Downloads · AGPL-3.0 · pre-alpha

Get Rasputin

Flashable images for the node OS and the firewall, published straight from the source repositories. Every release is signed and ships a manifest.json with a SHA-256 checksum for each artifact — verify before you flash.

Flash it in one command

On macOS or Linux, plug in the first node's microSD card or SSD and paste this into a terminal:

curl -fsSL https://rasputin.geekdojo.com/bootstrap.sh | sudo bash

It asks three questions — which hardware, a name for the node, which SSH key — then downloads the latest stable image, verifies its SHA-256 against the release manifest, flashes the drive (external drives only, behind a typed confirmation), writes your control-plane seed, and reads it back from the medium to prove it landed. Then power the node on and open http://rasputin.local — the first-run wizard registers a passkey and lands you on the dashboard. Under ten minutes, cold start to working cluster.

Review the script without running it — read it on GitHub (AGPL-3.0, same repo as this site), or read exactly what you'd be running: curl -fsSL https://rasputin.geekdojo.com/bootstrap.sh | less

The script resolves the current stable release itself — 2026.08.3 at this build — so there is no version to choose and nothing to download by hand. Prefer the image files, or flashing manually? They're just below.

Adding a node to a cluster that's already running? Use the control plane's own Add node wizard instead — it hands you an equivalent one-liner with the node's enrollment seed baked in.

Prefer to flash manually? (Windows, or by hand)
  1. Verify. Check the image's SHA-256 against its manifest.json — the stable URL is releases/latest/download/manifest.json on each repo (field imageSha256). Authenticity rides on the signature, not on where the file is hosted:
    curl -fsSLO https://github.com/geekdojo/rasputin-os/releases/latest/download/manifest.json
shasum -a 256 rasputin-os-*.img.xz   # compare to imageSha256 in manifest.json
  2. Flash. Write the image to a microSD card, NVMe, or USB drive. Raspberry Pi Imager (custom image) and balenaEtcher take the compressed files as-is; flashing with dd, decompress first (xz -d for the OS image, gzip -d for the firewall's .img.gz). On Windows, Rufus works too — fair warning: we don't bench-test Windows flashing, so if something's weird, say so. macOS + Etcher note: a "validation failed" at the very end is usually benign — macOS auto-mounts the freshly written seed volume and dirties it behind Etcher's back. The write itself succeeded; check the seed file landed and carry on.
  3. Seed. Mount the volume labeled RASPUTIN-OS (RASPUTIN-FW on the firewall image) and drop a rasputin-seed.env — a short KEY=value file (copy-exact template; save with Unix LF line endings — the file is read by sh, and stray CRs corrupt the values). For your first node (the control plane) it's three lines:
    RASPUTIN_NODE_ROLE=controlplane
RASPUTIN_NODE_ID=cp-1
RASPUTIN_SSH_AUTHORIZED_KEY="ssh-ed25519 AAAA… you@laptop"
    RASPUTIN_NODE_ID names the control plane — any short lowercase name (letters, digits, hyphens) works. Use your own SSH public key and keep the quotes — no key is baked in, yours is the only one. Full seed options →
  4. Boot. Power on and open http://rasputin.local. The first-run wizard registers a passkey and lands you on the dashboard — under ten minutes, cold start to working cluster.

Latest stable images

resolved 2026-08-24

Rasputin OS

2026.08.3

The node operating system — one image per architecture; a node's role is chosen at first boot. The web control plane ships inside this image, so there is nothing else to install.

Raspberry Pi 4 / 5 / CM5 rasputin-os-rpi-2026.08.3.img.xz Intel N100 / any amd64 box rasputin-os-n100-2026.08.3.img.xz

Release notes → · manifest.json (checksums)

Rasputin OpenWrt Firewall

2026.08.3

The dedicated firewall node — a separate x86-only image on its own release cadence, with stateful filtering, WireGuard, and tap-mode intrusion detection, managed from the same UI as the rest of the cluster.

Intel N100 firewall (x86-64) rasputin-fw-n100-2026.08.3-ab.img.gz

Release notes → · manifest.json (checksums)

The version pill above is resolved at site build time (daily, and on each release). The authoritative pointer is each repo's releases/latest/download/manifest.json — a stable URL serving plain JSON with every artifact's SHA-256; also mirrored as /releases.json on this site. Signatures chain to the public Rasputin root CA — exact verify commands, and what is and isn't signed, are on Install with an AI agent, which is also the page to hand an AI agent driving your install.

Before you flash

  • It's pre-alpha. Image layouts and update formats still change without notice. Don't put it in front of a network you care about — yet.
  • Two supported targets. Raspberry Pi 4 / 5 / CM5 (arm64) and Intel N100 / amd64 for nodes; an N100 box for the firewall. Everything else is community territory.
  • There is nothing to buy. Rasputin runs on hardware you already own, and the software is AGPL-3.0 — free, no paywall, no open core.
  • These images are for first flashes. A running cluster updates itself: Check for Updates applies the signed OTA bundles from the same releases (the .raucb files in the OS manifest — atomic, with automatic rollback; the firewall uses its own .rootfs artifact). You come back to this page for new media, not for upgrades.
  • Dev builds exist. Beyond the stable images above, each repo publishes -dev.N pre-releases — the newest work, but rougher and subject to breaking format changes. Grab them from the OS or firewall releases if you want the bleeding edge.
All OS releases on GitHub → Become a design partner