Deploying agents
Agents are installed from single-file installers that your server builds on demand. Each installer carries your server's address and an enrolment token for one tenant, so the device joins the right tenant without anyone typing a URL or a password.
Download an installer
Installers come from three places:
| Where | Who | Notes |
|---|---|---|
| Tenant admin portal > Installer Studio | Tenant admins | Installers for Windows, Linux and macOS, plus enrolment token management |
| User portal > Get the Agent | Any user in the tenant | So staff can install the agent on their own machine |
| Global admin portal > Installer Studio | Your team | Pick the tenant, then the platform |
| Platform | File |
|---|---|
| Windows | A setup .exe. Signed with your Authenticode certificate if you uploaded one. |
| Linux | A .deb package that installs the agent and a systemd service. |
| macOS | A single binary that installs a launchd service. |
The installer is branded with the tenant's product name, or the platform name if the tenant has none.
Enrolment tokens
Every download mints a new enrolment token that is valid for 30 days and can enrol any number of devices in that tenant. The server stores only a hash of it.
To stop pending installs from enrolling, revoke the token under Installer Studio > Enrollment tokens. Devices that already enrolled keep working: each received its own device token when it enrolled and no longer needs the enrolment token.
A device is identified by its hostname within the tenant. If a machine with the same hostname enrols again, it takes over the existing device record and the old device token stops working.
Install on each platform
- Windows: run the setup program as administrator, then set the passphrase in the desktop app.
- macOS: run the binary with
sudo. - Linux: install the
.deb, then set the passphrase. - Proxmox VE: install the Linux agent on the host and add a Proxmox backup source.
Choose the backup passphrase
Every device needs a backup passphrase before it backs anything up. The agent derives the encryption key from it. Until a passphrase is set, the service runs but skips backups.
Decide before you roll out:
- One passphrase per device limits the damage if one leaks, but you have to store each one.
- One passphrase per tenant is easier to manage. Anyone who has it can decrypt any of that tenant's devices whose backups they can reach.
Whichever you choose, record each passphrase in your password manager when you set it. See Encryption and key recovery.
Check the device
Open the tenant admin portal > Agents. A new device appears as soon as it enrols, with its hostname, OS, IP, agent version and policy. It reports a heartbeat while it is online.
Then run your first backup.