Skip to main content

Automated Setup

The setup script installs all dependencies, registers the server, and configures systemd services.

Interactive

The script prompts for the control plane URL, registration token, and node type.

Non-Interactive

What Gets Installed

All Nodes

  • WireGuard — encrypted mesh networking
  • Podman — container runtime
  • BuildKit — container image builds
  • Railpack — build plan generation

Proxy Nodes Only

  • Traefik — reverse proxy and TLS termination
  • CrowdSec — automated threat detection and IP banning
The script also enables IP forwarding and configures firewall rules for ports 80, 443, and 51820 (WireGuard).

Registration

Servers register with the control plane using a one-time token. Generate a token from the web UI, then pass it during the first run. On registration, the agent:
  1. Generates an Ed25519 signing key pair and a WireGuard key pair.
  2. Sends its public keys and IP addresses to the control plane.
  3. Receives a server ID, WireGuard subnet, and encryption key.
  4. Saves configuration to /var/lib/techulus-agent/config.json.
After registration, the token is invalidated. Subsequent runs do not require a token.

Manual Setup

Worker Node

Proxy Node

Install everything above, plus Traefik:

First Run

Worker node:
Proxy node:

Running as a Service

Worker Node

Create /etc/systemd/system/techulus-agent.service:

Proxy Node

Enable and start the service:
KillMode=process ensures only the agent process is stopped on restart, not the containers it manages. The rootful Podman API socket at /run/podman/podman.sock is required for container metrics collection.

Troubleshooting

Agent restart kills containers

Ensure KillMode=process is set in the systemd service file.

Containers stuck in “created” state

This is normal after a restart. The agent detects drift and starts them automatically.

Checking agent logs

Inspecting containers