install-agent.sh
Brings one more server into the fleet, verifies its checksum and enrolls it over mutual TLS.
curl -fsSL https://<deplo>/install-agent.sh | sudo bash -s -- <TOKEN> <URL> [FINGERPRINT]The three role flags below pick what the server is for, see Server roles for the full comparison.
Always take this command from the dashboard
The copy in the repository has placeholders that the running instance substitutes with the release's per-architecture URL and its checksum, and it refuses to run unsubstituted.
Requires
Root, systemd, curl and sha256sum, on linux/amd64 or arm64.
Docker is installed if missing, except for a migration source, which
needs the Docker it imports from. It refuses below 5 GB free on /,
recommends 30 GB, and checks nothing about memory or CPU.
Prop
Type
Prop
Type
Refuse unsubstituted placeholders
Refuses to run if the placeholders were not substituted.
Install Docker
Installs Docker if absent, and applies the address pools.
Pick the binary
Picks the binary by architecture, linux/amd64 or linux/arm64 only.
Verify the checksum
Verifies the SHA-256 and refuses to run an unverified binary.
Install the agent
Installs to /usr/local/bin/deplo-agent and creates /var/lib/deplo-agent
at 0700, deleting any existing certificate files so a reinstall
genuinely re-enrolls.
Install Traefik
Creates the deplo network and installs Traefik, unless one is running or
80 and 443 are taken.
Write bootstrap.env
Writes bootstrap.env at 0600, never on the command line.
Start the service
Writes the systemd unit at 0600 and starts it.
Check the firewall
Looks for a ufw or firewalld rule holding the agent port, and prints
the command to open it when one is missing. It never edits the
firewall itself, and it detects nothing else: a hand-written
nftables or iptables rule goes unnoticed.
The agent then calls home, sends a certificate signing request, and receives a signed certificate. The control plane never connects to your machine to set this up.
Logs: journalctl -u deplo-agent -f.
See also
Did this page help you?