Deploying to a host

comcon deploy runs the same six phases everywhere: acquire compute, bootstrap the host, build the image, provision users, wire routes and auth, then verify every URL end-to-end. Only host acquisition differs per target.

Pick a target

Target	The host is	Park	Resume
do	A droplet via doctl	Snapshot-park: stop → power off → snapshot → destroy	New droplet from snapshot — disk returns byte-identical
ssh	Any reachable Debian 12/13 host (Hetzner, Vultr, GCP, bare metal)	rclone sync of /srv + stop containers	Restore over SSH, containers recreated at recorded ports
local	This Linux machine (ports 80/443 free)	Sync + stop	Local restore
wsl	This WSL2 distro (systemd=true)	Sync + stop, then wsl --shutdown	Distro boot + restore
other	A VM from any other provider	Same as ssh	Provider CLI + restore

Sizing

RAM is the constraint — roughly 600–800 MB per active user container (Chromium is most of it) plus ~700 MB host-wide if you run the Authentik identity provider.

• s-2vcpu-4gb: ~3–4 users with password auth
• s-4vcpu-8gb: ~8 users, or fewer with full SSO

Domain, DNS, and TLS

A domain is optional. With one wildcard *.domain A record, every surface gets its own subdomain and real TLS (on-demand issuance by default, DNS-01 if you need it). Without a domain, surfaces serve at https://<ip>/<user>/ behind self-signed TLS and basic auth — you choose fallback, ip-only, or off.

On DigitalOcean, keeping the zone in DO DNS lets warmup update records automatically; otherwise a reserved IP (~$4/mo) gives you zero-touch DNS across droplet recreates.

The auth gate

Same routes either way — only the gate differs:

• none — open routes, dev only
• basicauth — per-user bcrypt passwords, zero extra RAM; the single-user default
• authentik — a full identity portal at auth.<domain> with MFA, groups, and per-user route isolation (~700 MB)
• oidc — oauth2-proxy in front of Google, Entra, Keycloak, or your own IdP

Optional: an Android node

A second droplet can run Waydroid and join the workspace over a private link. Agents drive it with adb; there is no streamed screen in v1.0.