Install the agent
One command on the host. It downloads the agent, verifies it, writes its configuration and waits for you to approve the code it shows.
curl -fsSL https://silentfailure.app/install | sudo sh -s -- --enroll-token TOKENThe line comes ready with your token in the dashboard, under Settings → Hosts & enrollment. The script detects the architecture and the package manager, so there is nothing to choose.
Three anchors, and they must agree
Piping a script to root deserves more than TLS. These are the three independent things that have to line up before anything is installed.
| ANCHOR | WHERE IT COMES FROM | WHAT IT CATCHES |
|---|---|---|
| sha256 in the script | Committed to git in the release manifest, generated into the script itself | A package swapped on the server |
| The files on the server | Published with rsync over SSH, verified in place | A manifest edited after the fact |
| A minisign signature | Signed on the build machine; the public key comes from the server environment | Anyone who holds the server or the repository but not the key |
The checksum is written into the script, so it arrives in the same TLS response as the code that uses it. Fetched separately, the file and its checksum could be replaced together, and the verification would be a ceremony.
Refuse to install without a signature
apt-get install -y minisign
curl -fsSL https://silentfailure.app/install | sudo sh -s -- --enroll-token TOKEN --require-signatureWithout minisign installed, the script verifies on sha256 alone — and it says so rather than staying quiet about it. --require-signature turns that into a refusal instead.
The script cannot verify itself
Neither can any other installer of this shape: the checksum would have to arrive through the channel you are trying to verify. The trust here is TLS. The way around it is to read the script first — it is a few hundred lines of POSIX shell, and it is generated, so what you read is what runs.
curl -fsSL https://silentfailure.app/install | lessThen approve it
The agent shows a code and waits. In the dashboard you see the hostname, operating system, kernel and the address it came from — check them against the machine you just installed on, and approve. The agent collects its token within seconds, and the token is stored only as a hash on our side.