A host with a stable address

For a computer that other devices can reach at a fixed address: an IP address on your own network, a public IP address, or a name that resolves to it (with a forwarded port if it is behind a router). It takes one command and no domain, certificate authority or reverse proxy.

What you need

A Linux computer, x86_64 with systemd, that runs your model (for example Ollama on port 11434). The installer never uses sudo and installs under your home directory.
Its address: 192.168.1.20, 203.0.113.7 or host.example.org. IPv6 is not supported by the app's command builder yet.
The app on your phone or Mac. You do not need its address: the installer prints a one-time claim code, and typing it in the app is what makes you the host's administrator.

Step 1: install the host

curl -fsSL https://euboulia.app/install.sh | bash -s -- host \
  --tls-port 8443 --tls-bind 0.0.0.0 \
  --endpoint https://ADDRESS_OR_NAME:8443

Add --dry-run first to see what it would do. --tls-bind 0.0.0.0 matters: without it the TLS port listens on this computer only. The host makes its own self-signed certificate on first start and signs its fingerprint into its record, so a plain IP address works.

It ends by printing a pairing link, euboulia://pair?url=...&address=.... euboulia-host pairing-link prints it again at any time.

Step 2: make it reachable

On your own network, nothing else is needed. On an iPhone the first connection to a device on the local network asks for permission: allow it.
From the internet, forward TCP port 8443 on your router to this computer and allow it in the computer's firewall. The port is authenticated (a signed login is required before anything is served) and limits concurrent model requests, but it is exposed to the internet: decide that deliberately. If you cannot forward a port, use a relay instead: the relay guide.

Step 3: check it

curl -sk https://ADDRESS_OR_NAME:8443/health
curl -sk https://ADDRESS_OR_NAME:8443/.well-known/phronesis.json

The first prints ok. The second prints the host's signed record: its address, its endpoint and the fingerprint of its certificate (tlsCertSHA256). -k is expected: a browser or curl does not know this certificate, and the app does not ask a certificate authority either; it checks the fingerprint against the signed record.

Step 4: pair the app

Open the app (Settings, Connection): scan the pairing code or paste the link, then press Connect. The host says it does not know this device yet; choose Claim this host and type the claim code the installer printed (it is valid for 30 minutes and works once; euboulia-host claim prints a new one). That makes this device the host's administrator. Then choose a model. Other devices ask to join and you approve them in the app (Settings, Members).

If something is wrong

Symptom	Look at
The installer says the port is in use	Choose another with `--tls-port` and `--port`.
The app cannot reach the host	The endpoint in the link must be reachable from the phone: same Wi-Fi for a local address, a forwarded port for the internet. `euboulia-host status` shows the service.
The app says the connection is not bound to the host	The certificate it saw is not the one in the signed record: something between the app and the host is answering. Do not continue.
The app says the host proves a different address	The link and the host do not match: a wrong or stale link. Print it again with `euboulia-host pairing-link`.