Install agents

Enroll Linux and Windows agents, check connectivity and understand signed worker updates.

Install agents

Put the runner in reach.

In your pilot organisation, create a limited-use, short-lived enrollment token in Agents & gateways. The portal shows the install command for your service with the token filled in; app.clm.mt below illustrates that URL. The installer downloads the agent from the service and refuses it unless its SHA-256 digest and release signature match, then enrolls it and starts it as a service.

Linux · systemd, sudo
read -rsp 'Enrollment token: ' CLM_ENROLL_TOKEN; echo
curl -fsSL https://app.clm.mt/install.sh |
  sudo env CLM_ENROLL_TOKEN="$CLM_ENROLL_TOKEN" bash
unset CLM_ENROLL_TOKEN

Linux needs systemd, curl, and OpenSSL 3 or Python 3 for the signature check. Add bash -s -- --download-only DIR to verify the agent without installing it. Use an assigned Windows agent for IIS or certificate-store work. macOS agents are not offered.

  • Keep identity and state directories private and persistent.
  • Confirm online status, agent version and advertised capabilities.
  • Worker updates use signed releases and startup-health rollback. Supervisor upgrades require a separate maintenance procedure.
  • Never run a first-install script over an existing enrolled identity.

Windows installation

Run the installer from elevated PowerShell. Windows Server 2022 amd64 is the validated version. It checks the agent the same way, creates the service and restricts the state directory to Administrators and SYSTEM.

Elevated PowerShell
$token = Read-Host 'Enrollment token' -AsSecureString
$env:CLM_ENROLL_TOKEN = [System.Net.NetworkCredential]::new('', $token).Password
irm https://app.clm.mt/install.ps1 | iex
Get-Service clm-agent

Windows Server 2022 amd64 certificate-store and IIS acceptance is recorded. IIS Central Certificate Store is refused. Exchange SE remains a limited single-server SMTP/IIS preview; check the integration limits before planning a rollout.

Review Windows validation limits →

Connectivity and updates

The agent initiates outbound HTTPS to the service; normal management does not require an inbound agent port. It also needs access to its configured CA, DNS APIs, resolvers and deployment targets. Preserve TLS validation and confirm any corporate proxy or private CA requirements with the operator.

Enrollment binds configuration and reports to the agent identity and assignments. Signed releases update the worker; failed startup restores the previous worker. The stable service supervisor has a separate maintenance procedure. Verify distribution and release trust with the operator before first installation.

Do not remove the identity or state directory to fix a temporary outage. Keep both persistent and private so pending reports and certificate state survive restart.