--- title: "Run Paseo on a remote server" description: "Run Paseo on an always-on exe.dev VM and steer Claude Code, Codex and OpenCode from its phone app or any browser. No API keys to paste." url: https://exe-staging.dev/deploy/paseo category: "AI agents" updated: 2026-10-31 --- # Run Paseo on a remote server One app for your coding agents, on a VM you steer from your phone. - **Software:** Paseo (https://paseo.sh) - **Source:** https://github.com/getpaseo/paseo - **License:** Apache-2.0 - **Time:** 10 minutes - **Example VM name:** `my-paseo` (yours will differ; on the VM, `hostname` prints it) - **Machine-readable:** https://exe-staging.dev/deploy/paseo/manifest.json ## What you get - The Paseo daemon running as a systemd service on port 6767 with its web app on, back after a reboot - A random Paseo password in `~/.paseo/paseo.env`, readable only by its owner - Claude Code and Codex ready in Paseo through exe.dev's LLM integration, with no API key to paste - A Git project at `~/project`, added to Paseo - Paseo's web app at port 6767, behind exe.dev login and Paseo's password Running on the VM: - **Paseo daemon**: @getpaseo/cli on Node.js 24, a systemd service, port 6767, data in `~/.paseo` - **Claude Code, Codex and OpenCode**: preinstalled; connected to exe.dev's LLM integration, data in `~/.claude, ~/.codex` - **Your project**, data in `~/project` How it is reached: - https://my-paseo.exe.xyz:6767/ (private): Paseo's web app in your phone's or laptop's browser, behind exe.dev login and Paseo's password - Paseo's iOS, Android and desktop apps (private): through Paseo's end-to-end encrypted relay, after pairing, with Paseo's password - ssh my-paseo.exe.xyz (private): your terminal, for the password, pairing and upkeep ## Deploy with Shelley Open https://exe-staging.dev/new?prompt=Set%20up%20Paseo%20on%20this%20VM%20by%20following%20the%20exe.dev%20recipe%20at%20https%3A%2F%2Fexe-staging.dev%2Fdeploy%2Fpaseo.md%20from%20top%20to%20bottom.%0A%0AThe%20recipe%27s%20example%20VM%20name%20is%20my-paseo.%20This%20VM%27s%20name%20is%20the%20output%20of%20%60hostname%60%3A%20use%20it%20wherever%20the%20recipe%20writes%20my-paseo.%20Skip%20the%20step%20that%20creates%20the%20VM%3B%20you%20are%20on%20it.%0A%0AYou%20are%20done%20when%20all%20of%20these%20are%20true.%20Check%20each%20one%20yourself%3A%0A-%20The%20Paseo%20daemon%20running%20as%20a%20systemd%20service%20on%20port%206767%20with%20its%20web%20app%20on%2C%20back%20after%20a%20reboot%0A-%20A%20random%20Paseo%20password%20in%20%60~%2F.paseo%2Fpaseo.env%60%2C%20readable%20only%20by%20its%20owner%0A-%20Claude%20Code%20and%20Codex%20ready%20in%20Paseo%20through%20exe.dev%27s%20LLM%20integration%2C%20with%20no%20API%20key%20to%20paste%0A-%20A%20Git%20project%20at%20%60~%2Fproject%60%2C%20added%20to%20Paseo%0A-%20Paseo%27s%20web%20app%20at%20port%206767%2C%20behind%20exe.dev%20login%20and%20Paseo%27s%20password%0A%0ARun%20the%20VM-side%20commands%20in%20%22Install%20by%20hand%22%20only%2C%20from%20%22Install%20Paseo%22%0Aon.%20If%20%60exeuntu%20configure%60%20reports%20an%20existing%20user%20config%2C%20leave%20it%0Aalone.%20Do%20not%20run%20%60paseo%20daemon%20pair%60%3A%20it%20turns%20on%20Paseo%27s%20relay%2C%20which%0Ais%20the%20owner%27s%20choice.%20Verify%20that%20%60systemctl%20is-active%20paseo%60%20says%0Aactive%2C%20that%20%60ss%20-ltn%60%20shows%20%600.0.0.0%3A6767%60%2C%20that%20the%20health%20check%0Aprints%20%60%22status%22%3A%22ok%22%60%2C%20and%20that%20the%20setup%20check%20prints%20%60OK%60.%20Never%0Aprint%20the%20password%20in%20your%20messages.%20Skip%20the%20backup%2C%20update%20and%0Atroubleshooting%20sections%20and%20the%20FAQ.%20Finish%20by%20giving%20the%20owner%20the%0Abrowser%20URL%20and%20the%20%60ssh%20...%20cat%20.paseo%2Fpaseo.env%60%20command%20from%20%22Open%0APaseo%22%2C%20with%20this%20VM%27s%20name%2C%20and%20tell%20them%20to%20follow%20%22Add%20your%20phone%22%0Anext.%0A%0AFinish%20with%20the%20URLs%20I%20should%20open.%0A to create a VM whose agent, Shelley, follows this recipe. From a terminal: ```sh curl -fsSL https://exe-staging.dev/deploy/paseo/prompt.txt | ssh exe.dev new --prompt=/dev/stdin ``` Or follow the steps below by hand. [Paseo](https://paseo.sh) is an open-source app for running coding agents: one interface for Claude Code, Codex, OpenCode and others, with a desktop app, native iOS and Android apps, a web app, and a CLI. The agents run in a daemon on one machine, and every app connects to it. Make that machine an exe.dev VM and they keep working when your laptop sleeps, while you check in from your phone. Claude Code, Codex and OpenCode come preinstalled on exe.dev and use its [LLM integration](/docs/integrations-llm): no API keys to paste, and model usage billed to your exe.dev account. ## Install Deploy installs Paseo, runs it as a service with a password, and checks that an agent answers. To do it yourself:
Install by hand On your computer, create a VM and connect. Pick any free name; if you already have a VM, skip the first command and use its name: ```bash ssh exe.dev new --name=my-paseo ssh my-paseo.exe.xyz ``` ### Install Paseo On the VM, connect Claude Code and Codex to the LLM integration, install Node.js 24 from NodeSource, and install the Paseo CLI, which includes the daemon: ```bash exeuntu configure claude exeuntu configure codex curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash - sudo apt-get install -y nodejs sudo npm install -g @getpaseo/cli paseo --version ``` ### Configure it Have the daemon listen on port 6767, where exe.dev's [HTTPS proxy](/docs/proxy) can reach it, accept requests for `*.exe.xyz`, and serve its web app. Then give it a random password, in a file only you can read: ```bash paseo daemon config set daemon.listen 0.0.0.0:6767 paseo daemon config set daemon.hostnames '[".exe.xyz"]' paseo daemon config set features.webUi.enabled true install -m 600 /dev/null ~/.paseo/paseo.env echo "PASEO_PASSWORD=$(openssl rand -hex 16)" > ~/.paseo/paseo.env ``` ### Run it as a service Still on the VM, run the daemon with systemd, so it starts on every boot and restarts if it stops: ```bash sudo tee /etc/systemd/system/paseo.service >/dev/null <<'EOF' [Unit] Description=Paseo daemon After=network-online.target Wants=network-online.target [Service] User=exedev WorkingDirectory=/home/exedev EnvironmentFile=/home/exedev/.paseo/paseo.env Environment=PATH=/home/exedev/.local/bin:/usr/local/bin:/usr/bin:/bin ExecStart=/usr/bin/paseo daemon run Restart=always RestartSec=5 [Install] WantedBy=multi-user.target EOF sudo systemctl daemon-reload sudo systemctl enable --now paseo sleep 5 curl -s localhost:6767/api/health ``` The health check prints `"status":"ok"`. On its first start Paseo downloads a local speech model (about 600 MB) for dictation, in the background. ### Add a project and check Give Paseo a project to work in. It's a Git repository, so you can review and undo whatever the agents change. Then run a one-line task through Paseo and archive it: ```bash git init ~/project paseo project create ~/project id=$(paseo -q run --cwd ~/project --provider claude/haiku --title "Setup check" "Reply with exactly: OK") paseo logs "$id" | tail -1 paseo archive "$id" ``` The `paseo logs` line prints `OK`. The `paseo` command on the VM talks to the daemon directly, without the password.
## Open Paseo Port 6767 is private: only people with access to the VM get past exe.dev's login, and Paseo asks for its password on top. On your computer, print the password: ```bash ssh my-paseo.exe.xyz cat .paseo/paseo.env ``` Open `https://my-paseo.exe.xyz:6767/` and log in to exe.dev. Paseo shows **Welcome to Paseo**. Choose **Direct connection** and enter: - **Host**: `my-paseo.exe.xyz` - **Port**: `6767` - **Use SSL**: on - **Password**: the part after `PASEO_PASSWORD=` Then **Connect**. Open the menu, choose **New workspace**, pick a model such as **Haiku 5.5** under **Select model**, and type a task: > Write index.html: a one-page site for a very opinionated cat. Keep it short. The agent works in `~/project` on the VM and tells you what it changed. ## Add your phone There are two ways in, and you can use both: - **The browser.** On your phone, open `https://my-paseo.exe.xyz:6767/`, log in to exe.dev with the same account, and connect as above. Add the page to your home screen to open it like an app. - **The Paseo app**, for [iOS or Android](https://paseo.sh/download). It can't sign in to exe.dev, so it goes through Paseo's [relay](https://paseo.sh/docs/security#relay-connections-recommended) instead: the daemon connects out to `relay.paseo.sh`, and the app meets it there, end-to-end encrypted. On your computer, turn the relay on and print a pairing QR code: ```bash ssh -t my-paseo.exe.xyz paseo daemon pair --relay ``` In the app, choose **Scan QR code**, scan it, confirm the host, and enter your password when it asks. The pairing link below the QR code works too, under **Paste pairing link**. The same pairing link connects the [desktop app](https://paseo.sh/download) from any computer.
Paseo on a phone: a finished task that wrote index.html, with the agent's summary and Worked for 9s
A finished task on a phone. The agent ran on the VM; the phone only steered it.
Start a task, lock your phone, and check back later: the work carries on without you. A few things worth knowing: - **Pick the agent and model** under **Select model**. Claude and Codex models run through exe.dev's [LLM integration](/docs/integrations-llm), and OpenCode lists the integration's models next to its own free ones. - **Permissions**: each agent has modes, from asking before every change to acting on its own. Claude starts in **Auto mode**; change it under **Select model**, or approve a waiting step on the VM with `paseo permit allow --all`. - **Talk instead of typing**: the microphone in the message box dictates, using the speech model on the VM. - **Run agents side by side**: choose **New worktree** under **Isolation** to give each one its own Git worktree. See Paseo's [parallel development guide](https://paseo.sh/docs/parallel-development). - **Preview what it builds**: ask the agent to serve the app on `0.0.0.0:8000`, then open `https://my-paseo.exe.xyz/`. It's private until you [share it](/docs/sharing). - **Bring your code**: [connect a GitHub repo](/docs/integrations-github), clone it on the VM, and add it with `paseo project create `. > [!WARNING] > Anyone with the password, through the relay or past exe.dev's login, can > run any command on the VM. Treat the password and pairing links like > keys, and keep port 6767 private. ## Back up and restore Commit and push your code; that's the copy that matters most. For a copy of the whole VM, run this on your computer (choose a free backup name): ```bash ssh exe.dev cp my-paseo my-paseo-backup ``` Paseo keeps its agents, projects, settings, password and relay keys in `~/.paseo`. To archive them on the VM, leaving out the speech model it can download again, stop the daemon for a moment. The archive holds your password and keys, so keep it private: ```bash mkdir -p ~/backups sudo systemctl stop paseo tar -C ~ -czf ~/backups/paseo-$(date +%F).tar.gz --exclude=.paseo/models --exclude='.paseo/daemon.log*' .paseo sudo systemctl start paseo chmod 600 ~/backups/paseo-*.tar.gz ``` To restore one, on a VM with Paseo installed as above, replace `2026-10-31` with the archive's date: ```bash sudo systemctl stop paseo rm -rf ~/.paseo tar -C ~ -xzf ~/backups/paseo-2026-10-31.tar.gz sudo systemctl start paseo paseo ls ``` Your agents are listed again, and paired phones reconnect with the same password. ## Update On the VM, install the newest release and restart the daemon; running agent turns are interrupted, so pick a quiet moment: ```bash sudo npm install -g @getpaseo/cli@latest sudo systemctl restart paseo paseo daemon status | grep daemonVersion ``` The web app comes with the daemon, so it updates too; the phone and desktop apps update from their stores. Update the agents with `sudo exeuntu update claude`, `sudo exeuntu update codex` and `sudo exeuntu update opencode`, then restart Paseo. ## Troubleshooting - **The page doesn't load.** On the VM, `systemctl status paseo` and `ss -ltn | grep 6767`: it should listen on `0.0.0.0:6767`. If not, `journalctl -u paseo -n 50` shows why, and `~/.paseo/daemon.log` has the details. - **The page loads but won't connect.** Check **Use SSL** is on, the port is `6767`, and the password matches `~/.paseo/paseo.env`. Paseo's web app loads before you sign in, by design; agents stay behind the password. - **The app says "Password required" after pairing.** Remove the host in **Settings → Connections** (under your host) and pair again with **Scan QR code** or **Paste pairing link**, which ask for the password. Opening the pairing link straight in a browser skips that question. - **An agent is missing or unavailable.** `paseo provider ls` lists what the daemon found. On the VM, `claude -p "Reply with exactly: OK"` and `codex exec "Reply with exactly: OK"` show whether the agents work on their own; rerun `exeuntu configure claude` or `exeuntu configure codex` if not, then `sudo systemctl restart paseo`. - **An agent sits at `permission`.** It's waiting for you. Approve it in the app, or on the VM with `paseo permit ls` and `paseo permit allow --all`. - **Changed the password?** Edit `~/.paseo/paseo.env`, run `sudo systemctl restart paseo`, and enter the new one on each device. For everything else, see Paseo's [docs](https://paseo.sh/docs) and [troubleshooting guide](https://paseo.sh/docs/troubleshooting). ## Frequently asked questions ### Does the Paseo phone app work with this? Yes, through Paseo's relay: run `paseo daemon pair --relay` on the VM, scan the QR code with the app and enter your Paseo password. The app can't open the private address on port 6767 because it can't sign in to exe.dev; your phone's browser can, and gets the same app. See [Add your phone](#add-your-phone). ### Is the relay safe? Paseo designed it to be untrusted: the daemon connects out to `relay.paseo.sh`, and traffic between it and your devices is end-to-end encrypted, so the relay sees only timing and sizes. The pairing link holds the daemon's public key, and the password travels inside the encrypted channel. The relay is [open source](https://github.com/getpaseo/paseo-relay), and Paseo's [security page](https://paseo.sh/docs/security) explains the design. ### Can I use my own Claude or ChatGPT subscription? Yes. On the VM, run `claude auth login` or `codex login`, after removing what `exeuntu configure` added: `apiKeyHelper` and `env.ANTHROPIC_BASE_URL` in `~/.claude/settings.json`, and the `exe-llm` provider in `~/.codex/config.toml`. Then run `sudo systemctl restart paseo`. Paseo uses whatever the agents' own command-line tools are signed in to. ### How much does it cost? Paseo is free and Apache-2.0 licensed, with no account. You pay for the VM as part of your exe.dev plan, and model usage through the [LLM integration](/docs/integrations-llm) is billed to your exe.dev account. exe.dev keeps a [list of models and prices](/llm-gateway-models). ### Do the agents keep working when I close the app? Yes. Agents run in the daemon on the VM, not on your phone, so you can lock it mid-task and open Paseo later to read the result, approve a step, or send the next message. ### Paseo or T3 Code? Both put coding agents on a server and give you web, desktop and phone apps for them. Paseo adds voice dictation, plugins, worktrees for parallel agents, and a relay that lets its phone app in without an account. [T3 Code](/deploy/t3code) installs as one binary with a ready-made service. Both can run on one VM, on different ports. ### Something's not working. Where do I look? On the VM, `systemctl status paseo` and `paseo daemon status` say whether the daemon runs and which agents it found; its log is `~/.paseo/daemon.log`. [Troubleshooting](#troubleshooting) covers the usual problems. ## Related - [Run T3 Code on a remote server](https://exe-staging.dev/deploy/t3code.md): Your coding agents on an always-on VM, steered from your phone. - [Run Claude Code on a remote server](https://exe-staging.dev/deploy/claude-code.md): A computer for Claude. A breather for your laptop. - [Run Codex on a remote server](https://exe-staging.dev/deploy/codex.md): A computer for Codex. An early night for your laptop. - [Run OpenCode on a remote server](https://exe-staging.dev/deploy/opencode.md): Every model, one VM, and an agent that works while your laptop sleeps. - [Host OpenClaw](https://exe-staging.dev/deploy/openclaw.md): An AI sidekick with its own computer. Your laptop can take a nap. - [Run Codex remote control on a server](https://exe-staging.dev/deploy/codex-remote-control.md): Codex on an always-on VM, steered from the ChatGPT app on your phone.