Orca #2249

Name of the Script

Orca

Script Type

CT (LXC Container)

Does this script support arm64?

arm64 not tested

📋 Script Details

Name of the Script

Orca

Script Type

CT (LXC Container)

Does this script support arm64?

arm64 not tested — upstream ships an orca-linux-arm64.AppImage, but the script has only been
verified on amd64 (var_arm64 left unset so the engine asks before attempting).

📋 Script Details

Orca (https://github.com/stablyai/orca) is the ADE for working with a fleet of parallel coding
agents. This script installs the headless Orca runtime (orca serve) in an unprivileged
Debian 13 LXC and exposes it over WebSocket for Orca desktop and mobile clients.

What the script does

• Deploys the official orca-linux.AppImage via fetch_and_deploy_gh_release (singlefile,
  USE_ORIGINAL_FILENAME) and extracts it with --appimage-extract — no FUSE needed in the LXC.
• Installs the Electron runtime libraries (Debian 13 t64 names) + Xvfb; orca serve starts
  its own Xvfb display when none is set.
• Runs the server as a dedicated non-root orca user so Chromium keeps its sandbox enabled
  (documented deviation from the "no separate user" rule — required by Orca upstream's headless
  guide). Root-owned /opt/orca, KillMode=mixed, RestartPreventExitStatus=3.
• A /usr/local/bin/orca-serve wrapper resolves the advertised endpoint on every start
  (manual override → Tailscale IP → LAN fallback), since Orca only advertises one endpoint.
• Network modes (host-side whiptail): private LAN only, or Tailscale (installs Tailscale
  with TUN passthrough; guided interactive login with URL/QR, or auth key for unattended).
• Agent API credentials (whiptail checklist): Anthropic, GitHub Copilot, Google Gemini,
  OpenAI, OpenCode Zen, OpenCode Go, OpenRouter, Vercel AI Gateway, CommandCode. Keys are stored
  in /etc/default/orca-agent (root, 0600) as an extra systemd EnvironmentFile, so every agent
  the server spawns inherits them without exposing secrets. Agent CLIs installed server-side via npm.
• Post-install helper orca-agents to add/update/remove provider keys and restart the service.
• update_script() with check_for_gh_release + create_backup/restore_backup; Orca state
  lives in /home/orca/.config and survives upgrades.

Status: in development. Written, shellcheck-clean, and validated against a real Proxmox VE
host (install, service, Tailscale pairing and client pairing verified). The PR will be opened as
soon as new-script pull requests are accepted again.