Manual install

The end state is a working restorable service under a dedicated system user, the same as the packaged install. You do each step yourself; nothing magical happens.

Before you start

Pick this path only if your distro is outside the launch matrix. Fedora, SUSE / openSUSE, Alpine, Arch, and older enterprise Linux (RHEL/Rocky/Alma 8) fit here; modern Ubuntu / Debian / RHEL 9 family all have a supported package and do not need this page.

0. Install prerequisites

Container runtime (Podman or Docker)

The agent needs a container runtime to spawn scratch DBs and run dump tools. Podman (rootless) is preferred; Docker is supported for customers already standardised on it.

sudo $(command -v dnf || command -v apk || command -v pacman || echo apt-get) install podman

No daemon, no service to enable. Rootless Podman runs under the restorable user created in a later step.

minisign

minisign is how this path verifies the raw binary. Install from your distro (Fedora / Arch / openSUSE package it directly), or download the static tarball from jedisct1/minisign.

1. Download and verify the binary

The raw binary and its signature live at https://get.restorable.app/$VERSION/. The release public key is at https://get.restorable.app/pub/restorable-release.pub.

VERSION=v0.4.0
ARCH=linux-amd64  # or linux-arm64
BASE=https://get.restorable.app

curl -fsSL $BASE/pub/restorable-release.pub -o restorable-release.pub
curl -fsSL $BASE/$VERSION/restorable-$ARCH         -o restorable
curl -fsSL $BASE/$VERSION/restorable-$ARCH.minisig -o restorable.minisig

minisign -Vm restorable -p restorable-release.pub

Signature and comment signature verified means the binary was signed with the offline release key. Refuse to proceed on any other output.

Cross-check the public key fingerprint against the copy on the trust page and our pinned social announcement. Three independent channels mean a compromised intermediate would need to have tampered with all three to swap the key unnoticed.

2. Create the system user

sudo groupadd --system restorable
sudo useradd --system --gid restorable \
             --home-dir /var/lib/restorable \
             --shell /usr/sbin/nologin \
             --comment "Restorable backup agent" \
             restorable

3. Install the binary and the install root

sudo install -o root -g root -m 0755 restorable /usr/local/bin/restorable
sudo install -d -o restorable -g restorable -m 0700 /var/lib/restorable

/var/lib/restorable is the agent's install root: config.yaml, keys/, blobs/, receipts/, events/ all live underneath it.

Note: manual installs go in /usr/local/bin, not /usr/bin. That follows FHS (admin-installed software lives under /usr/local; packaged software lives under /usr). If you later switch to the packaged install, the new binary at /usr/bin replaces this one; delete the admin-path copy to avoid PATH confusion.

4. Write a placeholder config and env file

sudo -u restorable tee /var/lib/restorable/config.yaml >/dev/null <<'EOF'
# /var/lib/restorable/config.yaml
# restorable init rewrites this file with real values.
EOF
sudo chmod 0660 /var/lib/restorable/config.yaml

sudo -u restorable tee /var/lib/restorable/env >/dev/null <<'EOF'
# Environment file loaded by the systemd unit. KEY=value per line.
# RESTORABLE_DB_URI=postgres://backup_user:***@db.internal:5432/prod
EOF
sudo chmod 0660 /var/lib/restorable/env

5. Install the systemd unit

sudo tee /etc/systemd/system/restorable.service >/dev/null <<'EOF'
[Unit]
Description=Restorable agent
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=restorable
Group=restorable
Environment=RESTORABLE_HOME=/var/lib/restorable
EnvironmentFile=/var/lib/restorable/env
ExecStart=/bin/sh -c 'export XDG_RUNTIME_DIR=/run/user/$$(id -u) && exec /usr/local/bin/restorable serve'
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=10s
ProtectSystem=strict
ReadWritePaths=/var/lib/restorable
PrivateTmp=true
SystemCallArchitectures=native
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload

6. Attach and start

Mint an auth key in the dashboard (Add machine), then:

sudo -u restorable RESTORABLE_HOME=/var/lib/restorable \
  /usr/local/bin/restorable init \
  --orchestrator https://app.restorable.app \
  --auth-key=rsk_auth_…

sudo systemctl enable --now restorable.service

Without an auth key, run init on its own; it prints an attach URL and short code, you open the URL in the dashboard to approve, the agent's poll completes.

Upgrading on this path

Repeat steps 1, 3 (binary only; leave user and state alone), and restart the service. There is no auto-upgrade: you pick the moment, verify the signature again, swap the binary.

VERSION=v0.5.0
ARCH=linux-amd64
BASE=https://get.restorable.app

curl -fsSL $BASE/$VERSION/restorable-$ARCH         -o restorable
curl -fsSL $BASE/$VERSION/restorable-$ARCH.minisig -o restorable.minisig
minisign -Vm restorable -p restorable-release.pub

sudo install -o root -g root -m 0755 restorable /usr/local/bin/restorable
sudo systemctl restart restorable

Subscribe to the release feed (or the Mastodon account) so you notice security patches; the in-repo apt/rpm customers get those automatically but you do not.

Uninstall

See Uninstalling for the full sequence. The short version: disable the service, remove the unit, remove the binary, back up /var/lib/restorable before deleting it, remove the user.