Install HostSSH on any machine

HostSSH runs as a single lightweight agent on each Node — cloud VPS, bare metal, office Linux install, or GPU rental. Same join path everywhere; the control plane is egress-only. No public IP? The agent still joins (pull-only heartbeats). Inbound expose for home/office/CGNAT boxes uses a Cloudflare Tunnel — tunnel-first join. The signed public installer remains gated until its release mirror and end-to-end proof are live.

Current onboarding

Open Fleet → Add node. When the release mirror is verified, the panel displays the signed one-line installer. While that gate is closed, it directs you to assisted onboarding instead of showing a command that cannot be verified.

The verified installer will:

1. Detects your OS/arch and installs Docker if it isn't already present (needed for supported Docker workload capture and restore).
2. Downloads the hostssh binary to /usr/local/bin.
3. Activates your license against the control plane (a signed ed25519 handshake — your key never sits in shell history).
4. Installs and starts the hostssh-agent systemd service.
5. Registers the server in your fleet dashboard at hostssh.com.

What the license unlocks

Capability	What you get
Backup	Private-beta encrypted restic snapshots for supported workloads
Restore	Operator-verified restore from a supported snapshot
Clone	Private-beta restore to a staging target
Relocate	Private-beta move workflow with deterministic IP rewrite
Web-SSH	Browser shell with ephemeral, short-TTL keys — no open :22
Telemetry	Backup health, uptime, storage, restore-drills in the dashboard

Tiers gate server count, transfer modes, and provisioning — see Licensing.

After install

hostssh status              # health, license, last backup
hostssh capture             # capture supported workloads to configured restic storage
hostssh doctor              # verify host, agent and dependency readiness

The local admin panel is available on http://127.0.0.1:8765 (expose it safely through a Cloudflare Tunnel, never by opening a port).

Use it on your own infrastructure

The agent isn't only for managed customers — run it on every machine you own for portable, higher-security, redundant client-data management. The same image format and control plane manage them all.

Options

Flag / env	Default	Purpose
--license KEY / HOSTSSH_LICENSE	(prompt)	License key
--channel stable|beta / HOSTSSH_CHANNEL	stable	Release channel
HOSTSSH_API	https://api.hostssh.com	Control-plane endpoint (self-host friendly)
HOSTSSH_PORT	8765	Local admin panel bind port

Uninstall

systemctl disable --now hostssh-agent
rm -f /usr/local/bin/hostssh /etc/systemd/system/hostssh-agent.service
rm -rf /etc/hostssh

Your .hsi images in object storage are never touched by uninstall.

Status: the installer script ships in the repo at agent/install.sh, but the public release URL is intentionally withheld until the binary mirror, signature, activation, and clean-host journey pass together.