One command to deploy a persistent autonomous AI agent on a Hetzner CAX21 ARM64 VPS.
git clone https://github.com/phantomcorp/arya-deploy.git
cd arya-deploy
bash install.shThe interactive CLI wizard runs 7 phases with safety gates between each:
- Emergency Access -- Create backup user so you are never locked out
- System Foundation + ZRAM -- Update packages, install essentials, configure swap
- Tailscale Mesh -- Join the zero-trust mesh network
- SSH Hardening -- Lock down SSH (only runs after Tailscale is confirmed alive)
- Docker Stack -- Install Docker, generate SOPS secrets, bring up n8n + PostgreSQL/pgvector
- OpenClaw + Arya Soul -- Install Node.js, OpenClaw runtime, configure API keys, start agent
- Heartbeat + Cron -- Enable systemd heartbeat daemon, install cron jobs, enable lingering
Every phase is idempotent. Re-run safely at any time.
arya-deploy/
├── install.sh # 7-phase interactive wizard (start here)
├── .soul/ # Soul Spec -- agent identity layer
│ ├── SOUL.md # Who Arya IS (values, voice, boundaries)
│ ├── IDENTITY.md # How Arya APPEARS (name, emoji, tagline)
│ ├── AGENTS.md # How Arya OPERATES (sub-agent rules, allowlists)
│ ├── USER.md # Who YOU are (preferences, accessibility)
│ ├── MEMORY.md # What Arya REMEMBERS (long-term facts)
│ ├── HEARTBEAT.md # Operational health protocol
│ └── BOOTSTRAP.md # First-run instructions (self-destructs)
│
├── Agent/ # Agent capability modules
│ ├── Sub-Agents/Skills/ # 6 pre-built .skill.md files
│ ├── Sub-Agents/Orchestration/ # Routing rules (routing.yaml)
│ ├── Sub-Agents/Templates/ # Custom skill templates
│ ├── Tools/MCP/ # MCP server config (servers.yaml)
│ ├── Memory/ # 4-layer memory config
│ ├── Security/Allowlists/ # Per-agent tool allowlists (8 agents)
│ ├── Security/Rules/ # Zero-trust policy
│ ├── Security/Guardrails/ # Prompt injection defense
│ └── AutoResearch/Programs/ # Skill optimizer loop
│
├── Docker/ # Container configs
│ ├── docker-compose.yaml # n8n + PostgreSQL 17 + pgvector (ARM64)
│ ├── .env.example # Secret template
│ ├── daemon.json # Docker daemon config
│ └── init-db.sql # Database bootstrap
│
├── Heartbeat/ # Service health monitoring
│ ├── heartbeat.sh # Push-model heartbeat daemon
│ └── heartbeat.yaml # Intervals, thresholds, alerts
│
├── Cron/ # Scheduled tasks
│ ├── Jobs/ # memory-cleanup, port-check, security-scan
│ ├── Templates/install-crons.sh # Cron installer
│ └── Logs/ # Execution logs
│
├── Scripts/ # Utility scripts
│ ├── health-check.sh # Full stack health verification
│ └── teardown.sh # Clean uninstall
│
├── Systemd/ # Service units
│ ├── arya-heartbeat.service # Heartbeat daemon
│ └── arya-openclaw.service # OpenClaw agent
│
└── memory/ # Runtime memory (daily logs)
Arya ships with a pre-baked soul layer (.soul/SOUL.md) that defines:
- Voice: Direct, technically precise, never sycophantic. Tagline: "Already done."
- Values: Safety over completion, transparency, proactive execution, minimal footprint
- SCAN drift guard: 7
@@SCAN_*markers across soul files trigger periodic self-checks to prevent personality drift - 8 sub-agents with structural tool allowlists: Scribe, Scout, Courier, Artisan, Watcher, Archivist, Analyst, Scheduler
Each sub-agent has an individual allowlist YAML in Agent/Security/Allowlists/ enforcing least-privilege tool access.
- Linux (Ubuntu 24.04 ARM64) -- tested on Hetzner CAX21
- 8GB+ RAM (4 vCPU, 80GB NVMe)
- Docker and Docker Compose (installed by Phase 5 if missing)
- Tailscale account (free tier)
| Component | Monthly |
|---|---|
| Hetzner CAX21 (ARM64, 4C/8G/80G) | ~$7 |
| LLM API (free-tier: Groq, Cerebras, Google AI Studio) | $0 |
| Tailscale (free tier) | $0 |
| Domain (optional) | $0-12 |
| Paid LLM fallback (DeepSeek V3.2, Claude Sonnet) | $0-33 |
| Total | $7-52/month |
MIT