# RasnuOS — Complete Technical & Product Reference (llms-full.txt)

> RasnuOS is the AI SRE and server operations control plane that asks before it acts. Connect any Linux, macOS, or Windows server in 30 seconds via the open-source static agent (`https://github.com/rasnu/os-agent`), diagnose production issues in plain language, inspect live telemetry, open browser terminals, edit files with automatic backups and 1-click Undo, migrate workloads directly between servers, and enforce human Approval Cards on every change.

- Primary Website: https://os.rasnu.com
- Open-Source Host Agent Repository: https://github.com/rasnu/os-agent
- Concise LLM Index: https://os.rasnu.com/llms.txt
- Full LLM Knowledge Base: https://os.rasnu.com/llms-full.txt
- Support Contact: support@rasnu.com
- Enterprise Inquiries: enterprise@rasnu.com
- Security Disclosures: security@rasnu.com (https://os.rasnu.com/.well-known/security.txt)

---

## 1. Executive Summary & Core Value Proposition

Traditional server management forces engineering teams to choose between:
1. Manual SSH sessions and brittle bash scripts (slow, error-prone, zero central audit trail),
2. Heavyweight Infrastructure-as-Code pipelines like Ansible/Terraform (built for initial provisioning, not live 2 AM incident diagnosis), or
3. Unchecked autonomous AI agents with raw root access (unsafe for production).

**RasnuOS solves this with Human-in-the-Loop Conversational Server Operations:**
- **Read-Only Diagnostics Run Immediately:** Checking CPU/RAM, tailing logs, inspecting service status (`systemctl`, `docker ps`, `journalctl`), and testing config syntax run safely without modifying server state.
- **Every State-Changing Action Pauses on an Approval Card:** Before any file write, package install, or service restart executes, RasnuOS presents the exact command, visual line-by-line file diff, risk level, and automatic `.bak` rollback path. Nothing runs until an authorized operator clicks **Approve** (in the web dashboard, ServiceNow, Telegram, or Email).
- **Zero Inbound Firewall Ports:** The open-source host daemon (`rasnuos-agent`, <15 MB static binary) connects outbound over TLS port 443 (`wss://`). Servers require no public SSH port 22 or VPN bastion exposure.

---

## 2. Open-Source Host Agent (`https://github.com/rasnu/os-agent`)

- **Repository:** https://github.com/rasnu/os-agent (Public, Apache-2.0 licensed, auditable source code and CI workflows)
- **Supported Operating Systems:** Ubuntu, Debian, RHEL, Rocky Linux, AlmaLinux, CentOS, Fedora, Arch Linux, Alpine Linux, openSUSE, macOS (Intel & Apple Silicon), Windows Server / Windows 10+
- **Supported Architectures:** `amd64` (`x86_64`) and `arm64` (`aarch64`)
- **Footprint:** Single static binary (<15 MB RAM idle, <0.5% CPU overhead)
- **Transport:** Outbound-only WebSocket over TLS 1.3 (port 443) with automatic exponential-backoff reconnection
- **Edge Secret Redaction:** Automatically redacts passwords, private keys, bearer tokens, AWS keys, and `.env` credentials on the server before command output or log lines leave the host
- **Local Host Guardrails:** Compiled safety policy engine blocks destructive disk/filesystem commands (`rm -rf /`, `mkfs`, `dd` to raw block devices, fork bombs, firewall lockouts) directly on the host machine even before execution
- **Cryptographically Signed Releases:** Every official agent binary release is signed offline; the agent verifies the embedded public key and SHA-256 checksum before applying any update (fail-closed)

---

## 3. The 6 Core Jobs in One Workspace (`/product`)

### Job 1: Converse & Diagnose (`/product#converse`)
- Chat in plain English with a single server or across an entire multi-server fleet ("Why is `api-prod-03` returning 502 errors on checkout?").
- Correlates live CPU/memory/disk metrics, process tables, service logs, and persistent server memory to pinpoint root causes in seconds.
- Includes reusable Playbooks (`/`), file context mentions (`@`), voice dictation, and AI prompt enhancement.

### Job 2: Operate (`/product#operate`)
- **Incident Mode 3-Pane Workspace:** Left pane for connected server fleet & active incidents; Center pane for the AI SRE Command Center & Approval Cards; Right pane with 7 built-in operational tabs (`Metrics`, `Terminal`, `Logs`, `Files`, `Processes`, `Audit`, `Canvas`).
- **Live Browser Terminal:** Interactive shell over the existing outbound agent connection without opening port 22.
- **Visual File & Config Editor:** Browse directories, edit configuration files with syntax highlighting, create automatic `.bak` backups on every save, and restore prior versions in 1 click.
- **One-Click Service Installers:** Guided deployment and configuration for 20+ production services (Nginx, Caddy, PostgreSQL, MySQL, Redis, Docker, Node.js, PHP, Python, Let's Encrypt SSL, UFW, Fail2ban, WireGuard, Prometheus exporters).

### Job 3: Protect (`/product#protect`)
- **3 Governance Modes per Workspace/Conversation:**
  1. **Manual Approval (Default):** Every state-changing command or file edit pauses on an Approval Card.
  2. **Team / CAB Review:** High-risk production changes route to designated approvers or external Change Advisory Boards (ServiceNow, Jira, Slack, Teams, PagerDuty, Telegram, Email) before execution.
  3. **Auto-Resolve (Opt-In):** Allows pre-approved low/medium-risk maintenance playbooks to execute automatically while still enforcing local host guardrails and automatic file backups.

### Job 4: Migrate (`/product#migrate`)
- Direct peer-to-peer encrypted `rsync` over ephemeral SSH keys between source and destination servers.
- Zero third-party cloud storage staging—your data moves directly from Server A to Server B.
- Includes pre-flight disk space checks, `--dry-run` file diff previews, configurable `--bwlimit` bandwidth throttling, and post-migration service verification.

### Job 5: Observe (`/product#observe`)
- Real-time 15-second telemetry streaming: CPU load, RAM usage, swap, disk I/O, network throughput, top processes, and discovered systemd/Docker services.
- Automated anomaly detection and Incident Radar alerts when resource thresholds or service health checks fail.
- Real-time AI token and server management wallet burn tracking.

### Job 6: Integrate (`/product#integrate`)
- Out-of-the-box integration with ServiceNow, Jira Service Management, PagerDuty, Slack, Microsoft Teams, Telegram, Email, and custom HMAC-SHA256 webhooks (`/api/webhooks/itsm/{tenantId}`).

---

## 4. Transparent Pricing & Usage Wallet (`/pricing`)

Every paid subscription tier credits **100% of your monthly subscription payment directly into your prepaid Usage Wallet**—you never pay an empty seat/platform tax on top of usage.

| Plan | Monthly Price (Annual Billing) | Server Limit | Team Seats | Key Capabilities |
| :--- | :--- | :--- | :--- | :--- |
| **Free** | $0 / mo | 1 Server | 1 Seat | Includes welcome usage credit upon registration, conversational diagnosis, browser terminal, file editor with 1-click Undo, and Manual Approval Cards. |
| **Solo / Hacker** | $12 / mo (100% credited to wallet) | Up to 3 Servers | 1 Seat | Multi-server chat, direct server-to-server migrations, 24/7 health monitoring, and custom playbooks. |
| **Startup / Team** | $39 / mo (100% credited to wallet) | Up to 10 Servers | Up to 5 Seats | Role-based access control (Owner, Admin, Operator, Viewer), shared team threads, and Telegram/Email approval links. |
| **Business** | $79 / mo (100% credited to wallet) | Unlimited Servers | Unlimited Seats | Full fleet Swarm rollouts, external CAB approval webhooks (ServiceNow, Slack, Teams, PagerDuty), IP allowlists, and CSV audit export. |
| **Enterprise** | Custom | Unlimited | Unlimited | Dedicated tenancy options, custom compliance SLAs, architecture onboarding, and priority engineering support. |

---

## 5. How RasnuOS Compares to Existing Infrastructure Tools (`/compare/*`)

| Competitor Category | Tool Compared | When to Use Competitor | Why Teams Add or Switch to RasnuOS |
| :--- | :--- | :--- | :--- |
| **Static IaC** | [Ansible & Terraform](https://os.rasnu.com/compare/ansible-terraform) | Provisioning cloud VPCs, IAM, and repeatable base images from Git. | Terraform/Ansible cannot diagnose a live 502 outage at 2 AM. RasnuOS inspects live logs/metrics, proposes the exact surgical fix, and pauses for 1-click human approval. |
| **Cloud-Locked Manager** | [AWS Systems Manager (SSM)](https://os.rasnu.com/compare/aws-ssm) | AWS-only fleets deeply tied to IAM Roles and CloudWatch. | RasnuOS works across AWS, GCP, Azure, Hetzner, DigitalOcean, bare-metal Linux, macOS, and Windows in one unified conversation without complex IAM policies. |
| **Observability & Paging** | [Datadog + PagerDuty](https://os.rasnu.com/compare/datadog-pagerduty) | High-cardinality APM tracing and on-call rotation scheduling. | Datadog and PagerDuty wake you up at 3 AM with an alert graph, then leave you to SSH in alone. RasnuOS diagnoses the root cause and prepares the ready-to-approve fix. |
| **Access Bastion** | [Teleport & Bastion SSH](https://os.rasnu.com/compare/teleport) | Zero-trust access proxying for manual engineer SSH sessions. | Teleport still requires a human to type every command manually. RasnuOS combines zero-inbound-port browser terminals and RBAC with an AI SRE that investigates and fixes issues. |
| **Static Runbooks** | [Rundeck](https://os.rasnu.com/compare/rundeck) | Running fixed cron jobs and rigid parameterized bash scripts. | Static bash scripts break when paths, OS versions, or failure symptoms shift. RasnuOS playbooks adapt to live server state while enforcing human Approval Cards. |
| **Uncontextualized AI** | [ChatGPT + Manual SSH](https://os.rasnu.com/compare/chatgpt-ssh) | General coding questions outside production servers. | Copy-pasting logs into ChatGPT leaks secrets and produces blind commands without rollback. RasnuOS redacts secrets on-host, sees live state, shows visual diffs, and creates `.bak` backups automatically. |

---

## 6. Frequently Asked Questions (`/faq`)

- **Can RasnuOS run commands on my server without my permission?**
  No. By default, Manual Approval is active: read-only diagnostic checks run safely, while any command or file edit that modifies your server pauses on an Approval Card until you click Approve.
- **Does RasnuOS require opening inbound SSH port 22?**
  No. The open-source agent (`https://github.com/rasnu/os-agent`) connects outward from your server over standard TLS port 443. You can keep all inbound firewall ports closed.
- **Are my passwords, `.env` files, or API keys sent to AI models?**
  No. The host agent automatically scrubs secrets, private keys, tokens, and credentials locally on your server before any log snippet or command output is transmitted. Furthermore, customer telemetry is never used to train foundation AI models.
- **What happens if the RasnuOS Control Plane goes offline?**
  Your servers and running applications are 100% unaffected. The lightweight agent simply waits and reconnects with exponential backoff when the connection resumes.
- **How do I uninstall the agent?**
  Run `sudo systemctl stop rasnuos-agent && sudo systemctl disable rasnuos-agent && sudo rm -f /usr/local/bin/rasnuos-agent` (or use the 1-click Disconnect & Uninstall button in the dashboard).