Automated Setup
The setup script installs all dependencies, registers the server, and configures systemd services.
Interactive
The script prompts for the control plane URL, registration token, and node type.
Non-Interactive
What Gets Installed
All Nodes
- WireGuard — encrypted mesh networking
- Podman — container runtime
- BuildKit — container image builds
- Railpack — build plan generation
Proxy Nodes Only
- Traefik — reverse proxy and TLS termination
- CrowdSec — automated threat detection and IP banning
The script also enables IP forwarding and configures firewall rules for ports 80, 443, and 51820 (WireGuard).
Registration
Servers register with the control plane using a one-time token. Generate a token from the web UI, then pass it during the first run.
On registration, the agent:
- Generates an Ed25519 signing key pair and a WireGuard key pair.
- Sends its public keys and IP addresses to the control plane.
- Receives a server ID, WireGuard subnet, and encryption key.
- Saves configuration to
/var/lib/techulus-agent/config.json.
After registration, the token is invalidated. Subsequent runs do not require a token.
Manual Setup
Worker Node
Proxy Node
Install everything above, plus Traefik:
First Run
Worker node:
Proxy node:
Running as a Service
Worker Node
Create /etc/systemd/system/techulus-agent.service:
Proxy Node
Enable and start the service:
KillMode=process ensures only the agent process is stopped on restart, not the containers it manages.
The rootful Podman API socket at /run/podman/podman.sock is required for container metrics collection.
Troubleshooting
Agent restart kills containers
Ensure KillMode=process is set in the systemd service file.
Containers stuck in “created” state
This is normal after a restart. The agent detects drift and starts them automatically.
Checking agent logs
Inspecting containers