Unattended install

How it works

The install command needs no terminal. Anything that can run a shell command as root on a new server can run it: cloud-init user data, a provider's startup script, a configuration tool. The script is the one every customer runs; it verifies the release by SHA-256 and an Ed25519 signature before anything is installed, and it is written to be read first (see Install).

The token

• Create it in the dashboard: Add server. Give the server a name and choose its protection mode (Automatic or Awaiting Approval); the mode travels with the token.
• One token enrols one server and is valid for 72 hours. A token that has enrolled its server is spent; a leaked spent or expired token is worth nothing.
• There is no API that creates tokens: the public API is read-only. For several servers, create several tokens.
• The server needs root, systemd, x86_64, OpenSSL 3 or later and outbound HTTPS to secai.techsteps.ae. Nothing inbound is opened.

cloud-init

User data is kept by the provider and readable by root on the instance, so put a token in it only for a server you are creating now.

#cloud-config
runcmd:
  - [ sh, -c, "curl -fsSL 'https://secai.techsteps.ae/agent/install.sh?token=<token>' | bash" ]

Provider startup script

Vultr, DigitalOcean, Hetzner and most others run a script once on first boot. Wait for the network before fetching the installer.

#!/bin/bash
for i in $(seq 1 30); do
  curl -fsS https://secai.techsteps.ae/health >/dev/null 2>&1 && break
  sleep 5
done
curl -fsSL "https://secai.techsteps.ae/agent/install.sh?token=<token>" | bash

Ansible

- name: Install the SecAI agent
  ansible.builtin.shell: curl -fsSL "https://secai.techsteps.ae/agent/install.sh?token={{ secai_token }}" | bash
  args:
    creates: /usr/local/bin/security-agent
  become: true

Terraform

variable "secai_token" { sensitive = true }

resource "..." "server" {
  user_data = <<-EOT
    #cloud-config
    runcmd:
      - [ sh, -c, "curl -fsSL 'https://secai.techsteps.ae/agent/install.sh?token=${var.secai_token}' | bash" ]
  EOT
}

Checking it worked

• systemctl is-active secai-agent prints active.
• The server appears in the dashboard within about a minute, under the name you gave the token.
• If the script stopped, its last lines say why: an unsupported CPU, OpenSSL older than 3, a download that did not verify, or an expired token. journalctl -u secai-agent has the agent's own log.

Control panels

Plesk has its own extension, SecAI Security, which runs the free assessment and installs the agent from the panel without a terminal.