Install the server.

Authenticated downloads

Open the hosted console and sign in with GitHub. The Install a server panel provides the current Windows ZIP and Ubuntu packages for x86-64 and ARM64. The download API rejects requests without a valid console session, selects only the named assets from the private project release, and issues a short-lived download URL.

Windows package

1. Download and extract ephemeral-phone-server-windows-amd64.zip.
2. Open Windows PowerShell as Administrator in that folder.
3. Run the installer below.

Set-ExecutionPolicy -Scope Process Bypass
.\Install-EphemeralPhone.ps1

The installer copies the binaries and console to Program Files, stores state and generated secrets in ProgramData, registers a hidden startup task, starts the server on loopback, and waits for /healthz. It does not open a firewall port.

Read the generated administrator token from the path printed at the end of installation, then open http://localhost:8080. To attach an existing remote runtime without placing its token in shell history:

.\Install-EphemeralPhone.ps1 -RuntimeProvider remote `
  -RemoteAgentUrl https://runtime.example.com `
  -AgentTokenFile C:\secure\agent-token.txt

Ubuntu package

Choose the package matching dpkg --print-architecture, then install it locally:

sudo apt install ./ephemeral-phone-server-ubuntu-amd64.deb
# ARM64 hosts use ephemeral-phone-server-ubuntu-arm64.deb

sudo ephemeral-phone-configure status
sudo cat /etc/ephemeral-phone/admin-token

The package creates a locked service account, generates independent server and agent tokens, installs the systemd units, starts the loopback control plane, and preserves configuration and phone state during normal package removal or upgrade.

Connect a real Android runtime

The server is healthy immediately after installation, but its safe default provider does not launch Android. A technician can install a reviewed command adapter directly into the local control plane:

sudo ephemeral-phone-configure runtime /path/to/reviewed-runtime.json

To make an Ubuntu machine a separately addressable runtime node, provide its reviewed adapter and the HTTPS address that will front the agent:

sudo ephemeral-phone-configure agent \
  /path/to/reviewed-runtime.json \
  https://runtime.example.com

The command enables the agent service, adds its unprivileged account to existing runtime-access groups, and prints the location of the generated pairing secret. A control plane can then connect to that protected agent:

sudo ephemeral-phone-configure remote https://runtime.example.com

The remote command prompts for the matching secret without including it in shell history. Runtime images, virtualisation, device access, storage encryption, GPU support, TLS termination, WebRTC media networking, upgrades, and recovery remain deployment-specific. See the technician acceptance guide.

Network and secret defaults

• Both installers bind the control plane to 127.0.0.1:8080 by default.
• Generated secrets are restricted to Administrators on Windows and root:ephemeral-phone on Ubuntu.
• No installer opens a firewall, publishes a port, installs a tunnel, or downloads an Android image without an operator decision.
• Use TLS and an access-controlled network before changing the listener from loopback.
• Review command-adapter JSON before installation; its lifecycle commands execute with the service account’s privileges.