Pre-alpha · AGPL-3.0 · runs on hardware you already own
The homelab cluster
that works in the first hour.
Rasputin turns a few Raspberry Pis or Intel N100 mini-PCs into one managed system: a web control plane, a node OS with atomic updates and automatic rollback, and a dedicated firewall node. Opinionated where you want guidance, open where you want control — and every line of it is open source. No paywall, no open core.
Flash a card, boot, open http://rasputin.local.
Cold start to working dashboard in under ten minutes — if it's slower, that's a bug and we want it filed.
What you get
First hour, not first weekend
Download, flash, set a role in one text file, boot. The first-run wizard registers a passkey and lands you on the dashboard. No config management, no shell required.
Updates you can trust
Atomic A/B OS updates with signed images and automatic rollback when a health check fails. An update that breaks a node undoes itself.
No passwords
Passkey-only login — Touch ID, Windows Hello, or a security key. SSH is key-only and your key is the only key: images ship with none baked in, and the build pipeline cannot inject one.
Apps without ceremony
Deploy from a curated catalog or paste your own Docker Compose. Your compose files stay yours — the escape hatch is always open, including opt-in Kubernetes (k3s) for those who want it.
A real firewall node
A dedicated x86 firewall with stateful filtering, WireGuard, and intrusion detection — managed from the same UI as the rest of the cluster.
Observability included
Per-node metrics and logs in one dashboard, out of the box, using components sized for small boards — not a monitoring stack you have to assemble first.
Straight answers before you flash
- It's pre-alpha. Image layouts and update formats still change without notice. Don't put it in front of a network you care about — yet.
- The IDS is detection-only. An N100 can't do inline intrusion prevention at 1 Gbps line rate, so Rasputin runs detection in tap mode and doesn't pretend otherwise.
- IPv4-only, by design. IPv6 is disabled across the whole stack.
- There is nothing to buy. Rasputin runs on a Pi 4/5, CM5, or any N100/amd64 box you already own. Down the road geekdojo plans purpose-built hardware for it — the software stays free either way.
- Every download is verifiable. Each release ships a manifest with SHA-256 checksums for every artifact.
Design partners wanted
The ask
Run Rasputin on your own hardware — a Raspberry Pi 4/5, CM5, or an Intel N100 box — for two weeks or more, and tell us in writing what's broken and what's missing. That's it. Blunt feedback is the valuable kind.
The give
Early access to every build, a direct line to the maintainer (your reports get answered fast, not triaged into a void), and your name in the credits.
Follow the build
A weekly-ish devlog — what shipped, one honest problem, one number — plus release announcements. The list is where launch news lands first.
Devlogs and release news only. No tracking pixels in the emails we control, unsubscribe anytime, and the list is never shared or sold.