Downloads · AGPL-3.0 · alpha
Get Rasputin
Flashable images for the node OS and the firewall, published straight from the
source repositories. Every release is signed and ships a manifest.json with a
SHA-256 checksum for each artifact — verify before you flash.
Flash it in one command
On macOS or Linux, plug in the first node's microSD card or SSD and paste this into a terminal:
curl -fsSL https://rasputin.geekdojo.com/bootstrap.sh | sudo bash
It asks four questions — which hardware, a name for the cluster, a name for the node,
which SSH key — then
downloads the latest stable image, verifies its SHA-256 against the release manifest,
flashes the drive (external drives only, behind a typed confirmation), writes your
control-plane seed, and reads it back from the medium to prove it landed. Then power the
node on and open http://<your-cluster>.local (http://rasputin.local
if you kept the default name) — the first-run wizard registers a
passkey and lands you on the dashboard. Under ten minutes, cold start to working cluster.
Review the script without running it — read it
on GitHub
(AGPL-3.0, same repo as this site), or read exactly what you'd be running:
curl -fsSL https://rasputin.geekdojo.com/bootstrap.sh | less
The script resolves the current stable release itself — 2026.10.0 at this build — so there is no version to choose and nothing to download by hand. Prefer the image files, or flashing manually? They're just below.
Adding a node to a cluster that's already running? Use the control plane's own Add node wizard instead — it hands you an equivalent one-liner with the node's enrollment seed baked in.
Prefer to flash manually? (Windows, or by hand)
- Verify. Check the image's SHA-256 against its
manifest.json— the stable URL isreleases/latest/download/manifest.jsonon each repo (fieldimageSha256). Authenticity rides on the signature, not on where the file is hosted:curl -fsSLO https://github.com/geekdojo/rasputin-os/releases/latest/download/manifest.json shasum -a 256 rasputin-os-*.img.xz # compare to imageSha256 in manifest.json
- Flash. Write the image to a microSD card, NVMe, or USB drive.
Raspberry Pi Imager (custom image) and balenaEtcher take the compressed files as-is;
flashing with
dd, decompress first (xz -dfor the OS image,gzip -dfor the firewall's.img.gz). On Windows, Rufus works too — fair warning: we don't bench-test Windows flashing, so if something's weird, say so. macOS + Etcher note: a "validation failed" at the very end is usually benign — macOS auto-mounts the freshly written seed volume and dirties it behind Etcher's back. The write itself succeeded; check the seed file landed and carry on. - Seed. Mount the volume labeled
RASPUTIN-OS(RASPUTIN-FWon the firewall image) and drop arasputin-seed.env— a shortKEY=valuefile (copy-exact template; save with Unix LF line endings — the file is read bysh, and strayCRs corrupt the values). For your first node (the control plane) it's four lines:RASPUTIN_NODE_ROLE=controlplane RASPUTIN_CLUSTER_ID=rasputin RASPUTIN_NODE_ID=cp-1 RASPUTIN_SSH_AUTHORIZED_KEY="ssh-ed25519 AAAA… you@laptop"
RASPUTIN_CLUSTER_IDnames the cluster — you browse it athttps://<name>.local, and it's fixed for the life of the installation, so set it here or not at all. Leave itrasputinunless a second Rasputin cluster might share your network.RASPUTIN_NODE_IDnames this box within that cluster — any short lowercase name (letters, digits, hyphens) works for either. Use your own SSH public key and keep the quotes — no key is baked in, yours is the only one. Full seed options → - Boot. Power on and open
http://<your-cluster>.local. The first-run wizard registers a passkey and lands you on the dashboard — under ten minutes, cold start to working cluster.
Latest stable images
resolved 2026-10-08Rasputin OS
2026.10.0The node operating system — one image per architecture; a node's role is chosen at first boot. The web control plane ships inside this image, so there is nothing else to install.
Rasputin OpenWrt Firewall
2026.10.0The optional firewall node — a separate x86-only image on its own release cadence, with stateful filtering, WireGuard, and tap-mode intrusion detection, managed from the same UI as the rest of the cluster.
The version pill above is resolved at site build time (daily, and on each
release). The authoritative pointer is each repo's
releases/latest/download/manifest.json — a stable URL serving plain JSON with
every artifact's SHA-256; also mirrored as /releases.json
on this site. Signatures chain to the public
Rasputin root CA — exact verify
commands, and what is and isn't signed, are on
Install with an AI agent, which is also the
page to hand an AI agent driving your install.
Before you flash
- It's alpha. Image layouts and update formats still change without notice. Don't put it in front of a network you care about — yet.
- Nodes: a Raspberry Pi, or any UEFI amd64 box. The firewall is narrower — a separate x86-only image, with an Intel N100 box as the reference target. Supported hardware lists what has actually been booted, and what is only expected to work.
- There is nothing to buy. Rasputin runs on hardware you already own, and the software is AGPL-3.0 — free, no paywall, no open core.
- These images are for first flashes. A running cluster updates itself:
Check for Updates applies the signed OTA bundles from the same releases (the
.raucbfiles in the OS manifest — atomic, with automatic rollback; the firewall uses its own.rootfsartifact). You come back to this page for new media, not for upgrades. - Dev builds exist. Beyond the stable images above, each repo publishes
-dev.Npre-releases — the newest work, but rougher and subject to breaking format changes. Grab them from the OS or firewall releases if you want the bleeding edge.