Euboulia

yoo-BOO-lee-uh – good deliberation

An assistant whose model, data and learning belong to you. The model runs on a computer you control, your host; the app on your Mac and iPhone talks to it. Planning, to-dos and chat, on your own model, with your keys.

How the parts fit together

How the parts fit togetherYour Mac and iPhone connect to your host, either directly or through a relay on a rented server. The host opens the tunnel to the relay from the inside. Your Macthe app, your key Your iPhonethe app, your key Your hostruns your model, holds your datahas its own key and certificate Relay (optional)a rented server, forwards bytes 1. directly, when the host has a stable address 2. or through the relay the host opens this tunnel itself, outward Every connection ends at the host and is checked against the certificate the host signed with its key.
The app and the host know each other by key. A relay is only a way to be reachable when the host sits behind a router.

Who is trusted

Who is trusted and what each can seeYour devices and host are trusted. The relay, the server company, DNS, certificate authorities, delivery networks and cloud AI services are not trusted. The relay sees addresses, times and amounts, not content. Trusted Your devices and your host The people you invitemore than strangers, not unconditionally They hold the keys, read the content,and decide who is a member. Your host answers only with a certificateit signed with its own key, so theconnection cannot be taken over on the way. Not trusted Relay operatorsServer and hosting companiesDNS providersCertificate authoritiesDelivery networks (CDNs)Cloud AI services A relay or a server company can see whichaddresses connect, when, and how much. It cannot read or change what is said, orpass itself off as your host. It can stopthe service. Nothing here hides that.
Large organizations are outside the circle. The design assumes they may be curious or hostile.

Your devices and your host are trusted. The people you invite are trusted more than strangers, not unconditionally. Large organizations are not: hosting and VPS companies, DNS providers, certificate authorities, delivery networks, relay operators and cloud AI services. A host is identified by its key, not its name; the app connects only over TLS to a certificate the host signed with that key; a relay holds no secret and forwards bytes it cannot read. The relay can still see which addresses connect, when, and how much.

Limits: the identity key has no backup yet; the installer below is fetched from a network you do not control (you can verify it first, see the end of this page); the protocol has not had an independent security review.

Set up a host

The host is the Linux computer (x86_64, systemd) that runs your model, for example with Ollama. How the app's devices reach it decides what you set up:

Who administers the host

Everything is identified by a key, not by a name or an IP address. When you first open the app it creates your key on that device; nobody else has it. The first administrator of a host is made at the host: the installer prints a one-time claim code on the host's own terminal (valid 30 minutes, works once, five wrong tries void it), you connect from the app and type it, and the host records your device as its administrator. Nothing a phone does remotely can do that without the code, so a relay, the server company, DNS or a delivery network cannot make themselves administrator. Each device has its own key: other devices of yours, and other people, ask to join from the app and the administrator approves them in Settings, Members. For scripted installs there is also --admin 0x…, which names the administrator's address in the command.

Prefer a file to typing? The app reads a small configuration file, and the page gives its format and a prompt an AI assistant can use to write one for you.

Both guides end with a pairing link. The app checks that the host it reaches proves exactly the address in the link, over a connection tied to the certificate the host signed for.

Prefer to read the installer first?

curl -fsSLO https://euboulia.app/install.sh
curl -fsSLO https://euboulia.app/install.sh.sig
curl -fsSLO https://euboulia.app/allowed_signers
ssh-keygen -Y verify -f allowed_signers -I euboulia-release -n euboulia-release -s install.sh.sig < install.sh
less install.sh
bash install.sh host --dry-run

The signing key's fingerprint is published in the project repository, not only here, so a copy served from this domain cannot vouch for itself. --dry-run shows everything the installer would do without changing anything.

Remove it

curl -fsSL https://euboulia.app/install.sh | bash -s -- uninstall            # the host
curl -fsSL https://euboulia.app/install.sh | bash -s -- uninstall --purge    # and its keys, members and config