2ban, unattended security upgrades, nightly state backups -- validated on Ubuntu, best-effort on RHEL
After install
- SSH in and switch to the coder user: su - coder
- Authenticate: opencode auth login
- Long-running tasks: supervise with systemd (see MOTD); tmux available for interactive sessions
How the install works
Generated from the install script itself -- these are the exact phases it runs on your server.
- 1.Pre-flight checks
- 2.Creating swap
- 3.Creating user
- 4.Installing system dependencies
- 5.Hardening (firewall, fail2ban, auto-updates)
- 6.Installing Node.js
- 7.Installing pnpm
- 8.Installing Docker
- 9.Installing Go
- 10.Installing Rust
- 11.Installing Python + uv
- 12.Installing Playwright
- 13.Installing OpenCode 1.17.18
- 14.Configuring log rotation + nightly backup
Supported Operating Systems
Requirements
- RAM
- 1GB minimum
- Disk
- 10GB minimum
Configuration
| Variable | Default | Description |
|---|---|---|
| VIRTUA_USER | coder | System user for the agent |
| VIRTUA_PASS | random 24-char | User password (for su - coder). Auto-generated if not set. |
Frequently Asked Questions
Which AI providers does OpenCode work with?
OpenCode is provider-agnostic. Run "opencode auth login" as the coder user and connect Anthropic, OpenAI, Google, or a local model -- you can switch providers at any time without reinstalling.
Which servers can I use?
Any fresh Ubuntu 24.04/25.04, Debian 12/13, or Rocky/AlmaLinux 9/10 server with at least 1GB RAM and 10GB disk. Swap is created automatically on small machines, so an entry-level VPS is enough to start.
Does the agent keep running when I disconnect?
Yes. Run tasks under systemd (the MOTD shows a ready-made systemd-run one-liner) and they survive SSH disconnects, logouts, and closed laptops. tmux is also available for interactive sessions you want to re-attach to.
Is the server safe to leave on the internet?
The installer applies a default-deny firewall with only SSH open, enables fail2ban, and turns on unattended security upgrades. Note that ports published by Docker containers you start yourself bypass the host firewall -- bind them to 127.0.0.1 unless you mean to expose them.
Changelog
- OpenCode pinned to 1.17.18 (weekly pin-bump loop)
- OpenCode pinned to 1.17.15 (weekly pin-bump loop, smoke-tested)
- One-click hardening: ufw default-deny (SSH only), fail2ban, unattended security upgrades (Ubuntu-validated)
- Nightly backup of ~/.config/opencode and ~/.local/share/opencode to /var/backups/agent (7-day rotation) and log rotation
- MOTD documents first-run auth (opencode auth login) and systemd as the supervision path
- Initial release
- Full dev environment: Docker, Go, Rust, Node.js, Python
- Playwright with Chromium and Firefox
- Developer tools: ripgrep, fd, fzf, jq, bat, tmux, htop