Install the binary

Download the Linux archive, or the Windows zip, and the release's SHA256SUMS.

Verify the executable

Compare the archive's SHA-256 checksum with its line in SHA256SUMS, and stop if it differs:

sha256sum smeltr-linux.tar.gz

On Windows use Get-FileHash -Algorithm SHA256 smeltr-windows.zip. The archive holds the executable, the license and the third-party notices.

Install the binary

The following commands target Linux with useradd. Create a dedicated service account once. If it already exists, use it. Keep the supplied executable name, version and checksum with your installation records.

sudo useradd --system --user-group --home-dir /var/lib/smeltr --no-create-home --shell /usr/sbin/nologin smeltr
sudo install -d -o root -g root -m 0755 /opt/smeltr
tar -xzf smeltr-linux.tar.gz
sudo install -o root -g root -m 0755 smeltr /opt/smeltr/smeltr
sudo install -d -o root -g smeltr -m 0750 /etc/smeltr
sudo install -d -o smeltr -g smeltr -m 0700 /var/lib/smeltr /etc/smeltr/secrets

Install Git using your operating system's package manager and confirm git --version succeeds. The leader uses git http-backend to serve configuration; workers have a built-in Git client. The executable includes the browser UI.

The sealing key encrypts secrets the leader stores. On a fresh installation, leave /etc/smeltr/secrets/sealing.key absent so Smeltr creates it. Back it up separately from the leader data and keep the matching copies for recovery.

Standalone: first local start

Save this complete configuration as smeltr.toml in your current directory. It runs the leader and one worker in the same process, with the browser interface restricted to this machine.

[leader]
enabled = true

[leader.http]
bind = "127.0.0.1"
port = 4000
public_origin = "http://127.0.0.1:4000"

[leader.tls]
enabled = false

[leader.storage]
data_dir = "/var/lib/smeltr"

[leader.secrets]
key = "/etc/smeltr/secrets/sealing.key"

[worker]
enabled = true
group = "default"

The worker enrolls automatically and uses the local leader. Leave its enrollment code and leader URL unset. It stores its identity, credential and cached configuration in /var/lib/smeltr/worker. This HTTP setup is for local evaluation; use HTTPS for network access.

Install the configuration, then start Smeltr in the foreground as its service account:

sudo install -o root -g smeltr -m 0640 ./smeltr.toml /etc/smeltr/smeltr.toml
sudo -u smeltr env SMELTR_CONFIG_FILE=/etc/smeltr/smeltr.toml /opt/smeltr/smeltr

Keep this process running while you sign in. Stopping it stops both the leader and worker. The absolute configuration and storage paths make startup independent of your working directory.

Run as a systemd service

Stop any foreground evaluation process before starting the service. Install the configuration it runs: the local one above, or a network one from HTTPS.

sudo install -o root -g smeltr -m 0640 ./smeltr.toml /etc/smeltr/smeltr.toml

The HTTPS configuration runs the leader only. To keep standalone mode, add the [worker] settings from the local example before installing it. Save this unit as /etc/systemd/system/smeltr-leader.service:

[Unit]
Description=Smeltr leader
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=smeltr
Group=smeltr
StateDirectory=smeltr
StateDirectoryMode=0700
WorkingDirectory=/var/lib/smeltr
Environment=SMELTR_CONFIG_FILE=/etc/smeltr/smeltr.toml
ExecStart=/opt/smeltr/smeltr
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
UMask=0077
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target

The service can bind port 443 while running as smeltr.

sudo systemctl daemon-reload
sudo systemctl enable --now smeltr-leader
sudo journalctl -u smeltr-leader -b

On first start, read the one-time administrator credentials in the service journal and complete the first login. Restrict access to that journal as you would other credential-bearing console logs.

For another service manager, set the executable, absolute configuration path, working directory, service account and restart policy explicitly. Preserve the data, key and configuration across replacing the executable. Do not start a second leader against the same data.