Single-link Ubuntu setup

Updated 22 October 2026 (Africa/Nairobi).

Owners/admins generate a private connection link in My Servers. The link opens /connect with its short-lived credential in the fragment, which is not sent in the HTTP request. The client reads it into memory and removes it from the address bar. It is not saved in local storage. Opening the link does not redeem it; the existing API pairing transaction enforces one-use redemption, the ten-minute deadline, workspace permissions and server allowances.

The dialog and link page supply one copyable Ubuntu command. The command downloads connect.sh over HTTPS and verifies its pinned checksum before executing it. That bootstrap selects amd64/arm64, downloads and verifies the installer and binary, passes the pairing credential through stdin, runs the installer and checks the service. The credential never enters a download URL, HTTP header, environment variable or external process argument. It is embedded in the command's shell-builtin input, so the command can remain in shell history; keep it private and remove it after use. Checksum pins come from the trusted control-plane release metadata; this is not a separate protection against a compromised control plane.

Docker access is unchecked by default and requires an existing Docker installation. It grants root-equivalent Docker socket access. The new default flow connects a monitoring agent; it does not silently install Docker, Caddy, BuildKit, a gateway or a deployment backend. See deployment prerequisites. Systemd, curl, supported Ubuntu LTS and administrative access are required. Existing private agent state is never overwritten by a connection-link installation.

Publish downloads

Run node scripts/build-agent.mjs with the pinned Go toolchain. On Windows, set GO_BINARY to the absolute go.exe path. The build normalizes shell assets to LF, disables VCS-dependent binary metadata and produces:

Legacy binaries/installer/checksum files in dist/agent.
An immutable content-derived release directory, such as 0.7.0-<12 hex characters>.
current.json containing the release ID, agent version and executable-file SHA-256 values.

Publish the immutable directory into /opt/ownserva/agent-releases on the VPS, verify its checksums, then atomically replace current.json last. Preserve older release directories while issued links may still use them. The production Compose file mounts this directory read-only at /agent-releases and sets AGENT_RELEASE_DIR. For host development, set AGENT_RELEASE_DIR to the absolute dist/agent directory.

The public metadata endpoint is /api/agent/releases/current. Versioned download routes allow only the manifest's supported file names and a bounded release-ID format; resolved filesystem paths must remain under the publication root. Metadata errors fail closed and prevent link generation. Downloads contain no account or workspace secrets. No database migration is needed; protocol version remains 0.7.0.

Acceptance

Verify generated-link fragments and expiry handling, clipboard fallbacks, default Docker opt-out, download allowlisting and path containment, checksum rejection before installation, server identity preservation and the default stdin credential flow. Verify actual pairing and a signed heartbeat against the deployed API, and revoke/remove temporary test resources. A successful script download or running process alone must not be reported as an online server.