> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ilyama.golain.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy Omega

> Deploy Omega with golain scaffold, systemd, launchd, or Windows service.

## Quick path: golain scaffold (dev and SQLite sync)

For Golain SQLite replication, the fastest path is **`golain omega scaffold`** or the TUI **Deploy Omega** wizard. Both download Omega + SQLite deps from CDN, issue MQTT certificates, and write ready-to-run config.

```bash theme={null}
golain login
golain context set --org=my-org --project=my-project
golain devices create --name=gw-01 --fleet=sensors

golain omega scaffold \
  --device=gw-01 \
  --fleet=sensors \
  --sample-db \
  --transport=tls \
  --out=~/.config/golain/omega/gw-01

source ~/.config/golain/omega/gw-01/omega-env.sh
~/.config/golain/omega/gw-01/omega -client ~/.config/golain/omega/gw-01/omega-config.yaml
```

<Tip>
  Use **`--transport=tls`** when QUIC fails against your broker. The TUI wizard offers the same transport choice.
</Tip>

The TUI wizard additionally generates **systemd**, **launchd**, **OpenRC**, or **init.d** unit files. → [Omega deploy guide](/tools/platform-tui/omega-deploy)

***

## Production: client-specific binary

Production deployments often use **client-specific binaries** — connection and modules are embedded at build time. Only secrets and device identity come from environment variables.

```bash theme={null}
make build-client CLIENT=ilyama-edge GOOS=linux GOARCH=arm64
# → bin/omega-linux-arm64
```

Copy the binary to the device. No YAML file required on disk when config is embedded.

## Linux (systemd)

```bash theme={null}
sudo cp bin/omega-linux-amd64 /usr/local/bin/omega
sudo chmod +x /usr/local/bin/omega
sudo mkdir -p /var/lib/omega /var/tmp/omega
sudo useradd -r -s /usr/sbin/nologin omega
sudo chown -R omega:omega /var/lib/omega /var/tmp/omega
```

Create `/etc/systemd/system/omega.service`:

```ini theme={null}
[Unit]
Description=Omega Edge Runtime
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=omega
Group=omega
Environment=OMEGA_DEVICE_ID=device-42
Environment=OMEGA_AUTH_TOKEN=your-production-secret
Environment=OMEGA_MQTT_USERNAME=your-mqtt-user
Environment=OMEGA_MQTT_PASSWORD=your-mqtt-password
ExecStart=/usr/local/bin/omega
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/omega /var/tmp/omega

[Install]
WantedBy=multi-user.target
```

Enable:

```bash theme={null}
sudo systemctl daemon-reload
sudo systemctl enable omega
sudo systemctl start omega
sudo journalctl -u omega -f
```

When using scaffold output, the TUI wizard writes a unit file under your `--out` directory with install commands.

## macOS (launchd)

Install binary to `/usr/local/bin/omega`, create `~/Library/LaunchAgents/io.golain.omega.plist` with `EnvironmentVariables` for `OMEGA_*` vars, then:

```bash theme={null}
launchctl load ~/Library/LaunchAgents/io.golain.omega.plist
```

See Omega repo `docs/deployment.md` for full plist template.

## Windows Service

Use `sc create` or NSSM to register `omega.exe` as a service. Set `OMEGA_*` environment variables in the service configuration.

## Docker (single container)

```bash theme={null}
docker run -d --name omega \
  -e OMEGA_DEVICE_ID=device-42 \
  -e OMEGA_AUTH_TOKEN=secret \
  -e OMEGA_MQTT_USERNAME=user \
  -e OMEGA_MQTT_PASSWORD=pass \
  -v /var/lib/omega:/var/lib/omega \
  your-registry/omega:tag
```

Prefer host networking or explicit MQTT DNS when bridging to on-prem brokers.

## Production checklist

* [ ] `signed_control.enabled: true` in embedded client config
* [ ] TLS/mTLS configured with valid CA trust
* [ ] `security.capabilities` lists only required modules
* [ ] `rpc.allowed_commands` minimized
* [ ] `expose_sensitive_telemetry: false` unless required
* [ ] Secrets in env vars or secret manager — not in unit files committed to git
* [ ] Device registered in Golain console before first connect (or JITR bootstrap cert ready)
* [ ] SQLite deps installed when using replication (`install-sqlite-deps.sh` or scaffold)

→ [Remote control](/edge/remote-control) · [Omega setup for SQLite sync](/edge/data-sync/omega-setup)