install.ledgerworks.systems

Linux endpoint federation-join bootstrap distribution (per LINUX_CONNECTOR_v1).

One-line install

curl -fsSL https://install.ledgerworks.systems/linux | sudo bash

Prompts for endpoint identifier, federation OAuth token, and federation DSN. Generates an Ed25519 keypair, installs systemd connector units, runs the 11-phase join, and enables the 5-min heartbeat timer.

What it does

Detect distro (Ubuntu / Debian / Rocky / RHEL / AlmaLinux / Arch / Alpine).
Install OS packages (python3 venv + psycopg2 + git + jq + ssh-keygen).
Generate per-endpoint Ed25519 signing key (mode 600; /opt/_secrets/<endpoint_id>/).
Deposit federation OAuth credentials.
Fetch + SHA-256-verify the connector tarball.
Install connector.service + connector.timer systemd units.
Run connector.py first join (phases 6-10: federation.lookup INSERT, federation.machines UPSERT, doctrine #3 detector registration, signed first heartbeat, telemetry verify).
Enable connector.timer for ongoing 5-min heartbeat.

Fail-closed guarantees

Any phase failure → endpoint stays pre_operational; connector.timer NEVER enabled.
Tarball SHA-256 mismatch → refuse; manual investigation required.
OAuth token NEVER bundled in linux; founder provides at install time.
Re-running is idempotent — completes missing phases; no-ops on fully-bootstrapped hosts.

Artifacts

/linux — bootstrap.sh (current)
/linux.sha256 — SHA-256 of bootstrap.sh
/linux.sig — Ed25519 signature (ssh-keygen -Y)
/manifest.json — version + federation_tick + git_sha + signing fingerprint

Versioned replay

Every publish appends a new version. Previous versions accessible at /v/<version>/linux (per feedback_no_destroy_doctrine).

Doctrine: LINUX_CONNECTOR_v1 + linux_endpoint_federation_join.md + feedback_solution_must_match_intent + feedback_no_preemptive_examples. Maintained at /opt/ledgerworks/scripts/linux_connector/install_publish/.