Triton Manage Server Installer

Production installer for the Triton Manage Server. Container-based (Docker or Podman), idempotent — safe to re-run.

Setup wizard

After install, open http://localhost:8082 and complete the wizard:

1. Set your manage server name
2. Create the admin account
3. Upload your licence (.lic file from your vendor bundle)

The vendor's public key is baked into the image at build time, so the .lic file is the only artefact you need from your vendor.

---

Linux

Install

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash

Optional flags

Pass flags after --:

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- [flags]

Flag	Description
--gateway-hostname HOST	Agent mTLS hostname (defaults to current FQDN).
--manage-host-ip IP	Host LAN IP for "+ This machine" auto-registration.
--image TAG	Pin a specific image tag (e.g. 1.0.0-rc.2).
--license-pubkey HEX	Hex-encoded Ed25519 verifier key. Only needed when not baked into the image.
--no-tls	Skip TLS sanity check (dev only).

Upgrade

Pull the latest image and restart (keeps all data, runs DB migrations automatically):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- --upgrade

Pin a specific version:

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- --upgrade --image forgejo.primatekun.tech/primatekuntech/triton-manage-server:1.2.0

Uninstall

Stop containers and remove them, but keep all data (PostgreSQL volume, credentials vault):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- --uninstall

Also delete all data (irreversible):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | sudo bash -s -- --uninstall --purge-data

---

macOS

Requirements: macOS 13 (Ventura) or later, Intel or Apple Silicon. Docker Desktop or Podman Desktop already installed, or Homebrew — the installer will install Podman automatically via brew if no runtime is found.

Do not use sudo. The installer runs as your normal user.

Install

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash

Installer files are saved to ~/.local/share/triton-manageserver.

Optional flags

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- [flags]

Flag	Description
--gateway-hostname HOST	Agent mTLS hostname (defaults to current FQDN).
--manage-host-ip IP	Host LAN IP for "+ This machine" auto-registration.
--image TAG	Pin a specific image tag (e.g. 1.0.0-rc.2).
--license-pubkey HEX	Hex-encoded Ed25519 verifier key. Only needed when not baked into the image.
--no-tls	Skip TLS sanity check (dev only).

Upgrade

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- --upgrade

Pin a specific version:

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- --upgrade --image forgejo.primatekun.tech/primatekuntech/triton-manage-server:1.2.0

Uninstall

Keep data:

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- --uninstall

Also delete all data (irreversible):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.sh | bash -s -- --uninstall --purge-data

---

Windows (10 build 19041+ / 11)

Requirements: Run PowerShell as Administrator. Windows 10 May 2020 Update (build 19041) or Windows 11. A container runtime (Docker Desktop or Podman Desktop) already installed, or internet access — the installer will install Podman automatically via winget.

If WSL2 is not yet enabled on your machine, the installer enables it and asks you to reboot. Run the same command again after the reboot.

Install

Open PowerShell as Administrator and run:

irm https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1 | iex

Optional flags (Windows)

Each command is a self-contained one-liner — copy and paste directly into PowerShell:

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) -GatewayHostname manage.example.com
& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) -ManageHostIP 10.0.0.5
& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) -Image forgejo.primatekun.tech/primatekuntech/triton-manage-server:1.2.0
& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) -NoTls

Flag	Description
-GatewayHostname HOST	Agent mTLS hostname (defaults to current FQDN).
-ManageHostIP IP	Host LAN IP for "+ This machine" auto-registration.
-Image TAG	Pin a specific image tag (e.g. 1.0.0-rc.2).
-LicensePubkey HEX	Hex-encoded Ed25519 verifier key.
-NoTls	Skip TLS sanity check (dev only).

Upgrade (Windows)

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) --upgrade

Pin a specific version:

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) --upgrade --image forgejo.primatekun.tech/primatekuntech/triton-manage-server:1.2.0

Uninstall (Windows)

Keep data (PostgreSQL volume, credentials vault):

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) --uninstall

Also delete all data (irreversible):

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/get.ps1'))) --uninstall --purge-data

---

Host-bound licences

Your vendor can issue an offline .lic file that is cryptographically bound to a specific host so it cannot be used on any other machine.

To get a host-bound licence:

1. Run the installer on the target server. At the end of the output you will see the Machine ID:

   [manage-server] Machine ID (for offline / air-gap licence binding):
   [manage-server]   <32-hex-chars>
   

   The same value is also shown in the setup wizard's licence-upload step.
2. Share the value with your vendor.
3. The vendor enters it in the License Portal when generating the offline .lic token.
4. Upload the new .lic file via the setup wizard (or, if already past wizard, in the admin UI under Settings → Licence). The Manage Server verifies the binding at every startup.

The Machine ID is stable:

Platform	Source
Linux	SHA-3-256 hash of /etc/machine-id (written once at OS install, never changes)
macOS	IOKit hardware UUID (tied to the logic board, survives OS reinstalls)
Windows	Registry MachineGuid (set at Windows install)

Container restarts, image upgrades, and re-running the installer always produce the same value.

---

Requirements

	Linux	macOS	Windows
Architecture	amd64, arm64	amd64 (Intel), arm64 (Apple Silicon)	amd64, arm64
OS version	Any modern distro	macOS 13 (Ventura)+	Windows 10 build 19041+ / 11
Container runtime	Docker or Podman + Compose (auto-installed)	Docker Desktop, Podman Desktop, or Homebrew Podman (auto-installed)	Docker Desktop or Podman Desktop (auto-installed via winget)
Run as	root / sudo	normal user (no sudo)	Administrator

---

Agent installation

agent/get.sh and agent/get.ps1 install the triton-agent daemon — a separate product from the Manage Server installer above. It runs on each host you want scanned, not on the Manage Server host. Full walkthrough (enrolling the host in the Manage Portal, generating the bundle, verifying the service) is in AGENT_ENROLLMENT.md in the main triton repo; this section covers just the installer's own prerequisites and connectivity requirements.

Prerequisites

	Linux / macOS	Windows
Run as	root / sudo	Administrator (elevated PowerShell)
Shell version	—	PowerShell 5.1+
OS version	Any modern distro / macOS 13+	Windows 10 1803+ / Server 2019+ for full pre-flight diagnostics (older builds silently skip the connectivity check — see AGENT_ENROLLMENT.md § Prerequisites)
Enrollment bundle	A .tar.gz bundle downloaded from the Manage Portal (Agents → Enrol Agent) — required before running either installer

Required outbound connectivity

The agent connects outbound only — no inbound ports need to be opened on the agent host.

Port	Purpose
8443	mTLS gateway — heartbeat, scan results, command polling. Required for the agent to run at all.
8082	Binary downloads during install/upgrade only.

Both are configurable on the Manage Server side (TRITON_MANAGE_GATEWAY_LISTEN, TRITON_MANAGE_LISTEN) — verify against the deployment's actual values before opening firewall rules. On Windows, if outbound traffic is restricted by policy, see AGENT_ENROLLMENT.md § Windows Firewall for a New-NetFirewallRule example.

Install

Linux / macOS (requires sudo):

curl -fsSL https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/agent/get.sh \
  | sudo bash -s -- --bundle ./agent-XXXX.tar.gz

Windows (requires Administrator):

& ([scriptblock]::Create((irm 'https://forgejo.primatekun.tech/primatekuntech/triton-install/raw/branch/main/agent/get.ps1'))) --bundle '.\agent-XXXX.tar.gz'

Add --check after --bundle ... on either platform to run the connectivity pre-flight test without installing anything — see AGENT_ENROLLMENT.md for the full flag reference, upgrade/uninstall commands, and what gets installed where on each platform.