Versions - ownhq registry

2026.11.04-700a9c2 latest

paas-cli.jar paas-server.jar provision.tar.gz 2026-11-04 10:51 UTC

commit 700a9c2087a20c2336a8042609be468892adc617

Download the release

paas-cli.jar 69 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.11.04-700a9c2 && cd ~/paas/2026.11.04-700a9c2 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.11.04-700a9c2/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.11.04-700a9c2 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.11.04-700a9c2/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.11.04-700a9c2/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.11.04-700a9c2/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.11.04-700a9c2
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.11.04-700a9c2
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.11.04-700a9c2
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.11.03-beed1ce

paas-cli.jar paas-server.jar provision.tar.gz 2026-11-03 21:56 UTC

commit beed1ceed7f09d9600f30d2828a4d2e8667f6144

Download the release

paas-cli.jar 69 MB paas-server.jar 72 MB provision.tar.gz 17 KB

mkdir -p ~/paas/2026.11.03-beed1ce && cd ~/paas/2026.11.03-beed1ce && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.11.03-beed1ce/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.11.03-beed1ce - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.11.03-beed1ce/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.11.03-beed1ce/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.11.03-beed1ce/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.11.03-beed1ce
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.11.03-beed1ce
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.11.03-beed1ce
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.30-700f055

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-30 19:23 UTC

commit 700f0557dbc21b9c1dbe4fb7c54eb4aae4f2d83f

Download the release

paas-cli.jar 69 MB paas-server.jar 72 MB provision.tar.gz 17 KB

mkdir -p ~/paas/2026.10.30-700f055 && cd ~/paas/2026.10.30-700f055 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.30-700f055/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.30-700f055 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.30-700f055/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.30-700f055/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.30-700f055/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.30-700f055
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.30-700f055
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.30-700f055
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.30-9e72fb0

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-30 16:24 UTC

commit 9e72fb08f85a68bec4f4441b8ef6a05f7f561f48

Download the release

paas-cli.jar 69 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.30-9e72fb0 && cd ~/paas/2026.10.30-9e72fb0 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.30-9e72fb0/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.30-9e72fb0 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.30-9e72fb0/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.30-9e72fb0/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.30-9e72fb0/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.30-9e72fb0
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.30-9e72fb0
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.30-9e72fb0
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.30-558df9b

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-30 14:58 UTC

commit 558df9b314b605684e3b8e3b112e634dffecf1d2

Download the release

paas-cli.jar 69 MB paas-server.jar 72 MB provision.tar.gz 17 KB

mkdir -p ~/paas/2026.10.30-558df9b && cd ~/paas/2026.10.30-558df9b && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.30-558df9b/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.30-558df9b - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.30-558df9b/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.30-558df9b/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.30-558df9b/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.30-558df9b
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.30-558df9b
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.30-558df9b
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.27-f398fb8

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-27 16:06 UTC

commit f398fb84ee41a17246725c02a35abb1a813c0370

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 17 KB

mkdir -p ~/paas/2026.10.27-f398fb8 && cd ~/paas/2026.10.27-f398fb8 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.27-f398fb8/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.27-f398fb8 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.27-f398fb8/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.27-f398fb8/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.27-f398fb8/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.27-f398fb8
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.27-f398fb8
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.27-f398fb8
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.27-527930f

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-27 11:34 UTC

commit 527930f6d8befe99df6cc3cfad367f1efe16f2f0

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.27-527930f && cd ~/paas/2026.10.27-527930f && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.27-527930f/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.27-527930f - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.27-527930f/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.27-527930f/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.27-527930f/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.27-527930f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.27-527930f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.27-527930f
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.23-bf8fc44

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-23 16:00 UTC

commit bf8fc440dd49279c25e3f9a21b1c4a0c47cfe96d

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.23-bf8fc44 && cd ~/paas/2026.10.23-bf8fc44 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.23-bf8fc44/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.23-bf8fc44 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-bf8fc44/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-bf8fc44/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.23-bf8fc44/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-bf8fc44
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-bf8fc44
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.23-bf8fc44
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.23-f0124fd

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-23 15:33 UTC

commit f0124fd820cdf5aae876bd0419f12f109a743e92

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.23-f0124fd && cd ~/paas/2026.10.23-f0124fd && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.23-f0124fd/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.23-f0124fd - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-f0124fd/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-f0124fd/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.23-f0124fd/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-f0124fd
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-f0124fd
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.23-f0124fd
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.23-f669625

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-23 11:06 UTC

commit f669625de2e568ade5f17a7a2491ec6887ca5d6e

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 17 KB

mkdir -p ~/paas/2026.10.23-f669625 && cd ~/paas/2026.10.23-f669625 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.23-f669625/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.23-f669625 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-f669625/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-f669625/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.23-f669625/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-f669625
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-f669625
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.23-f669625
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.23-6cd7412

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-23 09:25 UTC

commit 6cd7412f256370d6fd85f228c55d8ea35e2e847d

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 17 KB

mkdir -p ~/paas/2026.10.23-6cd7412 && cd ~/paas/2026.10.23-6cd7412 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.23-6cd7412/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.23-6cd7412 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-6cd7412/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-6cd7412/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.23-6cd7412/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-6cd7412
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-6cd7412
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.23-6cd7412
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.23-9d8b9c6

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-23 08:00 UTC

commit 9d8b9c68cb6253a625da9b74b1a5bdf527109db0

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.23-9d8b9c6 && cd ~/paas/2026.10.23-9d8b9c6 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.23-9d8b9c6/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.23-9d8b9c6 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-9d8b9c6/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-9d8b9c6/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.23-9d8b9c6/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-9d8b9c6
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-9d8b9c6
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.23-9d8b9c6
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.23-c83670b

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-23 07:38 UTC

commit c83670b960d846fcb0a01c2f7fd8e374226e54e7

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.23-c83670b && cd ~/paas/2026.10.23-c83670b && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.23-c83670b/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.23-c83670b - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-c83670b/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.23-c83670b/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.23-c83670b/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-c83670b
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.23-c83670b
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.23-c83670b
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.22-3f487af

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-22 18:17 UTC

commit 3f487aff5bddd287ae02e65c3fd9fea06f0fb006

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 17 KB

mkdir -p ~/paas/2026.10.22-3f487af && cd ~/paas/2026.10.22-3f487af && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.22-3f487af/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.22-3f487af - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.22-3f487af/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.22-3f487af/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.22-3f487af/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.22-3f487af
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.22-3f487af
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.22-3f487af
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.22-6719f94

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-22 13:27 UTC

commit 6719f947fd4f0ca0fbfcb1f0d01fde47022cdbf1

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 17 KB

mkdir -p ~/paas/2026.10.22-6719f94 && cd ~/paas/2026.10.22-6719f94 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.22-6719f94/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.22-6719f94 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.22-6719f94/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.22-6719f94/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.22-6719f94/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.22-6719f94
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.22-6719f94
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.22-6719f94
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.15-2a61851

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-15 07:07 UTC

commit 2a61851bb4708d81aada05adfe900aabb96ed3ff

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 17 KB

mkdir -p ~/paas/2026.10.15-2a61851 && cd ~/paas/2026.10.15-2a61851 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.15-2a61851/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.15-2a61851 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.15-2a61851/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.15-2a61851/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.15-2a61851/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.15-2a61851
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.15-2a61851
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.15-2a61851
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.14-35ddd61

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-14 18:00 UTC

commit 35ddd61ac5504ba0c064542de625de93b1a60497

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.14-35ddd61 && cd ~/paas/2026.10.14-35ddd61 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.14-35ddd61/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.14-35ddd61 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.14-35ddd61/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.14-35ddd61/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.14-35ddd61/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.14-35ddd61
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.14-35ddd61
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.14-35ddd61
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.14-2ff11b0

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-14 14:19 UTC

commit 2ff11b0365e3f4a8a5c8790197c5f98f2f59d888

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.14-2ff11b0 && cd ~/paas/2026.10.14-2ff11b0 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.14-2ff11b0/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.14-2ff11b0 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.14-2ff11b0/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.14-2ff11b0/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.14-2ff11b0/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.14-2ff11b0
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.14-2ff11b0
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.14-2ff11b0
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.14-9c7a9bc

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-14 12:35 UTC

commit 9c7a9bcc1c6866d68c6f985962e83052efb836ca

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.14-9c7a9bc && cd ~/paas/2026.10.14-9c7a9bc && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.14-9c7a9bc/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.14-9c7a9bc - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.14-9c7a9bc/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.14-9c7a9bc/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.14-9c7a9bc/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.14-9c7a9bc
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.14-9c7a9bc
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.14-9c7a9bc
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.14-8d3441a

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-14 09:17 UTC

commit 8d3441aaddb2859ff8f4ffa16f2bd43891d0c871

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 18 KB

mkdir -p ~/paas/2026.10.14-8d3441a && cd ~/paas/2026.10.14-8d3441a && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.14-8d3441a/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.14-8d3441a - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.14-8d3441a/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.14-8d3441a/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.14-8d3441a/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.14-8d3441a
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.14-8d3441a
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.14-8d3441a
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.12-7bfdab8

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-12 19:03 UTC

commit 7bfdab882b106b1551a6c5d395e223df7761a9db

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 15 KB

mkdir -p ~/paas/2026.10.12-7bfdab8 && cd ~/paas/2026.10.12-7bfdab8 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.12-7bfdab8/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.12-7bfdab8 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-7bfdab8/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-7bfdab8/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.12-7bfdab8/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-7bfdab8
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-7bfdab8
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.12-7bfdab8
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.12-966cd9e

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-12 14:41 UTC

commit 966cd9edf3e580db87951b3dd0f81761abab20c5

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 15 KB

mkdir -p ~/paas/2026.10.12-966cd9e && cd ~/paas/2026.10.12-966cd9e && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.12-966cd9e/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.12-966cd9e - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-966cd9e/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-966cd9e/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.12-966cd9e/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-966cd9e
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-966cd9e
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.12-966cd9e
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.12-efcf96b

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-12 14:23 UTC

commit efcf96b8f6b3433a8f45891553eabd128926d4c5

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 16 KB

mkdir -p ~/paas/2026.10.12-efcf96b && cd ~/paas/2026.10.12-efcf96b && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.12-efcf96b/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.12-efcf96b - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-efcf96b/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-efcf96b/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.12-efcf96b/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-efcf96b
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-efcf96b
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.12-efcf96b
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.12-1bda0e0

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-12 09:04 UTC

commit 1bda0e090a0edfbb3a9d297f6d3711107f07e532

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 16 KB

mkdir -p ~/paas/2026.10.12-1bda0e0 && cd ~/paas/2026.10.12-1bda0e0 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.12-1bda0e0/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.12-1bda0e0 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-1bda0e0/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-1bda0e0/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.12-1bda0e0/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-1bda0e0
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-1bda0e0
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.12-1bda0e0
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.12-170aeb1

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-12 08:17 UTC

commit 170aeb1f6980e15a8fe55f14bfae31041d7faf1b

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 16 KB

mkdir -p ~/paas/2026.10.12-170aeb1 && cd ~/paas/2026.10.12-170aeb1 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.12-170aeb1/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.12-170aeb1 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-170aeb1/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-170aeb1/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.12-170aeb1/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-170aeb1
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-170aeb1
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.12-170aeb1
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.12-8ce07ab

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-12 08:03 UTC

commit 8ce07ab862b271487e534ab70044ad94cb1e46ad

Download the release

paas-cli.jar 68 MB paas-server.jar 72 MB provision.tar.gz 16 KB

mkdir -p ~/paas/2026.10.12-8ce07ab && cd ~/paas/2026.10.12-8ce07ab && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.12-8ce07ab/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.12-8ce07ab - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-8ce07ab/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.12-8ce07ab/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.12-8ce07ab/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-8ce07ab
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.12-8ce07ab
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.12-8ce07ab
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.11-c72c180

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-11 06:24 UTC

commit c72c180d673f1611636e2b6899f3c086166be777

Download the release

paas-cli.jar 68 MB paas-server.jar 71 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.11-c72c180 && cd ~/paas/2026.10.11-c72c180 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.11-c72c180/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.11-c72c180 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.11-c72c180/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.11-c72c180/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.11-c72c180/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.11-c72c180
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.11-c72c180
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.11-c72c180
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.10-5710532

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-10 23:48 UTC

commit 5710532c489b77c7b24989b2bea9cc1b226cb874

Download the release

paas-cli.jar 68 MB paas-server.jar 71 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.10-5710532 && cd ~/paas/2026.10.10-5710532 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.10-5710532/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.10-5710532 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.10-5710532/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.10-5710532/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.10-5710532/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.10-5710532
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.10-5710532
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.10-5710532
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.10-e2cb93f

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-10 22:31 UTC

commit e2cb93fb18510bf197f308b7ac299035114ea7ce

Download the release

paas-cli.jar 68 MB paas-server.jar 71 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.10-e2cb93f && cd ~/paas/2026.10.10-e2cb93f && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.10-e2cb93f/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.10-e2cb93f - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.10-e2cb93f/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.10-e2cb93f/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.10-e2cb93f/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.10-e2cb93f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.10-e2cb93f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.10-e2cb93f
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.09-d9ae91f

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-09 09:53 UTC

commit d9ae91f388884aad25f15e432ce4201dcef2a77c

Download the release

paas-cli.jar 67 MB paas-server.jar 70 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.09-d9ae91f && cd ~/paas/2026.10.09-d9ae91f && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.09-d9ae91f/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.09-d9ae91f - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.09-d9ae91f/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.09-d9ae91f/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.09-d9ae91f/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.09-d9ae91f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.09-d9ae91f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.09-d9ae91f
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.09-bb1ab9a

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-09 08:02 UTC

commit bb1ab9a57ea286484241852731e5d258b734718e

Download the release

paas-cli.jar 67 MB paas-server.jar 70 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.09-bb1ab9a && cd ~/paas/2026.10.09-bb1ab9a && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.09-bb1ab9a/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.09-bb1ab9a - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.09-bb1ab9a/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.09-bb1ab9a/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.09-bb1ab9a/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.09-bb1ab9a
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.09-bb1ab9a
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.09-bb1ab9a
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.08-eb7f054

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-08 17:48 UTC

commit eb7f0541a55af7de768f4e53b0178d737efa9ab6

Download the release

paas-cli.jar 67 MB paas-server.jar 70 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.08-eb7f054 && cd ~/paas/2026.10.08-eb7f054 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.08-eb7f054/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.08-eb7f054 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.08-eb7f054/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.08-eb7f054/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.08-eb7f054/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.08-eb7f054
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.08-eb7f054
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.08-eb7f054
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.08-4f1ff88

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-08 14:28 UTC

commit 4f1ff8821fd941fe36f42c1d82e40de560534096

Download the release

paas-cli.jar 67 MB paas-server.jar 68 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.08-4f1ff88 && cd ~/paas/2026.10.08-4f1ff88 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.08-4f1ff88/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.08-4f1ff88 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.08-4f1ff88/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.08-4f1ff88/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.08-4f1ff88/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.08-4f1ff88
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.08-4f1ff88
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.08-4f1ff88
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.08-1a887a1

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-08 11:24 UTC

commit 1a887a1c0910140dcf059b1d3ffa9d0369446ef7

Download the release

paas-cli.jar 67 MB paas-server.jar 68 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.08-1a887a1 && cd ~/paas/2026.10.08-1a887a1 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.08-1a887a1/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.08-1a887a1 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.08-1a887a1/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.08-1a887a1/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.08-1a887a1/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.08-1a887a1
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.08-1a887a1
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.08-1a887a1
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.07-587808c

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-07 21:09 UTC

commit 587808c721c5fe11131ef47474428ec212c86ced

Download the release

paas-cli.jar 67 MB paas-server.jar 68 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.07-587808c && cd ~/paas/2026.10.07-587808c && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.07-587808c/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.07-587808c - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.07-587808c/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.07-587808c/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.07-587808c/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.07-587808c
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.07-587808c
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.07-587808c
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.07-dbb5087

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-07 00:22 UTC

commit dbb5087a1423908a879a63920a98a6f945d7370a

Download the release

paas-cli.jar 67 MB paas-server.jar 67 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.07-dbb5087 && cd ~/paas/2026.10.07-dbb5087 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.07-dbb5087/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.07-dbb5087 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.07-dbb5087/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.07-dbb5087/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.07-dbb5087/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.07-dbb5087
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.07-dbb5087
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.07-dbb5087
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.06-3b19bcb

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-06 22:55 UTC

commit 3b19bcbb935f463c385617ecf68363818362d34c

Download the release

paas-cli.jar 67 MB paas-server.jar 67 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.06-3b19bcb && cd ~/paas/2026.10.06-3b19bcb && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.06-3b19bcb/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.06-3b19bcb - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.06-3b19bcb/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.06-3b19bcb/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.06-3b19bcb/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.06-3b19bcb
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.06-3b19bcb
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.06-3b19bcb
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.06-e7decd6

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-06 13:29 UTC

commit e7decd6aebed34cd1757aa0e673ccf072551307f

Download the release

paas-cli.jar 67 MB paas-server.jar 67 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.06-e7decd6 && cd ~/paas/2026.10.06-e7decd6 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.06-e7decd6/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.06-e7decd6 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.06-e7decd6/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.06-e7decd6/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.06-e7decd6/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.06-e7decd6
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.06-e7decd6
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.06-e7decd6
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.06-fc1e2d7

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-06 13:16 UTC

commit fc1e2d7d983c2c6a667fbee1feb2151c0b217a10

Download the release

paas-cli.jar 67 MB paas-server.jar 67 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.06-fc1e2d7 && cd ~/paas/2026.10.06-fc1e2d7 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.06-fc1e2d7/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.06-fc1e2d7 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.06-fc1e2d7/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.06-fc1e2d7/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.06-fc1e2d7/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.06-fc1e2d7
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.06-fc1e2d7
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.06-fc1e2d7
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.06-ba4e22a

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-06 09:42 UTC

commit ba4e22a73e93ae83d3945c860e41c91846b63f4c

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.06-ba4e22a && cd ~/paas/2026.10.06-ba4e22a && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.06-ba4e22a/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.06-ba4e22a - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.06-ba4e22a/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.06-ba4e22a/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.06-ba4e22a/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.06-ba4e22a
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.06-ba4e22a
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.06-ba4e22a
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.04-baa3137

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-04 21:45 UTC

commit baa313759d6adb33604ca2f6f1882f961ab43a9b

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.04-baa3137 && cd ~/paas/2026.10.04-baa3137 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.04-baa3137/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.04-baa3137 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-baa3137/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-baa3137/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.04-baa3137/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-baa3137
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-baa3137
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.04-baa3137
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.04-891ebe2

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-04 19:58 UTC

commit 891ebe251c1f08eb179bd5ef8f9dfb0202c62f07

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 13 KB

mkdir -p ~/paas/2026.10.04-891ebe2 && cd ~/paas/2026.10.04-891ebe2 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.04-891ebe2/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.04-891ebe2 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-891ebe2/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-891ebe2/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.04-891ebe2/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-891ebe2
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-891ebe2
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.04-891ebe2
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.04-d536c99

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-04 10:05 UTC

commit d536c99934349c778ac9823b5a45e0572b5ea34a

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.04-d536c99 && cd ~/paas/2026.10.04-d536c99 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.04-d536c99/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.04-d536c99 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-d536c99/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-d536c99/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.04-d536c99/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-d536c99
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-d536c99
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.04-d536c99
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.04-9019603

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-04 10:01 UTC

commit 90196037b4ec64fee67e661298cccdde288639db

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.04-9019603 && cd ~/paas/2026.10.04-9019603 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.04-9019603/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.04-9019603 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-9019603/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-9019603/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.04-9019603/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-9019603
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-9019603
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.04-9019603
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.04-0b23ec0

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-04 09:32 UTC

commit 0b23ec06e45aae1cb0b0f0dd88a31429b2f1e378

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.04-0b23ec0 && cd ~/paas/2026.10.04-0b23ec0 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.04-0b23ec0/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.04-0b23ec0 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-0b23ec0/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.04-0b23ec0/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.04-0b23ec0/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-0b23ec0
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.04-0b23ec0
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.04-0b23ec0
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.03-da27523

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-03 18:40 UTC

commit da2752392a15a1ee2bff6472a022ccf42a3119ba

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.03-da27523 && cd ~/paas/2026.10.03-da27523 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.03-da27523/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.03-da27523 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.03-da27523/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.03-da27523/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.03-da27523/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.03-da27523
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.03-da27523
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.03-da27523
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.03-c5c1962

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-03 12:28 UTC

commit c5c1962f8df22bc1fc8609159397e3f352a198f8

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.03-c5c1962 && cd ~/paas/2026.10.03-c5c1962 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.03-c5c1962/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.03-c5c1962 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.03-c5c1962/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.03-c5c1962/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.03-c5c1962/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.03-c5c1962
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.03-c5c1962
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.03-c5c1962
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.03-d1823f4

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-03 10:33 UTC

commit d1823f4af3902dc36850df8e4de607a92a367448

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.03-d1823f4 && cd ~/paas/2026.10.03-d1823f4 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.03-d1823f4/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.03-d1823f4 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.03-d1823f4/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.03-d1823f4/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.03-d1823f4/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.03-d1823f4
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.03-d1823f4
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.03-d1823f4
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.03-d1fc276

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-03 10:02 UTC

commit d1fc276bd248db769ab92bb66ce70bc83b9729ee

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.03-d1fc276 && cd ~/paas/2026.10.03-d1fc276 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.03-d1fc276/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.03-d1fc276 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.03-d1fc276/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.03-d1fc276/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.03-d1fc276/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.03-d1fc276
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.03-d1fc276
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.03-d1fc276
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.02-b87dbfd

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-02 20:28 UTC

commit b87dbfdb2238adb79a718b0dff692eee14342c68

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.02-b87dbfd && cd ~/paas/2026.10.02-b87dbfd && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.02-b87dbfd/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.02-b87dbfd - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-b87dbfd/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-b87dbfd/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.02-b87dbfd/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-b87dbfd
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-b87dbfd
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.02-b87dbfd
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.02-0c0ad70

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-02 15:45 UTC

commit 0c0ad704f6f35ae74043bb88ee02b8aaad26d953

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.02-0c0ad70 && cd ~/paas/2026.10.02-0c0ad70 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.02-0c0ad70/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.02-0c0ad70 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-0c0ad70/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-0c0ad70/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.02-0c0ad70/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-0c0ad70
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-0c0ad70
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.02-0c0ad70
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.02-3f53557

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-02 15:27 UTC

commit 3f53557ccba3ef9f9aad945d052582366e659f7e

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.02-3f53557 && cd ~/paas/2026.10.02-3f53557 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.02-3f53557/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.02-3f53557 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-3f53557/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-3f53557/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.02-3f53557/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-3f53557
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-3f53557
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.02-3f53557
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.02-305c651

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-02 14:39 UTC

commit 305c651aaeedcc012043bd05165695506056b0d0

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 12 KB

mkdir -p ~/paas/2026.10.02-305c651 && cd ~/paas/2026.10.02-305c651 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.02-305c651/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.02-305c651 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-305c651/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-305c651/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.02-305c651/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-305c651
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-305c651
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.02-305c651
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.02-06ee9ac

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-02 12:42 UTC

commit 06ee9acad221a1152e85f1c4e99a8baafd7ea6e1

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 11 KB

mkdir -p ~/paas/2026.10.02-06ee9ac && cd ~/paas/2026.10.02-06ee9ac && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.02-06ee9ac/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.02-06ee9ac - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-06ee9ac/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-06ee9ac/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.02-06ee9ac/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-06ee9ac
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-06ee9ac
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.02-06ee9ac
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.02-a8e3aea

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-02 08:48 UTC

commit a8e3aea4d1f2613daf711e1314b575b8f23476bb

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 11 KB

mkdir -p ~/paas/2026.10.02-a8e3aea && cd ~/paas/2026.10.02-a8e3aea && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.02-a8e3aea/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.02-a8e3aea - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-a8e3aea/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.02-a8e3aea/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.02-a8e3aea/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-a8e3aea
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.02-a8e3aea
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.02-a8e3aea
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.10.01-44722a3

paas-cli.jar paas-server.jar provision.tar.gz 2026-10-01 07:27 UTC

commit 44722a3eec93adbd041d4435b4daac53380e98a1

Download the release

paas-cli.jar 66 MB paas-server.jar 67 MB provision.tar.gz 11 KB

mkdir -p ~/paas/2026.10.01-44722a3 && cd ~/paas/2026.10.01-44722a3 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.10.01-44722a3/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.10.01-44722a3 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.10.01-44722a3/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.10.01-44722a3/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.10.01-44722a3/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.01-44722a3
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.10.01-44722a3
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.10.01-44722a3
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.29-6557f32

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-29 07:48 UTC

commit 6557f3269962377e447299bb2da8fc2aa803c8a6

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 11 KB

mkdir -p ~/paas/2026.09.29-6557f32 && cd ~/paas/2026.09.29-6557f32 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.29-6557f32/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.29-6557f32 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.29-6557f32/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.29-6557f32/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.29-6557f32/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.29-6557f32
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.29-6557f32
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.29-6557f32
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.28-0b88210

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-28 11:05 UTC

commit 0b88210533ea3d8d03ef7952859292a90e1f30e3

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.28-0b88210 && cd ~/paas/2026.09.28-0b88210 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.28-0b88210/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.28-0b88210 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.28-0b88210/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.28-0b88210/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.28-0b88210/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.28-0b88210
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.28-0b88210
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.28-0b88210
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.24-b1bfbcc

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-25 07:40 UTC

commit b1bfbcc6678156cc879027f8bb7ce184daa42eb8

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.24-b1bfbcc && cd ~/paas/2026.09.24-b1bfbcc && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.24-b1bfbcc/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.24-b1bfbcc - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-b1bfbcc/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-b1bfbcc/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.24-b1bfbcc/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-b1bfbcc
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-b1bfbcc
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.24-b1bfbcc
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.24-327494e

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-24 14:15 UTC

commit 327494ee18f4da11607b7ea7be57b62db4a9b46d

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 11 KB

mkdir -p ~/paas/2026.09.24-327494e && cd ~/paas/2026.09.24-327494e && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.24-327494e/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.24-327494e - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-327494e/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-327494e/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.24-327494e/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-327494e
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-327494e
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.24-327494e
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.24-dc10d57

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-24 13:17 UTC

commit dc10d57c55482795081eda90367acd769e880abc

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.24-dc10d57 && cd ~/paas/2026.09.24-dc10d57 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.24-dc10d57/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.24-dc10d57 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-dc10d57/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-dc10d57/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.24-dc10d57/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-dc10d57
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-dc10d57
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.24-dc10d57
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.24-36d0d86

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-24 12:30 UTC

commit 36d0d862fe4eb0a9cdfadcc6b789b8e44ea0a5d2

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.24-36d0d86 && cd ~/paas/2026.09.24-36d0d86 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.24-36d0d86/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.24-36d0d86 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-36d0d86/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-36d0d86/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.24-36d0d86/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-36d0d86
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-36d0d86
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.24-36d0d86
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.24-864315d

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-24 09:21 UTC

commit 864315da6963801849cd09e670c8be42eda57736

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 11 KB

mkdir -p ~/paas/2026.09.24-864315d && cd ~/paas/2026.09.24-864315d && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.24-864315d/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.24-864315d - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-864315d/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.24-864315d/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.24-864315d/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-864315d
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.24-864315d
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.24-864315d
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.18-d2c4d45

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-18 12:32 UTC

commit d2c4d45b94d9818d8080674770cea076a942203a

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.18-d2c4d45 && cd ~/paas/2026.09.18-d2c4d45 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.18-d2c4d45/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.18-d2c4d45 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.18-d2c4d45/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.18-d2c4d45/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.18-d2c4d45/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.18-d2c4d45
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.18-d2c4d45
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.18-d2c4d45
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.18-f1cb84f

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-18 12:20 UTC

commit f1cb84f06f73ffada77dc2fdc6ffd2f40f2bfe15

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.18-f1cb84f && cd ~/paas/2026.09.18-f1cb84f && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.18-f1cb84f/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.18-f1cb84f - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.18-f1cb84f/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.18-f1cb84f/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.18-f1cb84f/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.18-f1cb84f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.18-f1cb84f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.18-f1cb84f
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.18-d0e9ff8

paas-cli.jar paas-server.jar provision.tar.gz 2026-09-18 11:50 UTC

commit d0e9ff84c01cf482b6b601ad0d92f6a6fcdc9161

Download the release

paas-cli.jar 60 MB paas-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.18-d0e9ff8 && cd ~/paas/2026.09.18-d0e9ff8 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.18-d0e9ff8/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.18-d0e9ff8 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o paas-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.18-d0e9ff8/f/paas-cli.jar?t=...need to log in to see your token..."
curl -fSL -o paas-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.18-d0e9ff8/f/paas-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.18-d0e9ff8/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz
cat > ohq.sh <<'EOF'
#!/usr/bin/env bash
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x ohq.sh
cat > paas.sh <<'EOF'
#!/usr/bin/env bash
echo "paas is now ohq - link it: ln -sfn ~/paas/latest/ohq.sh ~/.local/bin/ohq" >&2
target=$0
while [ -L "$target" ]; do
  link=$(readlink "$target")
  case $link in
    /*) target=$link ;;
    *) target=$(dirname "$target")/$link ;;
  esac
done
exec java -jar "$(cd "$(dirname "$target")" && pwd)/paas-cli.jar" "$@"
EOF
chmod +x paas.sh

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

bin=
for dir in "$HOME/.local/bin" "$HOME/bin"; do
  case ":$PATH:" in *":$dir:"*) bin=$dir; break ;; esac
done
target=${bin:-$HOME/.local/bin}
mkdir -p "$target"
if [ -e "$target/ohq" ] && [ ! -L "$target/ohq" ]; then
  echo "$target/ohq is a file, not a link - left as is" >&2
else
  ln -sfn "$(dirname "$PWD")/latest/ohq.sh" "$target/ohq"
fi
if [ -n "$bin" ]; then
  echo "ohq is on your PATH - run: ohq"
else
  login_shell=${SHELL:-sh}
  rc='~/.profile'
  case ${login_shell##*/} in
    zsh) rc='${ZDOTDIR:-~}/.zshrc' ;;
    bash) rc='~/.bashrc'; if [ "$(uname)" = Darwin ]; then rc='~/.bash_profile'; fi ;;
  esac
  line='export PATH="$HOME/.local/bin:$PATH"'
  hint="echo '$line' >> $rc"
  if [ "${login_shell##*/}" = fish ]; then hint='fish_add_path ~/.local/bin'; fi
  echo "~/.local/bin is not on your PATH. Add it once, then open a new terminal:"
  echo "  $hint"
fi

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.18-d0e9ff8
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.18-d0e9ff8
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.18-d0e9ff8
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.17-b5a61f3

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-17 23:00 UTC

commit b5a61f38e54ba3ad26afac1bc5a2fea92cf548d3

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.17-b5a61f3 && cd ~/paas/2026.09.17-b5a61f3 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.17-b5a61f3/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.17-b5a61f3 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-b5a61f3/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-b5a61f3/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.17-b5a61f3/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-b5a61f3
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-b5a61f3
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.17-b5a61f3
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.17-4fc03eb

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-17 21:21 UTC

commit 4fc03eb926fdfe968a0c355d867e3bcc4c7cf862

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.17-4fc03eb && cd ~/paas/2026.09.17-4fc03eb && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.17-4fc03eb/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.17-4fc03eb - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-4fc03eb/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-4fc03eb/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.17-4fc03eb/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-4fc03eb
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-4fc03eb
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.17-4fc03eb
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.17-1e9be47

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-17 20:15 UTC

commit 1e9be476225024b40caf11d71e922cb0f2939ac0

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 11 KB

mkdir -p ~/paas/2026.09.17-1e9be47 && cd ~/paas/2026.09.17-1e9be47 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.17-1e9be47/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.17-1e9be47 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-1e9be47/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-1e9be47/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.17-1e9be47/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-1e9be47
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-1e9be47
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.17-1e9be47
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.17-63595c7

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-17 07:26 UTC

commit 63595c7f07dceaaab04e07d8b3d70f9abf7157ab

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.17-63595c7 && cd ~/paas/2026.09.17-63595c7 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.17-63595c7/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.17-63595c7 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-63595c7/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-63595c7/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.17-63595c7/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-63595c7
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-63595c7
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.17-63595c7
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.17-b7d657f

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-17 07:14 UTC

commit b7d657ff9f798e44882f725b20172293047935a1

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.17-b7d657f && cd ~/paas/2026.09.17-b7d657f && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.17-b7d657f/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.17-b7d657f - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-b7d657f/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.17-b7d657f/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.17-b7d657f/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-b7d657f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.17-b7d657f
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.17-b7d657f
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.16-aba966d

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-16 20:11 UTC

commit aba966de4d3ad87b0490b9c147aaa587890dce37

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.16-aba966d && cd ~/paas/2026.09.16-aba966d && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.16-aba966d/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.16-aba966d - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.16-aba966d/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.16-aba966d/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.16-aba966d/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.16-aba966d
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.16-aba966d
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.16-aba966d
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.16-15541ce

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-16 19:49 UTC

commit 15541cea6344934a274ca4865fc7cf01385aa7c7

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.16-15541ce && cd ~/paas/2026.09.16-15541ce && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.16-15541ce/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.16-15541ce - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.16-15541ce/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.16-15541ce/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.16-15541ce/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.16-15541ce
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.16-15541ce
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.16-15541ce
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.16-af45cd8

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-16 14:54 UTC

commit af45cd8858b3ac1de75684eb5fe5541f46a58597

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.16-af45cd8 && cd ~/paas/2026.09.16-af45cd8 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.16-af45cd8/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.16-af45cd8 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.16-af45cd8/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.16-af45cd8/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.16-af45cd8/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.16-af45cd8
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.16-af45cd8
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.16-af45cd8
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.16-fee20f6

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-16 12:41 UTC

commit fee20f6132b8ce7f6fc29b05783ae3264dca483a

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 11 KB

mkdir -p ~/paas/2026.09.16-fee20f6 && cd ~/paas/2026.09.16-fee20f6 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.16-fee20f6/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.16-fee20f6 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.16-fee20f6/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.16-fee20f6/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.16-fee20f6/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.16-fee20f6
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.16-fee20f6
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.16-fee20f6
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.15-bc74df7

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-15 08:10 UTC

commit bc74df7ba8085b4009b5d6551c55a3f4550b7f7e

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.15-bc74df7 && cd ~/paas/2026.09.15-bc74df7 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.15-bc74df7/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.15-bc74df7 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.15-bc74df7/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.15-bc74df7/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.15-bc74df7/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.15-bc74df7
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.15-bc74df7
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.15-bc74df7
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.14-c519c3b

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-14 11:55 UTC

commit c519c3b749dd53299a262a35fb5c238875b32503

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 11 KB

mkdir -p ~/paas/2026.09.14-c519c3b && cd ~/paas/2026.09.14-c519c3b && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.14-c519c3b/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.14-c519c3b - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.14-c519c3b/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.14-c519c3b/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.14-c519c3b/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.14-c519c3b
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.14-c519c3b
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.14-c519c3b
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.11-eb65b04

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-11 12:22 UTC

commit eb65b04ea3ae9b642c1489cbf25b24a86d62e857

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.11-eb65b04 && cd ~/paas/2026.09.11-eb65b04 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.11-eb65b04/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.11-eb65b04 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.11-eb65b04/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.11-eb65b04/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.11-eb65b04/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.11-eb65b04
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.11-eb65b04
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.11-eb65b04
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.09-c18341c

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-09 13:55 UTC

commit c18341cf267a9d60ff524ac546f67fb3f8f9abd9

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.09-c18341c && cd ~/paas/2026.09.09-c18341c && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.09-c18341c/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.09-c18341c - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.09-c18341c/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.09-c18341c/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.09-c18341c/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.09-c18341c
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.09-c18341c
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.09-c18341c
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.09-62cde75

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-09 13:43 UTC

commit 62cde75132fc0e06b1d212323f4513c1fddc2c97

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.09-62cde75 && cd ~/paas/2026.09.09-62cde75 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.09-62cde75/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.09-62cde75 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.09-62cde75/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.09-62cde75/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.09-62cde75/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.09-62cde75
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.09-62cde75
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.09-62cde75
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

2026.09.08-c151a25

deploy-cli.jar deploy-server.jar provision.tar.gz 2026-09-08 11:56 UTC

commit c151a2589b666256bd0f29ab5b59d4de73b7aa44

Download the release

deploy-cli.jar 60 MB deploy-server.jar 61 MB provision.tar.gz 10 KB

mkdir -p ~/paas/2026.09.08-c151a25 && cd ~/paas/2026.09.08-c151a25 && \
curl -fsSL "https://paas-registry.warsawdynamics.com/v/2026.09.08-c151a25/install.sh?t=...need to log in to see your token..." \
| bash

#!/usr/bin/env bash
# ownhq 2026.09.08-c151a25 - downloads every file of this release into the current directory.
set -euo pipefail

curl -fSL -o deploy-cli.jar "https://paas-registry.warsawdynamics.com/v/2026.09.08-c151a25/f/deploy-cli.jar?t=...need to log in to see your token..."
curl -fSL -o deploy-server.jar "https://paas-registry.warsawdynamics.com/v/2026.09.08-c151a25/f/deploy-server.jar?t=...need to log in to see your token..."
curl -fSL -o provision.tar.gz "https://paas-registry.warsawdynamics.com/v/2026.09.08-c151a25/f/provision.tar.gz?t=...need to log in to see your token..."

tar -xzf provision.tar.gz

ln -sfn "$PWD" "$(dirname "$PWD")/latest"

echo
echo "Downloaded into $(pwd)."
echo "$(dirname "$PWD")/latest now points here."
echo "Next: fill in the machine under 'Provision ownhq' on the versions page,"
echo "and run the commands it produces."

The one-liner just runs install.sh. Read it on the second tab and run it yourself if you would rather not pipe a URL into bash. The upgrade tab is for an ownhq that is already running a release with self-upgrade: it fetches this release and applies it to itself, so nothing is downloaded here. Copy cli to run it from a terminal, or web to paste the URL into the Upgrade card on ownhq's Overview page. Older ownhq instances keep using the provision steps below.

Provision an ownhq

Run the phases in order. The inventory lists every saved server; the other phases target your active server .

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.08-c151a25
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

# 1. Work from the release you downloaded, and keep one inventory for every
#    release and every ownhq. The plays target the group "ownhq" (and still accept
#    "brain", its name before the rename); this adds each saved server under it once
#    and is safe to rerun.
cd ~/paas/2026.09.08-c151a25
touch ~/paas/inventory.ini
grep -q '^\[ownhq\]' ~/paas/inventory.ini || echo '[ownhq]' >> ~/paas/inventory.ini
grep -q '^<host> ' ~/paas/inventory.ini || echo '<host> ansible_user=ownhq' >> ~/paas/inventory.ini

# 2. First contact, once per ownhq, as the account the image ships with.
#    Creates the ownhq account with your key and disables root SSH.
ansible-playbook -i ~/paas/inventory.ini --limit <host> -e ansible_user=<user> -e ownhq_pubkey_src=<pubkey> provision/bootstrap.yml

# 3. Provision, as ownhq. --limit keeps it to this ownhq: the vault passphrase
#    prompt is per ownhq. Press Enter to have a passphrase generated.
cd ~/paas/2026.09.08-c151a25
ansible-playbook -i ~/paas/inventory.ini --limit <host> provision/ownhq.yml \
  -e @provision/vars/prod.yml \
  -e server_jar=$PWD/paas-server.jar \
  -e cli_jar=$PWD/paas-cli.jar

# Upgrading an ownhq you already provisioned: download the new release and run
# this step from its directory - nothing else. Press Enter at the prompt: an open
# vault needs no passphrase. Only a closed vault, after a reboot, asks for it;
# unlock first with:  ssh ownhq@<host> sudo /opt/paas/scripts/ohq unlock

Keep the two secrets
The provision phase prints the ownhq vault passphrase once - every reboot needs it. The ownhq MEK is revealed from the setup page, reachable over a tunnel. Put both in a password manager before you close the terminal.
secrets
```
ssh -L 7070:10.8.0.1:7070 ownhq@<host>
# browser:  http://localhost:7070/setup
# terminal: curl -H 'Accept: text/plain' http://localhost:7070/setup/mek/reveal
```

Published versions

2026.11.04-700a9c2 latest

Download the release

Provision an ownhq

Keep the two secrets

2026.11.03-beed1ce

Download the release

Provision an ownhq

Keep the two secrets

2026.10.30-700f055

Download the release

Provision an ownhq

Keep the two secrets

2026.10.30-9e72fb0

Download the release

Provision an ownhq

Keep the two secrets

2026.10.30-558df9b

Download the release

Provision an ownhq

Keep the two secrets

2026.10.27-f398fb8

Download the release

Provision an ownhq

Keep the two secrets

2026.10.27-527930f

Download the release

Provision an ownhq

Keep the two secrets

2026.10.23-bf8fc44

Download the release

Provision an ownhq

Keep the two secrets

2026.10.23-f0124fd

Download the release

Provision an ownhq

Keep the two secrets

2026.10.23-f669625

Download the release

Provision an ownhq

Keep the two secrets

2026.10.23-6cd7412

Download the release

Provision an ownhq

Keep the two secrets

2026.10.23-9d8b9c6

Download the release

Provision an ownhq

Keep the two secrets

2026.10.23-c83670b

Download the release

Provision an ownhq

Keep the two secrets

2026.10.22-3f487af

Download the release

Provision an ownhq

Keep the two secrets

2026.10.22-6719f94

Download the release

Provision an ownhq

Keep the two secrets

2026.10.15-2a61851

Download the release

Provision an ownhq

Keep the two secrets

2026.10.14-35ddd61

Download the release

Provision an ownhq

Keep the two secrets

2026.10.14-2ff11b0

Download the release

Provision an ownhq

Keep the two secrets

2026.10.14-9c7a9bc

Download the release

Provision an ownhq

Keep the two secrets

2026.10.14-8d3441a

Download the release

Provision an ownhq