Triton Manage Server Installer

Production installer for the Triton Manage Server. Container-based (Docker or Podman), idempotent — safe to re-run.

Setup wizard

After install, open http://localhost:8082 and complete the wizard:

1. Set your manage server name
2. Create the admin account
3. Upload your licence (.lic file from your vendor bundle)

The vendor's public key is baked into the image at build time, so the .lic file is the only artefact you need from your vendor.

---

Linux

Install

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash

Optional flags

Pass flags after --:

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- [flags]

Flag	Description
--gateway-hostname HOST	Agent mTLS hostname (defaults to current FQDN).
--manage-host-ip IP	Host LAN IP for "+ This machine" auto-registration.
--image TAG	Pin a specific image tag (e.g. 1.0.0-rc.2).
--license-pubkey HEX	Hex-encoded Ed25519 verifier key. Only needed when not baked into the image.
--no-tls	Skip TLS sanity check (dev only).

Upgrade

Pull the latest image and restart (keeps all data, runs DB migrations automatically):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- --upgrade

Pin a specific version:

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- --upgrade --image forgejo.primatekun.tech/primatekuntech/triton-manage-server:1.2.0

Uninstall

Stop containers and remove them, but keep all data (PostgreSQL volume, credentials vault):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- --uninstall

Also delete all data (irreversible):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- --uninstall --purge-data

---

macOS

Requirements: macOS 13 (Ventura) or later, Intel or Apple Silicon. Docker Desktop or Podman Desktop already installed, or Homebrew — the installer will install Podman automatically via brew if no runtime is found.

Do not use sudo. The installer runs as your normal user.

Install

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash

Installer files are saved to ~/.local/share/triton-manageserver.

Optional flags

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- [flags]

Flag	Description
--gateway-hostname HOST	Agent mTLS hostname (defaults to current FQDN).
--manage-host-ip IP	Host LAN IP for "+ This machine" auto-registration.
--image TAG	Pin a specific image tag (e.g. 1.0.0-rc.2).
--license-pubkey HEX	Hex-encoded Ed25519 verifier key. Only needed when not baked into the image.
--no-tls	Skip TLS sanity check (dev only).

Upgrade

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- --upgrade

Pin a specific version:

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- --upgrade --image forgejo.primatekun.tech/primatekuntech/triton-manage-server:1.2.0

Uninstall

Keep data:

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- --uninstall

Also delete all data (irreversible):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- --uninstall --purge-data

---

Windows (10 build 19041+ / 11)

Requirements: Run PowerShell as Administrator. Windows 10 May 2020 Update (build 19041) or Windows 11. A container runtime (Docker Desktop or Podman Desktop) already installed, or internet access — the installer will install Docker Desktop automatically via winget (a pre-existing Podman install is also detected and used — see below).

If WSL2 is not yet enabled on your machine, the installer enables it and asks you to reboot. Run the same command again after the reboot.

Install

Open PowerShell as Administrator and run:

irm https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1 | iex

Optional flags (Windows)

Each command is a self-contained one-liner — copy and paste directly into PowerShell:

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) -GatewayHostname manage.example.com
& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) -ManageHostIP 10.0.0.5
& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) -Image forgejo.primatekun.tech/primatekuntech/triton-manage-server:1.2.0
& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) -NoTls

Flag	Description
-GatewayHostname HOST	Agent mTLS hostname (defaults to current FQDN).
-ManageHostIP IP	Host LAN IP for "+ This machine" auto-registration.
-Image TAG	Pin a specific image tag (e.g. 1.0.0-rc.2).
-LicensePubkey HEX	Hex-encoded Ed25519 verifier key.
-NoTls	Skip TLS sanity check (dev only).

Upgrade (Windows)

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) --upgrade

Pin a specific version:

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) --upgrade --image forgejo.primatekun.tech/primatekuntech/triton-manage-server:1.2.0

Uninstall (Windows)

Keep data (PostgreSQL volume, credentials vault):

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) --uninstall

Also delete all data (irreversible):

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) --uninstall --purge-data

---

Host-bound licences

Your vendor can issue an offline .lic file that is cryptographically bound to a specific host so it cannot be used on any other machine.

To get a host-bound licence:

1. Run the installer on the target server. At the end of the output you will see the Machine ID:

   [manage-server] Machine ID (for offline / air-gap licence binding):
   [manage-server]   <32-hex-chars>
   

   The same value is also shown in the setup wizard's licence-upload step.
2. Share the value with your vendor.
3. The vendor enters it in the License Portal when generating the offline .lic token.
4. Upload the new .lic file via the setup wizard (or, if already past wizard, in the admin UI under Settings → Licence). The Manage Server verifies the binding at every startup.

The Machine ID is stable:

Platform	Source
Linux	SHA-3-256 hash of /etc/machine-id (written once at OS install, never changes)
macOS	IOKit hardware UUID (tied to the logic board, survives OS reinstalls)
Windows	Registry MachineGuid (set at Windows install)

Container restarts, image upgrades, and re-running the installer always produce the same value.

---

Requirements

	Linux	macOS	Windows
Architecture	amd64, arm64	amd64 (Intel), arm64 (Apple Silicon)	amd64, arm64
OS version	Any modern distro	macOS 13 (Ventura)+	Windows 10 build 19041+ / 11
Container runtime	Docker or Podman + Compose (auto-installed)	Docker Desktop, Podman Desktop, or Homebrew Podman (auto-installed)	Docker Desktop or Podman Desktop (auto-installed via winget)
Run as	root / sudo	normal user (no sudo)	Administrator

---

Agent installation

agent/get.sh and agent/get.ps1 install the triton-agent daemon — a separate product from the Manage Server installer above. It runs on each host you want scanned, not on the Manage Server host.

Full walkthrough — enrolling the host in the Manage Portal, transferring the bundle, installing, verifying, upgrading, and uninstalling on Linux/macOS/Windows/FreeBSD — is in agent/README.md. Common troubleshooting questions (IP changes, service management, log locations, missing scanner binary) are in agent/FAQ.md.

Quick reference, once you already have an enrollment bundle from the Manage Portal (Hosts → Agents → Enrol agent):

Linux / macOS (requires sudo):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/agent/get.sh \
  | sudo bash -s -- --bundle ./triton-agent-<hostname>.tar.gz

Windows (requires Administrator):

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/agent/get.ps1'))) --bundle '.\triton-agent-<hostname>.tar.gz'

Air-gapped agent install

For hosts with no internet access at all — see agent/README.md § Air-gapped install. agent/get-airgap.sh and agent/get-airgap.ps1 in this repo are reference copies only — they are embedded directly into the agent enrollment bundle by the Manage Server (pkg/manageserver/ca/bundle.go in the triton repo) and are never fetched from this repo. They're kept here so operators can audit the script before trusting a bundle. The source of truth is pkg/manageserver/ca/assets/ in the triton repo.