Obsidian Web

Run Obsidian in a browser via Selkies WebRTC streaming on a bare-metal server.

Requirements

• Ubuntu 22.04 or 24.04 LTS
• Root access
• 1 GB RAM minimum (swap is created automatically)
• Ports 3000 (HTTP) and 3001 (HTTPS) open

Quick Start

# 1. Install Selkies streaming infrastructure (defaults: user=selkies, public, no auth)
sudo bash selkies-setup.sh

# 2. Start services
sudo systemctl start xvfb pulseaudio-selkies openbox-selkies selkies

# 3. Install Obsidian
sudo bash obsidian-setup.sh

Open https://<server-ip>:3001 in your browser (accept the self-signed cert warning).

Install under an existing user with security

# Install under 'ubuntu' user with basic auth and custom resolution
sudo bash selkies-setup.sh --user ubuntu --auth admin:mysecretpass --resolution 1920x1080

# Start services
sudo systemctl start xvfb pulseaudio-selkies openbox-selkies selkies

# Install Obsidian (auto-detects user from /etc/selkies.env)
sudo bash obsidian-setup.sh

Uninstall

# Remove all Selkies and Obsidian artifacts (preserves user account and vault data)
sudo bash selkies-uninstall.sh

Tailscale-only (recommended for private access)

sudo bash selkies-setup.sh --user ubuntu --tailscale-only
# Access via Tailscale IP only — public ports are firewalled
# Then use tailscale serve to proxy :3000, or access https://<tailscale-ip>:3001 directly

Localhost-only (for SSH tunnel or external reverse proxy)

sudo bash selkies-setup.sh --user ubuntu --bind 127.0.0.1
# Access via: ssh -L 3001:localhost:3001 ubuntu@server
# Then open: https://localhost:3001

CLI Options (selkies-setup.sh)

Flag	Default	Description
--user <name>	selkies	Linux user to run services under. Uses existing user if found, creates new one otherwise.
--bind <addr>	0.0.0.0	nginx listen address for both ports. 0.0.0.0 = public, 127.0.0.1 = localhost-only.
--auth <user:pass>	(none)	Enable nginx basic auth. Installs apache2-utils automatically.
--resolution <WxH>	1280x720	Streamed resolution (e.g. 1920x1080).
--tailscale-only	(off)	Configure UFW: deny all incoming except SSH + Tailscale interface.
--help		Show usage help.

Security note: If --bind 0.0.0.0 is used without --auth, the script prints a warning but proceeds. You may have your own security layer (VPN, cloud firewall).

obsidian-setup.sh takes no arguments — it auto-detects the user from /etc/selkies.env written by selkies-setup.sh.

selkies-uninstall.sh takes no arguments — it auto-detects the user from /etc/selkies.env.

Scripts

selkies-setup.sh

Sets up the generic Selkies WebRTC streaming infrastructure. Reusable for any desktop application, not just Obsidian.

What it does:

• Installs system packages (X11, GStreamer, PulseAudio, Openbox, nginx, build tools)
• Installs Node.js 22
• Configures service user (creates new or uses existing via --user)
• Configures Xvfb virtual display at :1
• Configures Openbox window manager (auto-maximize, single workspace)
• Configures PulseAudio null sink for headless audio
• Clones and builds Selkies (Python package, GStreamer, dashboards)
• Configures nginx reverse proxy (HTTP :3000 for reverse proxies, HTTPS :3001 for direct access)
• Writes systemd units for all services (parameterized for chosen user)
• Sets streamed resolution via --resolution

selkies-uninstall.sh

Removes all Selkies and Obsidian artifacts. Must be run as root.

What it removes:

• Systemd services and unit files (xvfb, pulseaudio-selkies, openbox-selkies, selkies)
• Selkies installation (/lsiopy, /opt/gstreamer, /usr/share/selkies)
• Obsidian installation (/opt/obsidian)
• Config files (/etc/selkies.env, nginx config, PulseAudio, Openbox autostart/menu)
• TLS certificates and auth files

What it preserves:

• The Linux user account (too risky to auto-remove)
• Vault data (<user-home>/vault)
• Apt packages (X11, GStreamer, Node.js, nginx, etc.)
• Swap file (/swapfile)

sudo bash selkies-uninstall.sh

obsidian-setup.sh

Installs Obsidian on top of the Selkies infrastructure. Must be run after selkies-setup.sh.

What it does:

• Auto-detects user and home directory from /etc/selkies.env
• Installs Electron dependencies (libxss1, libasound2t64)
• Downloads and extracts the latest Obsidian AppImage
• Configures Openbox autostart and right-click menu for Obsidian
• Pre-configures a vault at <user-home>/vault
• Restarts Openbox to pick up the new configuration

Services

All services run as the configured user (default: selkies) and auto-start on boot:

Service	Description
xvfb.service	Virtual X11 display :1
pulseaudio-selkies.service	Headless audio (null sink)
openbox-selkies.service	Window manager
selkies.service	WebRTC streamer
nginx.service	Reverse proxy (HTTP :3000 + HTTPS :3001)

# Start all
sudo systemctl start xvfb pulseaudio-selkies openbox-selkies selkies

# Check status
sudo systemctl status xvfb pulseaudio-selkies openbox-selkies selkies nginx

# View logs
journalctl -u selkies.service -f

Idempotency

All three scripts are idempotent and can be re-run safely. The install scripts check whether each step has already been done before proceeding. The uninstall script skips artifacts that don't exist.

Tested On

• Ubuntu 22.04 LTS (Jammy Jellyfish) on Vultr VPS
• Ubuntu 24.04 LTS (Noble Numbat) on AWS EC2