A headless Tor gateway and a KDE Plasma desktop whose only network path runs through Tor.
Download · Website · Source · Threat model · Design
om·bra /'om.brä/ · italian, noun / 1. shadow. / 2. this machine: everything it does online passes through tor. you were never here.
- Two machines, one way out: the desktop has one NIC whose only peer is the gateway
- Fail-closed: if Tor is down, the desktop has no network at all
- Amnesic or persistent: you choose at every boot; nothing starts on its own
- Encrypted at rest: LUKS2 (argon2id) and encrypted swap on the desktop
- Native arm64: built for Apple Silicon, no emulation
- No telemetry: no update checks, no phoning home, no exit IP shown or logged
| Ombra | Whonix | Tails | |
|---|---|---|---|
| 🖥️ Desktop | KDE Plasma, themed, mouse-first | LXQt | GNOME |
| 🐧 Base | Debian 13 (trixie) | Debian | Debian 13 (trixie) |
| 🍎 Apple Silicon | ✅ Yes, native arm64 | ❌ No, x86-64 only | |
| 🧠 Amnesic mode | ✅ Your choice at every boot | ✅ Always | |
| 🔐 Disk encryption | ✅ LUKS2 on the desktop disk, inside the VM | ❌ Not in its images; encrypt the host |
✅ yes,
| Path | How |
|---|---|
| Prebuilt VMs | Download both OVAs from ombra-os.org/install and import them into VMware Fusion |
| Build from source | curl -fsSL https://ombra-os.org/build.sh | bash |
| Repository | What it is |
|---|---|
| ombra | The operating system: installers, boot and unlock screens, both VMs |
Ombra is GPL-3.0-or-later. To report a vulnerability, use Security Advisories.
