self-hosted

Your second brain,
on your own server.

Run Memo unattended on a Raspberry Pi, an old laptop, a home NAS, or a VPS — no display, no desktop app, just a network connection and one line typed over SSH. Multi-account with per-capability permissions is built in.

one command, unified across Linux x86_64/arm64 and macOS

No display needed

A dedicated server-only installer skips the Flutter binary entirely — just the backend, the CLI, and the inference engine.

A real 4-mode auth system

None, token, password, or token+password — argon2id hashing, brute-force lockout, per-device tokens, all credential-less only from loopback.

Multi-account, per-capability permissions

Admin and user roles from Settings → Accounts, now with 7 independent switches per account — Models, Memory, Agent, Calendar, WhatsApp, Telegram, Routines — enforced server-side.

Fully managed over SSH

memo config/remote/service/provider/agent/model, plus account management (list-accounts/add-account/delete-account) — a complete CLI toolkit, no dashboard or raw curl against the API required.

three ways in

Pick the shape that fits your box.

Server-only installer

get-memo-server.sh

A Raspberry Pi, home server, or VPS with SSH access. Auto-detects Linux x86_64/arm64 and macOS from one command, offers to set itself up as a systemd service on the way.

Docker / CasaOS

ghcr.io/…/memo-backend

CasaOS, Unraid, Synology, or any Docker host. A multi-arch, backend-only image published automatically on every release — install straight from a pasted docker-compose.yml.

Remote desktop

Settings → Remote Access

Already run Memo on a desktop? Turn on Remote Access and point another device at it — the full feature set, nothing to install elsewhere.

honest about what's not done

Beta-hardened, not yet independently audited.

No built-in TLS yet — put it behind Tailscale, ngrok, or your own reverse proxy for anything leaving your LAN.
Starting/stopping a Tailscale or ngrok tunnel is still Settings-only, not yet a CLI subcommand.
The auth system has been tested live against a real non-loopback client on a real Raspberry Pi — but a genuine adversarial security review hasn't happened yet.