What an operator does
The operator keeps the community’s station running. The station is an ordinary computer, often a Raspberry Pi, that holds the community’s ledger and is the one thing that writes to it. Phones talk to it over the local network. If it is down, members keep signing but nothing settles until it is back.
The job in one sentence: keep it running, keep it backed up, and keep the pairing ceremony honest.
What you need
| Thing | Details |
|---|---|
| A machine | Any always-on Linux or macOS box: a Raspberry Pi 4 or 5 with a 64-bit OS and 4 GB or more of RAM, a spare laptop, a mini-PC. |
| A network | A Wi-Fi network all members’ phones can join. Give the station a fixed address on it if you can. |
| The software | Built from source, once. Ten to thirty minutes. |
| Two safe places | For the passphrase and backups. A fireproof folder at home plus a sealed envelope with a trusted member. |
The pages
- Run a station: build, initialize, configure, run, survive reboots.
- Pair phones and wallets: the in-person ceremony that is the actual security boundary.
- Backups and key recovery: the fifteen minutes that save the community.
- Encrypted at rest: the seizure-resistant profile, Linux only, and the boot ceremony it costs.
- The courier desk: ingesting paper, printing receipts and cards.
- Radio and text message: the Reticulum sidecar, LoRa bring-up, and where SMS stops today.
- Keeping phones in sync: the per-vendor battery traps and the ten-minute drill.
- Troubleshooting: symptom, cause, fix.
The exact values every setting takes are in
Configuration. The source runbooks these
pages are drawn from live in the station repo and go into more detail:
Setting up a Railroad Network community,
Keeping phones in sync when the app is closed,
and Bringing up a LoRa radio link.
Honest warnings
- Research-stage software. No independent audit. Play stakes only.
- One station, one network. No federation and no relaying over the internet yet. Your community is one station plus the phones that can reach it.
- Phone traffic is plain HTTP, on purpose. Every message is encrypted and signed end to end, so the transport needs no TLS. The security ceremony that matters is the pairing-code comparison. Take it seriously.
- Android only, sideloaded. You hand members a signed installer file.
- The phone app is online-only for signing. Members with the app need the station reachable to send, confirm, vote, or contest. The offline outbox, certificates, and paper export ship today in the command-line wallet; plan your outage drill around laptops and paper.