# Orama Network > Orama Network is a decentralized platform for deploying web apps, SQLite databases and serverless WASM functions across a peer-to-peer node network, reached through a single API gateway per namespace. A separate Cosmos SDK ledger, oramad, mints the ORAMA token. Application requests do not pass through that ledger. Custom domains can be verified, but certificates are issued only on the network's own domain. ## Start here - [Get started](https://orama.network/llms/start-get-started.md): This is the one page for joining the Orama network with machines of your own: from empty servers and a wallet to nodes that show up in orama status, a… - [What is Orama](https://orama.network/llms/start-what-is-orama.md): Orama Network is an open-source cloud platform that runs on many independently operated servers instead of one company's data centres. You use it through… - [Choose your path](https://orama.network/llms/start-journeys.md): Pick the journey that matches what you want to do. Each one is a reading order, not a menu: follow it top to bottom. If you just want to join the network… - [What works today](https://orama.network/llms/start-status.md): This page is the honest inventory. It is written against the code on the nightly branch (network version 0.3.0). When a page elsewhere in these docs… - [Glossary](https://orama.network/llms/start-glossary.md): Short definitions of the words these docs use. Each links to the page that explains it. ## Developer - [Quickstart](https://orama.network/llms/developer-getting-started.md): This takes you from nothing to a deployed site and a working database call. It assumes someone runs an Orama cluster you can reach (your own, see Install… - [Namespaces](https://orama.network/llms/developer-namespaces.md): A namespace is the unit you build in. It is your own small cluster inside the Orama cluster: its own database, its own cache and its own gateway, on… - [Sign-in and sessions](https://orama.network/llms/developer-sign-in.md): Orama has no accounts, no passwords and no sign-up. Everything that reaches a gateway is one of two things. - [Devices](https://orama.network/llms/developer-devices.md): A session used to belong to an account and nothing else. Every installation of an application signed in as the same wallet held interchangeable sessions… - [Access control and keys](https://orama.network/llms/developer-access-control.md): Who may do what in a namespace. A namespace has exactly one owner and any number of members. A member holds a role, a role is a set of permissions, and a… - [How you talk to the network](https://orama.network/llms/developer-client-surface.md): Humans use one CLI. Programs use the SDK and the gateway HTTP API. There is no Orama dashboard and no Orama MCP server. - [Deployments](https://orama.network/llms/developer-deployments.md): Deploy applications to the Orama decentralized network. The CLI supports four deployment types: static sites, Next.js SSR, Go backends, and Node.js… - [Domains and Routing](https://orama.network/llms/developer-domains.md): Every deployment on the Orama Network is assigned a domain automatically. You do not need to configure DNS, provision certificates, or set up reverse… - [Databases](https://orama.network/llms/developer-databases.md): Orama provides two database systems for your applications: per-namespace SQLite databases for isolated, node-local storage, and a distributed RQLite ORM… - [Cache](https://orama.network/llms/developer-cache.md): Distributed caching powered by Olric — an in-memory key-value store designed for distributed systems. Cache data across the network with automatic… - [Storage](https://orama.network/llms/developer-storage.md): Orama Storage is file storage built on IPFS. Upload, retrieve, pin and unpin files across the cluster. Every file is identified by its CID (content… - [PubSub](https://orama.network/llms/developer-pubsub.md): Real-time, WebSocket-based messaging for the Orama Network. Publish and subscribe to topics for live event streaming, notifications, inter-service… - [Functions](https://orama.network/llms/developer-functions.md): Orama Network runs serverless functions as sandboxed WebAssembly (WASM) modules. Functions are written in Go, compiled to WASM with TinyGo, and executed… - [Push notifications](https://orama.network/llms/developer-push.md): Push is bring your own credentials: you control your Apple Developer account, your push keys and your topic format. The platform provides delivery… - [WebRTC](https://orama.network/llms/developer-webrtc.md): Real-time voice, video, and data channels for Orama Network namespaces. Media flows through TURN relays: clients never connect directly. The SFU… - [Vault](https://orama.network/llms/developer-vault.md): Orama Vault stores small secrets by splitting them with Shamir's Secret Sharing across guardian nodes, so that no guardian holds the secret. Status… - [Backups and restore](https://orama.network/llms/developer-backups.md): A sealed backup captures a whole namespace in one file that only you can open. The cluster is given only your public key, so it can write backups it… - [TypeScript SDK](https://orama.network/llms/developer-sdk-reference.md): @debros/orama (version 0.3.0, MIT) is the programmatic surface of an Orama namespace. Everything a deployed application does (query its database, publish… - [Push Notifications](https://orama.network/llms/developer-push-notifications.md): This guide explains how a tenant app (any namespace on the Orama Network) configures push notifications end-to-end. The platform is… - [Go Client SDK](https://orama.network/llms/developer-go-sdk.md): The Orama Network Go Client SDK provides a clean, type-safe Go interface for interacting with the Orama Network. It abstracts away the complexity of peer… - [Gateway API surface](https://orama.network/llms/developer-api-surface.md): Every route the gateway registers, and which client owns it. Humans use the CLI, programs use the SDK and this HTTP API, and there is no Orama dashboard… - [CLI overview](https://orama.network/llms/developer-cli-overview.md): orama is the human interface to an Orama network. One binary, three audiences: operators (orama status, upgrade, edit, remove, ssh, network), tenants… - [orama app](https://orama.network/llms/developer-cli-app.md): Inspect and manage deployed applications. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama auth](https://orama.network/llms/developer-cli-auth.md): Sign in, approve a login from another machine, and manage sessions. Every command and flag below comes from the orama command tree, so it matches the… - [orama chain](https://orama.network/llms/developer-cli-chain.md): Read the Orama chain and fund test accounts. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama cluster and operator](https://orama.network/llms/developer-cli-cluster.md): Cluster-wide settings, namespace creators, and the wallets that operate a cluster. Every command and flag below comes from the orama command tree, so it… - [orama db](https://orama.network/llms/developer-cli-db.md): Create and query SQLite databases. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama deploy and domain](https://orama.network/llms/developer-cli-deploy.md): Deploy apps and attach custom domains. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama network](https://orama.network/llms/developer-cli-network.md): Choose which network the CLI talks to: a cluster by its gateway, or a network of the registry by its manifest. Every command and flag below comes from… - [orama function](https://orama.network/llms/developer-cli-function.md): Build, deploy and run serverless functions. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama global](https://orama.network/llms/developer-cli-global.md): Install and operate a global node, and build its chain messages. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama members and audit](https://orama.network/llms/developer-cli-members.md): Who may work in a namespace, and the namespace's audit trail. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama setup](https://orama.network/llms/developer-cli-setup.md): Join an Orama network: turn fresh VPSes into nodes, in one command. Every command and flag below comes from the orama command tree, so it matches the… - [orama status](https://orama.network/llms/developer-cli-status.md): Your nodes, the cluster, the chain and your account, live or one view at a time. Every command and flag below comes from the orama command tree, so it… - [orama namespace](https://orama.network/llms/developer-cli-namespace.md): Create namespaces, mint API keys, back up and restore. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama node](https://orama.network/llms/developer-cli-node.md): Install, run, upgrade and remove nodes. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama maint sandbox](https://orama.network/llms/developer-cli-sandbox.md): Throwaway Hetzner clusters for testing. Every command and flag below comes from the orama command tree, so it matches the binary. - [orama storage](https://orama.network/llms/developer-cli-storage.md): Storage deals on the Orama chain. Every command and flag below comes from the orama command tree, so it matches the binary. - [Other commands](https://orama.network/llms/developer-cli-other.md): nodes, ssh and version, and the maintainer commands under orama maint: build, push, rollout, inspect, invite and vpn. Every command and flag below comes… - [Video Tutorials](https://orama.network/llms/developer-video-tutorials.md): Video walkthroughs of the Orama Network. ## Operator - [What you need to run a cluster](https://orama.network/llms/operator-getting-started.md): To join a network with machines you rent, run orama setup: it does what the pages below do by hand, for every machine at once, and registers you on the… - [One-VPS evaluation](https://orama.network/llms/operator-one-vps.md): A single server can run Orama end to end: the index plane on that machine, then a tenant namespace on the same machine, then an app with a database. This… - [Join with orama setup](https://orama.network/llms/operator-setup.md): orama setup turns fresh machines into nodes of an Orama network in one command. It gives your RootWallet an SSH key on each machine, installs the signed… - [Install a cluster from scratch](https://orama.network/llms/operator-install-from-scratch.md): This is the whole path from three empty servers and a domain to a working cluster with an app running on it. Follow it in order. After every stage there… - [Run your own cluster](https://orama.network/llms/operator-run-your-own-cluster.md): A private Orama cluster is three or more Linux machines that you install with orama node setup, plus a domain whose nameserver records you can publish… - [Build and sign](https://orama.network/llms/operator-build-and-sign.md): Orama nodes never compile anything. You build one archive on your own computer (or take a published release, below), and every node unpacks it. The… - [Signed archives](https://orama.network/llms/operator-signed-archives.md): Nodes install only build archives signed by an address they trust. The list of trusted addresses — the trust anchor — is /etc/orama/archive-signers on… - [DNS and nameservers](https://orama.network/llms/operator-nameserver.md): An Orama cluster is its own DNS server. Its base domain, and every name under it (each deployment, each namespace gateway, each node, the TURN hosts) is… - [TLS and certificates](https://orama.network/llms/operator-tls-certificates.md): Every public name of an Orama cluster is served over HTTPS with a certificate the cluster obtains for itself. You do not buy, upload or renew a… - [Joining nodes](https://orama.network/llms/operator-joining-nodes.md): Adding a node to a running cluster is one command from your computer, using a single-use invite. This page covers the invite, the three kinds of node… - [Installing by hand](https://orama.network/llms/operator-node-setup.md): orama setup is the normal way to join a network: it installs the cluster node and the global layer on every machine you give it. orama node setup… - [First namespace and app](https://orama.network/llms/operator-first-app.md): A cluster that answers orama status is up. This page proves it works end to end by creating a namespace and deploying a site, and shows what to look at. - [Node management](https://orama.network/llms/operator-node-management.md): These commands run from your computer and manage every node you operate. Your wallet identity (through RootWallet) links you to your nodes: orama node… - [Cluster administration](https://orama.network/llms/operator-cluster-admin.md): The wallets on a cluster's operator list can change cluster-wide settings, manage who creates namespaces, rotate keys and see the whole cluster's health… - [Monitoring](https://orama.network/llms/operator-monitoring.md): Cluster health, from your machine. Three parts work together: - [Upgrades](https://orama.network/llms/operator-upgrades.md): A new Orama version is a new signed archive and a rolling restart. Extract can happen on every node at once. Restarts happen one node at a time, with a… - [Upgrade notes](https://orama.network/llms/operator-upgrade-notes.md): What a rolling upgrade does differently when it crosses a release that changes how a node is laid out, which service versions it runs, or the registry… - [WireGuard Mesh Networking](https://orama.network/llms/operator-wireguard.md): All inter-node communication in the Orama Network happens over a WireGuard mesh overlay. WireGuard provides encrypted, high-performance tunnels between… - [Vault guardians](https://orama.network/llms/operator-vault-guardians.md): Every Orama node runs a vault-guardian, the daemon that stores one Shamir share of each secret in the network's vault. This page is the operator's… - [WebRTC operations](https://orama.network/llms/operator-webrtc-operations.md): How a WebRTC-enabled namespace is provisioned, where its rooms live, which ports it uses, how TURN is shared per host, and how the roles are kept… - [Troubleshooting](https://orama.network/llms/operator-troubleshooting.md): Named failures, what causes them, and how to fix them. Start with the tools, then find your symptom. Always use the orama CLI for diagnostics and service… - [Replace a node](https://orama.network/llms/operator-node-replacement.md): How to replace one nameserver with a new machine without losing the registry's Raft quorum and without breaking namespaces. The same process applies to… - [Wipe a node](https://orama.network/llms/operator-clean-node.md): How to take Orama off a server so it can be installed fresh, or so it can leave the cluster for good. - [Inspector](https://orama.network/llms/operator-inspector.md): The inspector is a cluster health check tool that SSHs into every node, collects subsystem data in parallel, runs deterministic checks, and optionally… - [OramaOS](https://orama.network/llms/operator-orama-os.md): OramaOS is a custom minimal Linux image, built with Buildroot, purpose-made for running Orama nodes. It replaces the Ubuntu deployment with a locked-down… - [Global nodes](https://orama.network/llms/operator-global-nodes.md): A global node runs the public Orama chain (oramad) and, optionally, the services beside it: the storage provider, the history archiver, the chain indexer… - [Stealth TURN operations](https://orama.network/llms/operator-stealth-turn.md): A TLS-level SNI router that lets Orama serve TURN-over-TLS on :443, sharing the port with Caddy HTTPS. From a network observer's perspective, TURN… - [Running the Orama Tor network](https://orama.network/llms/operator-tor-network.md): The Orama Tor network is a separate anonymity network built from unmodified upstream Tor (the tor package of the Tor Project's apt repository) and run by… - [Hardening checklist](https://orama.network/llms/operator-security.md): The reasons are on Security model and Secrets and keys. This page is what to check on a node you operate, with the command for each, and what the… ## Architecture and security - [Architecture overview](https://orama.network/llms/architecture-overview.md): This page is the map. Orama is a modular gateway and edge proxy: clients reach an HTTPS gateway, and the gateway orchestrates a set of backend services… - [Node process model](https://orama.network/llms/architecture-node-process-model.md): What runs on a node, in what order, and what happens when things fail. This is the page to read before you operate a node, or before you wonder why a… - [Request lifecycle](https://orama.network/llms/architecture-request-lifecycle.md): What happens between your HTTPS request and the answer, and why each step is where it is. - [Security model](https://orama.network/llms/architecture-security-model.md): This page explains what Orama protects, how, and where the protection stops. It is the page to read before you decide what to put on a cluster, or… - [Secrets and keys](https://orama.network/llms/architecture-secrets-and-keys.md): Every secret and key in an Orama cluster, what it is for, where it lives, and who can read it. Use it to answer "if this leaks, what is exposed", and to… - [Vulnerability disclosure](https://orama.network/llms/architecture-disclosure.md): Status: this page sets scope, severity and the reporting rules. It does not promise a payout. Payouts are the owner's to set and publish separately. ## Blockchain - [What the chain is](https://orama.network/llms/blockchain-what-it-is.md): Orama has a ledger. The binary is oramad. It is a Cosmos SDK 0.54 application on CometBFT 0.39, in its own Go module at chain/. The node software in… - [The modules](https://orama.network/llms/blockchain-modules.md): Every module in chain/x/, what it does and whether it is live. "Live" means wired into oramad and exercised by tests on a test network. It does not mean… - [Reading the chain](https://orama.network/llms/blockchain-reading-the-chain.md): There are four ways to read the chain: the orama chain command, the gateway's read-only proxy, the TypeScript SDK, and oramad itself on a node. Writing… - [Using the explorer](https://orama.network/llms/blockchain-using-the-explorer.md): The explorer at orama.network/explorer lets anyone read an Orama chain: its blocks, transactions, wallets, validators, epochs, supply, nodes, storage… - [Public chain read API](https://orama.network/llms/blockchain-chain-read-api.md): Every Orama gateway serves the chain's public data over plain HTTP under /v1/chain/, with no key and no account. This page is for developers who build on… - [Supply and emission](https://orama.network/llms/blockchain-supply.md): A normal genesis creates no norama. A genesis with coins already in accounts is allowed only on a devnet, stagenet or localnet chain id, and only when… - [What do I earn](https://orama.network/llms/blockchain-what-do-i-earn.md): What a validator, a storage provider and a relay earn per epoch under the chain's parameters, for a small and a large operator and a newcomer with no… - [Fees](https://orama.network/llms/blockchain-fees.md): Every transaction pays a base fee. The base fee behaves like EIP-1559, with integer arithmetic in norama per unit of gas. - [Validators and staking](https://orama.network/llms/blockchain-validators.md): Bonds live in x/staking. The voting power CometBFT uses is computed by x/power at the end of every block. Staking's own validator-set updates are… - [Governance: the two houses](https://orama.network/llms/blockchain-governance.md): x/houses is Orama's governance module. It is implemented and wired, and it is gated closed at genesis: nothing can pass until the conditions below are… - [Nodes, roles and bonds](https://orama.network/llms/blockchain-nodes.md): x/nodes is the chain's registry of who runs what. An operator registers nodes, gives each node roles, and locks a bond per role. Other modules read this… - [Storage deals](https://orama.network/llms/blockchain-storage-deals.md): A storage deal is an on-chain agreement: you escrow ORAMA, a set of providers each hold one encrypted piece of your file, and every epoch each provider… - [History archive](https://orama.network/llms/blockchain-archive.md): A validator that keeps every block forever needs ever more disk. x/archive lets the network agree that a range of old blocks has been stored safely… - [Relay rewards](https://orama.network/llms/blockchain-relay-rewards.md): x/relay is the chain's registry of Tor relays and exits, and the rule for paying them from the relay share of emission (10% of each epoch's maximum). - [Token factory](https://orama.network/llms/blockchain-token-factory.md): x/token lets anyone create a token without writing a contract. A token is a bank denom named factory// and its balances live in the normal bank module. - [NFTs and the market](https://orama.network/llms/blockchain-nfts-and-market.md): Two modules handle NFTs on the chain. x/cnft stores compressed NFTs, millions of them for the price of one small tree. x/market lets owners sell them at… - [Shielded pool](https://orama.network/llms/blockchain-shielded.md): x/shielded is the private way to hold and move ORAMA. It is a shielded pool in the style of Zcash Orchard (orchard 0.15.5, "Ironwood" in Orama's naming)… - [Contracts](https://orama.network/llms/blockchain-contracts.md): The chain can run CosmWasm smart contracts through wasmd (v0.70.3 on wasmvm v3.0.7). Contracts exist only in builds made with cgo and libwasmvm (make… - [Running a chain node](https://orama.network/llms/blockchain-running.md): orama maint node install does not start the chain. A machine runs it as a global node, installed with sudo orama global install --services chain,...: see… - [Run a global node](https://orama.network/llms/blockchain-run-a-global-node.md): A global node runs the public Orama L1 (oramad) and, optionally, the services beside it: the storage provider, the history archiver, or the repair… - [Security disclosure and bounty policy](https://orama.network/llms/blockchain-security-disclosure.md): This page sets out the scope, the severity ratings and the disclosure rules for vulnerabilities in the Orama chain and its global services. It does not… ## Privacy network - [Privacy network overview](https://orama.network/llms/privacy-overview.md): This section covers every privacy feature in Orama, who each one hides information from, and what is not built. Read this page first. It is deliberately… - [Tor: the proxy, onion submission and the Orama Tor network](https://orama.network/llms/privacy-tor.md): Every Orama node runs a Tor client. It is client-only: it relays nothing, opens no inbound port and never becomes an exit. Three things use it: the… - [Relayed fetch](https://orama.network/llms/privacy-relayed-fetch.md): Relayed fetch lets a client download a stored object without the node that holds it ever learning the client's address. A second node, the relay, carries… - [Stealth TURN](https://orama.network/llms/privacy-stealth-turn.md): Stealth TURN lets a namespace serve TURN over TLS on port 443, the same port as ordinary HTTPS. To a network observer a relayed call looks like a normal… - [VPN](https://orama.network/llms/privacy-vpn.md): There is no public Orama VPN today. There is a command-line client for a private Orama Tor network, and a launch gate that keeps anything public closed… ## RootWallet - [RootWallet overview](https://orama.network/llms/rootwallet-overview.md): RootWallet is a self-custody wallet that also keeps your passwords, SSH keys, authenticator codes, payment cards and secure notes. It is the wallet Orama… - [Install RootWallet](https://orama.network/llms/rootwallet-install.md): Download from the RootWallet releases page. - [Wallets and accounts](https://orama.network/llms/rootwallet-wallets.md): Create. Every surface generates a 12-word BIP-39 phrase. You must confirm words before the wallet is written: three random words on the CLI, a… - [Send, receive, swap and ORAMA](https://orama.network/llms/rootwallet-assets.md): Desktop and mobile can swap and bridge through LI.FI. The CLI does not. - [The vault](https://orama.network/llms/rootwallet-vault.md): The vault stores passwords, SSH keys, authenticator (TOTP) codes, secure notes and payment cards in one AES-256-GCM file, ~/.rootwallet/vault.json, under… - [The agent](https://orama.network/llms/rootwallet-agent.md): The RootWallet desktop app runs a small local server, the agent, on a Unix socket. External tools such as the orama CLI ask it for an SSH key, a… - [Signing in to Orama with RootWallet](https://orama.network/llms/rootwallet-orama-sign-in.md): Orama identifies you by a wallet address and proves it with a signature. RootWallet is the wallet the orama CLI uses to produce that signature, and the… - [CLI reference (rw)](https://orama.network/llms/rootwallet-cli.md): rw is RootWallet in the terminal (package @debros/root-cli). Run rw --help for anything not listed. Many read commands accept --json. - [RootWallet security](https://orama.network/llms/rootwallet-security.md): One BIP-39 phrase makes a 64-byte seed. From it: ## Contributor - [Development setup](https://orama.network/llms/contributor-dev-setup.md): How to build and test Orama from a checkout. Everything lives in one repository. - [Architecture Reference](https://orama.network/llms/contributor-architecture-reference.md): The detailed architecture of the Orama Network node and gateway: the process model, the core components, data flow, security architecture, and how the… - [Code Style Guide](https://orama.network/llms/contributor-code-style.md): Consistent code style makes the codebase easier to read, review, and maintain. This guide covers the conventions, patterns, and requirements for… - [Testing](https://orama.network/llms/contributor-testing.md): Every code change ships tests. This page covers the three layers: unit tests, the end-to-end cluster guide, and the fleet e2e suite that gates a release… - [Performance](https://orama.network/llms/contributor-performance.md): Two measurements guard the chain's speed. Go microbenchmarks time the hot paths of the code on one machine and fail a release when one of them got more… - [Release and rollout](https://orama.network/llms/contributor-deployment.md): How code gets from a checkout onto nodes. For installing a cluster the first time see Install a cluster from scratch; for the full upgrade protocol see… - [Sandbox clusters](https://orama.network/llms/contributor-sandbox.md): Spin up temporary 5-node Orama clusters on Hetzner Cloud for development and testing. Cost depends on the server type you pick during setup — a few euro… ## Blog - [What is Orama Network? A decentralized cloud, explained](https://orama.network/llms/blog/what-is-orama-network.md): Orama is an open-source cloud built to run on servers owned by independent people: hosting, database, storage, functions and calls, with no accounts.