Install the Wakora agent

The agent is a single static binary. There is nothing to configure at install time: the only thing you provide is your team key, which the console shows you when you add a host. The installer detects the platform, verifies the download, registers the host and sets up the service. About a minute later the host is in your console with its services already recognised.

One command

Linux

curl -fsSL https://get.wakora.io | bash -s -- --key <YOUR_TEAM_KEY>

The same line works on every supported distribution; the installer picks the amd64 or arm64 build and detects systemd, OpenRC or sysvinit. Platform notes: Debian and Ubuntu, RHEL family, SUSE, Alpine.

macOS

curl -fsSL https://get.wakora.io | bash -s -- --key <YOUR_TEAM_KEY>

Installs a launchd daemon on Intel and Apple Silicon. Details: macOS.

Windows

In PowerShell as Administrator:

$env:WAKORA_KEY = "<YOUR_TEAM_KEY>"
iwr -UseBasicParsing https://get.wakora.io/win | iex

Installs a Windows service. Details: Windows.

For clusters and container hosts see Kubernetes and Docker. For hundreds of hosts at once, see Fleet deployment.

What the installer does

1. Detects the operating system and CPU architecture and downloads the matching binary from get.wakora.io.
2. Verifies the SHA-256 checksum and the ed25519 signature of the binary. Hosts whose OpenSSL predates ed25519 support verify an ECDSA co-signature instead; the check never silently skips, and an unverifiable file is deleted, never installed.
3. Installs the binary to /usr/local/bin/wakora (Linux, macOS) or Program Files\Wakora (Windows).
4. Registers the host with your team key. The key is used once for that exchange and is never written to disk; the host receives its own identity and key instead.
5. Sets up the service so the agent survives reboots, and runs wakora doctor so the first thing you see is a checklist rather than silence.

The installer is short and fail-closed; read it before you pipe it if that is your policy (curl -fsSL https://get.wakora.io). The agent it installs is built from the public source at github.com/wakora-io/agent.

What happens in the first minute

The agent opens one outbound TLS connection to the Wakora endpoint on port 8443 and pins the server's public key. It sends a heartbeat every 30 seconds and host metrics every 60 seconds, enumerates processes, ports, packages, units and cron jobs, and receives the signed definitions that match what it found. Their probes start on the spot, so a web server shows its sites and a database its connections on the very first look at the host page. Nothing inbound is opened.

Verify it is running

wakora doctor

The checklist covers the binary, the service, disk space, the identity, DNS, the outbound connection, the certificate pin, the clock, authentication and whether data is being acknowledged. Each failing line names what to do next. If you installed the service before registering, that is fine too: the agent idles instead of crash-looping and starts the moment you run wakora --key.

Verifying the download yourself

The installer already checks the SHA-256 and the ed25519 signature before it writes anything. If you download the binary by hand, for an air-gapped install or for a security review, every asset carries the same two files next to it.

Pick the asset for your platform: wakora (Linux amd64), wakora-linux-arm64, wakora.exe, wakora-windows-arm64.exe, wakora-darwin-amd64, wakora-darwin-arm64. Each one has a .sha256 and a .sig beside it, and the signed manifest.json lists all of them with their hashes.

curl -fsSL https://get.wakora.io/bin/wakora -o wakora
curl -fsSL https://get.wakora.io/bin/wakora.sha256 -o wakora.sha256
curl -fsSL https://get.wakora.io/bin/wakora.sig -o wakora.sig
curl -fsSL https://www.wakora.io/trust/files/wakora-publisher.pem -o wakora-publisher.pem

The checksum file holds a bare hash with no filename, so compare it rather than piping it into sha256sum -c:

[ "$(cat wakora.sha256)" = "$(sha256sum wakora | cut -d' ' -f1)" ] && echo "checksum ok"

The signature is stored base64-encoded and OpenSSL wants the raw 64 bytes, so decode it first. Skipping this step makes a genuine binary look tampered with:

base64 -d wakora.sig > wakora.sig.raw
openssl pkeyutl -verify -pubin -inkey wakora-publisher.pem -rawin -in wakora -sigfile wakora.sig.raw

A good download answers Signature Verified Successfully. Anything else means the file is not the one we published, and you should not run it.

openssl pkeyutl -rawin needs OpenSSL 3. On older systems (Ubuntu 20.04, Debian 10) verify the checksum by hand and run the installer, which falls back to a second signature those versions can read.

The channel also publishes https://get.wakora.io/bin/manifest.json and its detached manifest.json.sig, signed by the same key. The manifest names every asset with its hash and records the exact build inputs, which is what you need to reproduce the binary from source. Past releases stay reachable under their version, for example https://get.wakora.io/bin/r316/wakora.

Supported platforms

OS	Architectures	Service manager
Linux	amd64, arm64	systemd, OpenRC, sysvinit
Windows	amd64, arm64	Windows service
macOS	amd64, arm64	launchd

Everything the agent monitors on top of these platforms is in Supported technologies. To remove the agent later, see Uninstall.