Deploy Omega

Quick path: golain scaffold (dev and SQLite sync)

For Golain SQLite replication, the fastest path is golain omega scaffold or the TUI Deploy Omega wizard. Both download Omega + SQLite deps from CDN, issue MQTT certificates, and write ready-to-run config.

golain login
golain context set --org=my-org --project=my-project
golain devices create --name=gw-01 --fleet=sensors

golain omega scaffold \
  --device=gw-01 \
  --fleet=sensors \
  --sample-db \
  --transport=tls \
  --out=~/.config/golain/omega/gw-01

source ~/.config/golain/omega/gw-01/omega-env.sh
~/.config/golain/omega/gw-01/omega -client ~/.config/golain/omega/gw-01/omega-config.yaml

Use --transport=tls when QUIC fails against your broker. The TUI wizard offers the same transport choice.

The TUI wizard additionally generates systemd, launchd, OpenRC, or init.d unit files. → Omega deploy guide

Production: client-specific binary

Production deployments often use client-specific binaries — connection and modules are embedded at build time. Only secrets and device identity come from environment variables.

make build-client CLIENT=ilyama-edge GOOS=linux GOARCH=arm64
# → bin/omega-linux-arm64

Copy the binary to the device. No YAML file required on disk when config is embedded.

Linux (systemd)

sudo cp bin/omega-linux-amd64 /usr/local/bin/omega
sudo chmod +x /usr/local/bin/omega
sudo mkdir -p /var/lib/omega /var/tmp/omega
sudo useradd -r -s /usr/sbin/nologin omega
sudo chown -R omega:omega /var/lib/omega /var/tmp/omega

Create /etc/systemd/system/omega.service:

[Unit]
Description=Omega Edge Runtime
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=omega
Group=omega
Environment=OMEGA_DEVICE_ID=device-42
Environment=OMEGA_AUTH_TOKEN=your-production-secret
Environment=OMEGA_MQTT_USERNAME=your-mqtt-user
Environment=OMEGA_MQTT_PASSWORD=your-mqtt-password
ExecStart=/usr/local/bin/omega
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/omega /var/tmp/omega

[Install]
WantedBy=multi-user.target

Enable:

sudo systemctl daemon-reload
sudo systemctl enable omega
sudo systemctl start omega
sudo journalctl -u omega -f

When using scaffold output, the TUI wizard writes a unit file under your --out directory with install commands.

macOS (launchd)

Install binary to /usr/local/bin/omega, create ~/Library/LaunchAgents/io.golain.omega.plist with EnvironmentVariables for OMEGA_* vars, then:

launchctl load ~/Library/LaunchAgents/io.golain.omega.plist

See Omega repo docs/deployment.md for full plist template.

Windows Service

Use sc create or NSSM to register omega.exe as a service. Set OMEGA_* environment variables in the service configuration.

Docker (single container)

docker run -d --name omega \
  -e OMEGA_DEVICE_ID=device-42 \
  -e OMEGA_AUTH_TOKEN=secret \
  -e OMEGA_MQTT_USERNAME=user \
  -e OMEGA_MQTT_PASSWORD=pass \
  -v /var/lib/omega:/var/lib/omega \
  your-registry/omega:tag

Prefer host networking or explicit MQTT DNS when bridging to on-prem brokers.

Production checklist

signed_control.enabled: true in embedded client config
TLS/mTLS configured with valid CA trust
security.capabilities lists only required modules
rpc.allowed_commands minimized
expose_sensitive_telemetry: false unless required
Secrets in env vars or secret manager — not in unit files committed to git
Device registered in Golain console before first connect (or JITR bootstrap cert ready)
SQLite deps installed when using replication (install-sqlite-deps.sh or scaffold)

→ Remote control · Omega setup for SQLite sync

Omega edge runtime

Device RPC

Edge SQLite sync

Edge agent (Omega)

Operate & query

Wire protocol reference

Quick path: golain scaffold (dev and SQLite sync)

Production: client-specific binary

Linux (systemd)

macOS (launchd)

Windows Service

Docker (single container)

Production checklist

​Quick path: golain scaffold (dev and SQLite sync)

​Production: client-specific binary

​Linux (systemd)

​macOS (launchd)

​Windows Service

​Docker (single container)

​Production checklist

Quick path: golain scaffold (dev and SQLite sync)

Production: client-specific binary

Linux (systemd)

macOS (launchd)

Windows Service

Docker (single container)

Production checklist