PROJECT ORCHARD

§Contents

2Pick a track

Each track is a complete, working build. Later tracks add capability and effort. AI subscription cost is the same on every track (see §17) and excluded here. Below Seedling there's also a $0 on-ramp — the 🌰 Pip rungs on the next page.

↑The Ladder — start free, climb as needed

Every rung is a price tag — spend nothing until something actually pinches. And note the bottom rung: AI is optional. This build works as a pure shared docs-and-notes system for $0, with AI added per-person, later or never.

more: thegood.cloud · nextcloud.com/sign-up · ollama.com · openrouter.ai

3Builds by persona

This build isn't just for developers. Each card names the track (§2), the hardware and software that fit, and the realistic cost.

4Hardware

6Flash & first boot

1. Download the Armbian minimal/server image (Ubuntu 24.04) for Orange Pi 5 from armbian.com.
2. Flash it to a microSD with balenaEtcher or Raspberry Pi Imager ("Use custom image").
3. Insert the SD, connect Ethernet, power on. Find the Pi's IP in your router's client list:

ssh root@<pi-ip>          # Armbian first-boot wizard: set passwords, create your user

4. Move the OS to NVMe so the SD card can retire:

sudo armbian-config       # System → Install → boot from NVMe → follow prompts
sudo reboot               # then pull the SD card

more: etcher.balena.io · armbian.com/orange-pi-5

sudo apt update && sudo apt full-upgrade -y
sudo apt install -y unattended-upgrades tmux git curl htop
sudo dpkg-reconfigure -plow unattended-upgrades   # auto security patches: YES

# from your laptop — copy your key onto the pi
ssh-copy-id you@<pi-ip>
# on the pi — turn off password logins
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

8Tailscale

Tailscale builds an encrypted WireGuard mesh between your devices — zero open ports, zero router config. The free Personal plan covers this entire build.

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh          # --ssh: tailscale handles SSH auth via your identity

Then in the admin console at login.tailscale.com:

• Enable MagicDNS — the Pi is now reachable as grove from every device on your tailnet.
• Disable key expiry for the Pi and Macs (Machines → ⋮ → Disable key expiry), or you'll get locked out in ~180 days.
• Install Tailscale on your phone, tablet, and laptop. A phone terminal app (Termius, Blink) + ssh grove = your dev environment in your pocket.

more: tailscale.com/kb · tailscale.com/kb/1193/tailscale-ssh

# ~/.tmux.conf
set -g mouse on
set -g history-limit 100000
set -g default-terminal "tmux-256color"

# daily-driver alias (~/.bashrc or ~/.zshrc)
alias work='tmux new -A -s main'   # attach if it exists, create if not

10The AI client

Examples use Claude Code; the pattern is identical for Codex CLI, Gemini CLI, or aider — all run on ARM64 Linux.

# Node 22 LTS via nvm (survives distro upgrades better than apt's node)
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
source ~/.bashrc && nvm install 22
npm install -g @anthropic-ai/claude-code
claude               # first run: browser-based login

Headless login: the login flow wants a browser. Either paste the printed URL into any browser and copy the code back, or port-forward: ssh -L 54545:localhost:54545 grove and open the URL locally.

more: docs.claude.com/en/docs/claude-code · github.com/nvm-sh/nvm · aider.chat

sudo apt install -y gh
gh auth login        # choose SSH, let it generate + upload a key
git config --global user.name  "Your Name"
git config --global user.email "you@example.com"
mkdir -p ~/lazy-agent/projects && cd ~/lazy-agent/projects && gh repo clone you/your-app

12Notes sync — Nextcloud ⇄ Obsidian

Each Obsidian vault is a folder of Markdown files — Obsidian never runs on the Pi. Keep every vault under one parent, ~/lazy-agent/vaults/ (§21), and a single sync covers them all: personal, shared, per-project.

sudo apt install -y nextcloud-desktop-cmd
mkdir -p ~/lazy-agent/vaults
# use an APP PASSWORD: Nextcloud → Settings → Security → Devices & sessions

Create a service + timer so sync runs every 5 minutes, forever:

# /etc/systemd/system/vaultsync.service
[Unit]
Description=Nextcloud vault sync
[Service]
Type=oneshot
User=you
ExecStart=/usr/bin/nextcloudcmd --non-interactive \
  --user you --password-from-env \
  /home/you/lazy-agent/vaults https://cloud.example.com/remote.php/webdav/Vaults
EnvironmentFile=/home/you/.config/vaultsync.env   # NC_PASSWORD=app-password · chmod 600

# /etc/systemd/system/vaultsync.timer
[Unit]
Description=Sync vault every 5 min
[Timer]
OnBootSec=2min
OnUnitActiveSec=5min
[Install]
WantedBy=timers.target

sudo systemctl enable --now vaultsync.timer
systemctl list-timers | grep vault     # verify

Now "take notes in my Obsidian" is just the agent writing Markdown into a vault — add a vault by adding a directory. Each vault carries an AGENTS.md telling agents how to treat it; layout and ready-made files in §21.

more: docs.nextcloud.com · obsidian.md

13Mac build & simulator nodes

About 10 minutes per Mac:

1. Install Tailscale and sign in. Name machines by role, not hardware — mac-build, mac-sim — so lanes and docs survive hardware swaps.
2. System Settings → General → Sharing → Remote Login: ON (your user only).
3. Keep it awake: sudo pmset -a sleep 0 disablesleep 1. Laptops: keep the lid open or add a dummy HDMI plug — simulators want a "display."
4. Install Xcode. Pin the same version on every Mac with xcodes; then sudo xcodebuild -license accept.
5. Clone your repos to the same path on every Mac, e.g. ~/src/your-app.
6. fastlane: your lanes are already in-repo. Use match so signing certs live in an encrypted private repo — any Mac becomes build-capable with one fastlane match development. Keep MATCH_PASSWORD and the App Store Connect API key in ~/.zshenv (chmod 600), never in the repo.
7. Android: plug a real device into mac-sim (or the Pi) — adb devices over USB, or Wi-Fi adb across the tailnet. Google ships no Android emulator for ARM Linux; real devices are better for end-to-end testing anyway.

more: docs.fastlane.tools · docs.fastlane.tools/actions/match · github.com/XcodesOrg/xcodes · codemagic.io

14Wiring the agent to the Macs

The part that feels like magic: the agent on the Pi treats the Macs as tools. Because fastlane already encodes your signing and release logic, the agent never needs to understand Xcode — it runs lanes over SSH and reads the output.

# things the agent (or you) run from the pi
ssh mac-build 'cd ~/src/your-app && git pull && fastlane ios beta'
ssh mac-sim   'xcrun simctl boot "iPhone 16"; cd ~/src/your-app && flutter run -d iPhone'
ssh mac-sim   'xcrun simctl io booted screenshot /tmp/s.png' && scp mac-sim:/tmp/s.png .

Teach every repo the topology with a CLAUDE.md (or AGENTS.md) block:

# CLAUDE.md (excerpt)
## Build topology
- This machine (grove) is ARM Linux: edit, test pure-Dart, git. No Xcode here.
- iOS build/publish:   ssh mac-build 'cd ~/src/your-app && fastlane ios beta'
- iOS simulator runs:  ssh mac-sim '…' — screenshot via simctl, scp back to inspect
- Android device tests: adb over the tailnet on mac-sim
- Always commit + push before triggering remote lanes (Macs build from git)

Allow-list the pattern once in the project's .claude/settings.json so remote builds don't prompt every time:

{ "permissions": { "allow": [ "Bash(ssh mac-build *)", "Bash(ssh mac-sim *)" ] } }

more: docs.claude.com/en/docs/claude-code/settings

15Voice input (optional)

• Phone dictation (zero setup): use your phone keyboard's mic inside the SSH terminal app. Surprisingly good; punctuation is the only pain.
• whisper.cpp on the Pi: the board runs Whisper small/base comfortably. Record a voice memo on your phone → it syncs into ~/vault/Inbox/ via Nextcloud → a systemd path unit transcribes it into your daily note or feeds it to the agent as a prompt. About an hour of glue scripting.

git clone https://github.com/ggerganov/whisper.cpp && cd whisper.cpp
cmake -B build && cmake --build build -j
./build/bin/whisper-cli -m models/ggml-small.bin -f memo.wav -otxt

17Costs

Build (one-time)

Running (annual)

Worked example — Grafted · Claude Pro · owned Macs · managed Nextcloud

The AI subscription dominates everything else. The hardware is a rounding error next to a year of inference — which is exactly why the client belongs on a $150 board instead of a $2,000 laptop.

19Substitutions (and why the design is what it is)

The two most common "couldn't I just…?" swaps: what you gain, what you give up, and why the main path is prescribed anyway.

💻 The rig: a retired laptop instead of a Pi

Any x86-64 laptop that still boots can be the Grove. Flash Ubuntu Server 24.04 from a USB stick (DietPi ships x86 images too), set HandleLidSwitch=ignore in /etc/systemd/logind.conf, and every command in this guide runs unchanged. What you gain:

• $0 hardware — usually more RAM, CPU, and storage than the Pi — and the battery doubles as a free mini-UPS.
• x86-64 closes the Android gap: Google's emulator ships for x86-64 Linux but not ARM, so a laptop Grove can run Android emulators locally — the one platform hole the Pi build has.

Why the guide leads with the Pi anyway:

• Power: 15–40 W idle vs ~5 W — $20–60/yr vs $7. Cheap, but no longer negligible.
• Moving parts: fans and dust on an always-on machine mean noise and eventual maintenance; the passive Pi case has neither.
• Batteries hate 24/7 charging. A swollen cell inside a closed laptop is a real hazard — remove it and run on AC, or cap the charge level in firmware.
• Old hardware fails on its own schedule. Acceptable — blast radius means you lose nothing — but plan to rebuild someday.

Verdict: if the spare laptop already exists, it's the best $0 Seedling hardware there is. The architecture doesn't care which rig you pick — state lives in the Sky either way.

☁️ The Sky: free inference — OpenRouter, Ollama Cloud, free tiers

• OpenRouter — one OpenAI-compatible API key routing to dozens of models, including rotating :free ones; drops into aider and most CLI agents. Drawbacks: free models are rate-limited and mid-tier, some free endpoints log or train on prompts (check each model's data policy), and there's now a middleman seeing your traffic.
• Ollama Cloud — hosted open-weight models (Qwen, DeepSeek, gpt-oss…) behind the familiar ollama CLI, with a usable free tier. Drawbacks: usage caps, and open-weight quality still trails frontier models on long agentic coding runs.
• Provider free tiers — Gemini CLI's free quota is genuinely generous; Claude and Codex free allowances are smaller. Zero new accounts to trust.

Why the guide prescribes a paid frontier plan anyway: agentic coding compounds — a model that's 20% weaker doesn't cost 20% more time; it fails tasks you then finish yourself. Flat-rate billing is predictable, and paid plans carry the clearest no-training terms (§16). The honest free path: prove the build free, then pay once it earns its keep. Want the model fully in-house instead? That's the 🍎 Heirloom build — §20.

more: openrouter.ai · ollama.com · github.com/google-gemini/gemini-cli

★Side quest — the everywhere PC

So far the Grove has been a terminal. Give it a desktop and it becomes something better: one personal computer that lives in one place and appears on any screen you're near — same files, same apps, same half-finished document, whether you're on a tablet in a café or a borrowed laptop on another continent. Tailscale already makes it reachable; a desktop makes it feel plugged in.

The spell (10 minutes)

sudo apt install -y xfce4 xrdp     # lightweight desktop + RDP server
sudo systemctl enable --now xrdp
# if you enabled ufw in §8, RDP is already tailnet-only — nothing else to open

From any device, open an RDP client — Windows App (macOS/iOS), Microsoft Remote Desktop (Windows/Android), Remmina (Linux) — point it at grove, and log in with your Pi user. A full desktop appears, riding the tailnet like everything else: zero ports open to the internet.

What the quest unlocks

• Writing in a familiar room: LibreOffice for documents — or run the Obsidian desktop app on the Pi itself; your synced vault is already there, and half-written drafts stay open between sessions. It's tmux for a GUI.
• Math on demand: SpeedCrunch for quick sums, GNU Octave (a MATLAB-alike) or Python + Jupyter when it gets serious.
• Any screen becomes your PC: a tablet plus a Bluetooth keyboard is now a laptop; disconnect mid-sentence at the café, reconnect from home, and the cursor is exactly where you left it.

Field notes

• Keep the resolution modest (1080p): RDP is crisp for documents, code, and spreadsheets — it is not a video-streaming protocol.
• XFCE is deliberately light; the board runs it comfortably alongside your agent sessions.
• Only connect from devices you trust — anything holding your tailnet login and password is your PC. Skip the hotel-lobby computer.
• Pair it with the Trellis layout (§21): the agent only sees ~/lazy-agent and ~/read-space, so the documents you write on this desktop stay yours.

more: github.com/neutrinolabs/xrdp · xfce.org · raspberrypi.com/software/connect · octave.org

★Side quest — chat mode (no terminal)

Everything so far assumes you like terminals. Not everyone does — and not everyone you share the orchard with will. Chat mode turns the Grove into a contact in apps people already use: no Tailscale client on the phone, no SSH app, no tmux. Two flavors:

Option A — hand your session to your phone (/rc)

ssh grove && work        # tmux, as usual
claude                   # start the agent
/rc                      # remote control: continue this session in the Claude app

The same session now appears as a live chat in the Claude mobile/web app — same repo, same vault, permission prompts included (you approve writes with a tap). Back at a keyboard later? It's still running in tmux, right where the conversation left off. Commands evolve — run /help for the current remote-control syntax.

Option B — Hermes: the Grove as a group-chat bot

Hermes (Nous Research's open-source agent) runs on the Pi as an always-on service, uses your cloud provider for inference, and shows up as a bot in Discord, Slack, Telegram, WhatsApp, or Signal. Anyone you allow can message it — ask questions, request notes updates, kick off tasks. For the Friend Group and Community Org personas this is the natural interface: vault-sharers chat with the bot and never need a Pi account, a terminal, or even Obsidian.

more: hermes-agent.ai · github.com/0xNyk/awesome-hermes-agent · docs.claude.com/en/docs/claude-code

20The Heirloom build — local models

For the skilled — or anyone who wants to become skilled. The 🍎 Heirloom track moves inference itself in-house: one strong machine on your tailnet serves an open-weight model through llama.cpp, and your prompts never leave the building. Everything else in the architecture stays exactly where it was.

The Mill — one more tailnet node

Join the strong box to the mesh like every other node and name it by role: mill. The Grove remains the brain-client; only the "inference" arrow moves — from the Sky to the Mill. GitHub and Nextcloud keep their jobs, and the Mill holds no unique state: models re-download, configs live in your dotfiles repo. Blast radius intact.

A GPU box idles at 30–80 W (≈ $40–110/yr) — let it sleep and wake-on-LAN it from the Grove when needed.

The software (one evening)

# on the mill — build llama.cpp, grab a GGUF model from Hugging Face
git clone https://github.com/ggml-org/llama.cpp && cd llama.cpp
cmake -B build -DGGML_CUDA=ON && cmake --build build -j   # Macs: no flag, Metal is automatic
./build/bin/llama-server -m model-q4.gguf --host 0.0.0.0 --port 8080
# on the grove — point any OpenAI-compatible agent at it
aider --openai-api-base http://mill:8080/v1

Expose port 8080 to the tailnet only (the same ufw pattern as §8). Ollama is the low-friction alternative — same idea, one command per model. Note that Claude Code speaks Anthropic's API only: for this lane use OpenAI-compatible agents (aider, or Hermes pointed at the Mill). Many Heirloom builders run both — a cloud agent for the hard work, the Mill for private or offline work.

This is the one build where "private AI" is literal — prompts, notes, and code never cross your tailnet boundary. Pair it with Greenhouse (self-hosted Headscale + Nextcloud) for a fully sovereign orchard.

more: github.com/ggml-org/llama.cpp · huggingface.co (GGUF models) · ollama.com

21Agent best practices — the Trellis

Agents work best — and feel safest to live with — inside a structure that tells them what everything is. The 🌿 Trellis is ORCHARD's workspace layout: two folders with hard rules, everything else invisible. It ships as a copy-ready starter (lazy-agent-starter/, beside this guide) and gets a full deep-dive in Annex 02: The Trellis.

• ~/lazy-agent/ is the agent's whole world: every vault, every repo, a scratch workbench. Full read-write, no prompts, no sprawl — everything the agent makes stays inside.
• ~/read-space/ is consent, made spatial: putting a file there is the permission to read it. Read-only, enforced by deny rules in .claude/settings.json — not by politeness.
• Every directory carries an AGENTS.md — what the folder is, how agents should treat it, what must never happen there — plus a one-line CLAUDE.md ("Read AGENTS.md") so every agent brand lands on the same truth.
• Launch from inside: cd ~/lazy-agent && claude — the working directory is the wall. Anything outside the trellis triggers a visible permission prompt instead of a silent read.

The starter also ships working .claude folders with four skills (daily-note, inbox-triage, vault-gardener, new-plot) and the permission rules above. Annex 02 goes deeper: context management, session hygiene, and durable agent memory.

more: agents.md · docs.claude.com/en/docs/claude-code/skills

22Glossary

SBC

Single-board computer — a full Linux machine on one palm-sized board (Orange Pi, Raspberry Pi).

ARM64

The CPU architecture these boards use. Most Linux dev tools ship builds for it; a few don't (see emulator).

NVMe / M.2

Fast SSD storage on a small plug-in card. Far more reliable than SD cards for 24/7 duty.

headless

Running with no monitor or keyboard — managed entirely over the network.

SSH

Encrypted remote-terminal protocol; how you operate the Pi and the Macs.

SSH key

A cryptographic keypair that replaces passwords for SSH logins. Safer and script-friendly.

Tailscale

Zero-config VPN that joins your devices into a private encrypted network. Free for personal use.

WireGuard

The fast, modern VPN protocol Tailscale is built on.

tailnet

Your private Tailscale network of devices.

MagicDNS

Tailscale feature that gives each device a stable name, e.g. ssh grove.

Headscale

Open-source, self-hosted replacement for Tailscale's coordination server.

tmux

Terminal multiplexer — keeps sessions (and running agents) alive after you disconnect.

mosh

"Mobile shell" — an SSH-like terminal that tolerates bad networks and switching between Wi-Fi and cellular.

systemd / timer

Linux's service manager. A timer unit runs a job on a schedule — used here for note sync.

unattended-upgrades

Ubuntu/Debian tool that installs security updates automatically.

LUKS

Linux full-disk encryption.

Nextcloud

Self-hostable file-sync service — think private Dropbox.

app password

Per-device password issued by Nextcloud so your real password never sits in a config file.

Obsidian / vault

Note-taking app; a vault is just a folder of Markdown files, which is why a sync daemon is all the Pi needs.

CLI agent

An AI coding assistant that runs in the terminal: Claude Code, Codex CLI, Gemini CLI, aider.

inference

Running the AI model to produce output. In this build it happens on the provider's servers, never on the Pi.

git / repo

Version control; a repo holds your project and its history. Push/pull moves commits between machines.

gh

GitHub's official command-line tool — handles auth, cloning, and PRs.

CI

Continuous integration — rented machines (GitHub Actions, Codemagic) that build, test, and ship your code on push.

fastlane / lane

Automation tool for app builds and store releases. A lane is one scripted task, e.g. ios beta.

match

fastlane's system for keeping iOS signing certificates in an encrypted git repo, so any Mac can build.

simulator vs emulator

iOS simulators run on Macs via Xcode. Android's emulator doesn't ship for ARM Linux — use a real device instead.

adb

Android Debug Bridge — controls a real Android device over USB or Wi-Fi.

TestFlight

Apple's beta-distribution service; where fastlane ios beta uploads to.

whisper.cpp

Local speech-to-text engine; runs comfortably on these boards.

quantized model

A compressed AI model small enough for modest hardware, at lower quality — the Wild track's fallback.

dummy HDMI plug

Cheap adapter that convinces a headless Mac a display is attached, which simulators need.

dotfiles

Your personal config files (.tmux.conf, .zshrc…), ideally kept in a git repo so any machine can be re-personalized fast.

Project ORCHARD Field Guide v2.8 · July 2026 · Assembled with Claude Code. Prices are July-2026 US ballparks — verify current pricing and provider data-use policies before relying on them. Commands target Armbian/Ubuntu 24.04 (🍊) and Raspberry Pi OS Bookworm (🍓). Share this guide with anyone who wants to grow their own.