# Install the binary

[Download](/get#download) the Linux archive, or the Windows zip, and the release's `SHA256SUMS`.

## Verify the executable

Compare the archive's SHA-256 checksum with its line in `SHA256SUMS`, and stop if it differs:

```
sha256sum smeltr-linux.tar.gz
```

On Windows use `Get-FileHash -Algorithm SHA256 smeltr-windows.zip`. The archive holds the executable, the license and the third-party notices.

## Install the binary

The following commands target Linux with `useradd`. Create a dedicated service account once. If it already exists, use it. Keep the supplied executable name, version and checksum with your installation records.

```
sudo useradd --system --user-group --home-dir /var/lib/smeltr --no-create-home --shell /usr/sbin/nologin smeltr
sudo install -d -o root -g root -m 0755 /opt/smeltr
tar -xzf smeltr-linux.tar.gz
sudo install -o root -g root -m 0755 smeltr /opt/smeltr/smeltr
sudo install -d -o root -g smeltr -m 0750 /etc/smeltr
sudo install -d -o smeltr -g smeltr -m 0700 /var/lib/smeltr /etc/smeltr/secrets
```

Install Git using your operating system's package manager and confirm `git --version` succeeds. The leader uses `git http-backend` to serve configuration; workers have a built-in Git client. The executable includes the browser UI.

The **sealing key** encrypts secrets the leader stores. On a fresh installation, leave `/etc/smeltr/secrets/sealing.key` absent so Smeltr creates it. Back it up separately from the leader data and keep the matching copies for recovery.

## Standalone: first local start

Save this complete configuration as `smeltr.toml` in your current directory. It runs the leader and one worker in the same process, with the browser interface restricted to this machine.

```
[leader]
enabled = true

[leader.http]
bind = "127.0.0.1"
port = 4000
public_origin = "http://127.0.0.1:4000"

[leader.tls]
enabled = false

[leader.storage]
data_dir = "/var/lib/smeltr"

[leader.secrets]
key = "/etc/smeltr/secrets/sealing.key"

[worker]
enabled = true
group = "default"
```

The worker enrolls automatically and uses the local leader. Leave its enrollment code and leader URL unset. It stores its identity, credential and cached configuration in `/var/lib/smeltr/worker`. This HTTP setup is for local evaluation; use [HTTPS](/docs/https) for network access.

Install the configuration, then start Smeltr in the foreground as its service account:

```
sudo install -o root -g smeltr -m 0640 ./smeltr.toml /etc/smeltr/smeltr.toml
sudo -u smeltr env SMELTR_CONFIG_FILE=/etc/smeltr/smeltr.toml /opt/smeltr/smeltr
```

Keep this process running while you [sign in](/docs/first-login). Stopping it stops both the leader and worker. The absolute configuration and storage paths make startup independent of your working directory.

## Run as a systemd service

Stop any foreground evaluation process before starting the service. Install the configuration it runs: the local one above, or a network one from [HTTPS](/docs/https).

```
sudo install -o root -g smeltr -m 0640 ./smeltr.toml /etc/smeltr/smeltr.toml
```

The HTTPS configuration runs the leader only. To keep standalone mode, add the `[worker]` settings from the local example before installing it. Save this unit as `/etc/systemd/system/smeltr-leader.service`:

```
[Unit]
Description=Smeltr leader
Wants=network-online.target
After=network-online.target

[Service]
Type=simple
User=smeltr
Group=smeltr
StateDirectory=smeltr
StateDirectoryMode=0700
WorkingDirectory=/var/lib/smeltr
Environment=SMELTR_CONFIG_FILE=/etc/smeltr/smeltr.toml
ExecStart=/opt/smeltr/smeltr
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
UMask=0077
Restart=on-failure
RestartSec=5s

[Install]
WantedBy=multi-user.target
```

The service can bind port 443 while running as `smeltr`.

```
sudo systemctl daemon-reload
sudo systemctl enable --now smeltr-leader
sudo journalctl -u smeltr-leader -b
```

On first start, read the one-time administrator credentials in the service journal and complete the [first login](/docs/first-login). Restrict access to that journal as you would other credential-bearing console logs.

For another service manager, set the executable, absolute configuration path, working directory, service account and restart policy explicitly. Preserve the data, key and configuration across replacing the executable. Do not start a second leader against the same data.