Install a single-host pilot

Use a dedicated Ubuntu 22.04 or 24.04 x86_64 host with sudo access and a hostname or IP reachable from your test workstations. This is a pilot for non-sensitive data on a protected network, not a production security configuration. Do not run the native Linux installer on macOS.

• Docker option: Docker Engine, Compose v2, and registry access or preloaded base images.
• Native option: the installer can provision PostgreSQL and systemd services. Use a fresh evaluation host and preview its changes.
• Permit only required test networks: UI TCP 8081 for Docker or 80 for native nginx, Control TCP 8080, node API TCP 9092, and Desktop-to-node UDP 33001–33008.
• Choose Docker OR native services. Do not start both on the same ports. Back up existing data before modifying a host.

• Need production instead?

  Use trusted HTTPS, managed secrets, backups, and operational acceptance before handling customer data.

Obtain the Linux amd64 release archive and its published SHA-256 from your RIPTON delivery contact. Replace VERSION with your supplied version. Work from the extracted release root on the target server, not a source checkout. Review RELEASE_MANIFEST.md and the bundled INSTALL.md for your exact version.

sha256sum ripton-release-VERSION-linux-amd64.tar.gz
# Compare with the separately supplied checksum before extracting.
tar -xzf ripton-release-VERSION-linux-amd64.tar.gz
cd ripton-release-VERSION
test -x bin/linux-amd64/ript-control
test -x bin/linux-amd64/rnode
test -x bin/linux-amd64/ripton
test -f ui/dist/index.html

uname -m
docker info
docker compose version
scripts/prepare-docker-single-host.sh --host '<HOST_IP_OR_DNS>'
docker compose -f docker-compose.single-host.yml config --quiet
docker compose -f docker-compose.single-host.yml up -d --build
docker compose -f docker-compose.single-host.yml ps

The preparation helper creates a private .env with unique secrets and the client-reachable host. Do not use localhost for --host when clients are on another machine. Securely back up .env; the helper refuses to overwrite it without an explicit override. If ports conflict, adjust the documented RIPTON_* port settings before startup. Keep the UDP base, count, and published range consistent.

# Replace the host and adjust ports if changed in .env.
curl -fsS 'http://HOST_IP_OR_DNS:8080/healthz'
curl -fsS 'http://HOST_IP_OR_DNS:8080/readyz'
# curl prompts for the node password.
curl -fsS --user rnode 'http://HOST_IP_OR_DNS:9092/api/v1/ping'
curl -fsSI 'http://HOST_IP_OR_DNS:8081/'
docker compose -f docker-compose.single-host.yml logs --tail=100

Open http://HOST_IP_OR_DNS:8081/ from your workstation. Use the generated RIPTON_RNODE_AUTH_PASS privately when prompted for the node password. Register http://HOST_IP_OR_DNS:9092 as the pilot node URL, adjusting ports if changed. Skip the native option and continue to step 4.

Use this option instead of Docker. The installer provisions services and can install PostgreSQL packages. Set the advertised host to the address reachable from Desktop clients. The nginx helper can disable the default site; review its preview before using an existing web server.

scripts/install-single-machine.sh --dry-run
sudo RNODE_ADVERTISE_HOST='<HOST_IP_OR_DNS>' scripts/install-single-machine.sh
sudo RIPTON_CONTROL_URL='http://127.0.0.1:8080' scripts/install-ui-nginx.sh --dry-run
sudo RIPTON_CONTROL_URL='http://127.0.0.1:8080' scripts/install-ui-nginx.sh
sudo systemctl status ript-control rnode nginx --no-pager
# Run these local diagnostics on the Ubuntu server.
curl -fsS http://127.0.0.1:8080/readyz
sudo scripts/ript-smoke-check.sh

Open http://HOST_IP_OR_DNS/ from your workstation. The loopback Control URL is an nginx upstream on this server, not the user-facing workspace address. Securely back up /etc/ript-control/env and /etc/rnode/env. The node password is stored in the root-readable node environment file. Default storage is /data/ripton/rnode; set RNODE_STORAGE_ROOT during installation if you need another mounted volume.

1. 1Open your deployed UI. On a clean database with no users, the first registration creates the administrator. Coordinate bootstrap on a restricted network before permitting other users to register.
2. 2Open Admin → License & Activation and install the supplied signed licence or use your activation code. Verify that the licence covers your topology. Customer-specific licences are delivered separately. If your offline licence binds exact node IDs, follow the ordering in your release's AIR_GAP_LICENSING.md instead.
3. 3Open Admin → Nodes and add the node's reachable Base URL, /api/v1 prefix, and configured node credentials. Use HTTPS in production. Run Check connectivity and assign the appropriate node as Default storage.
4. 4Install Desktop on a test workstation that can reach Control and the node transfer ports. On macOS, open desktop/macos/RIPTON Desktop.dmg, move the application to Applications, and open it. On Debian/Ubuntu use the commands below. Approve protocol-handler registration if prompted.

# Debian/Ubuntu workstation only
sudo dpkg -i 'desktop/linux/RIPTON Desktop.deb'
ripton-desktop --health
ripton-desktop --register-protocol-handler

Service health alone is not acceptance. Send a small non-sensitive file, confirm upload completion, download as the intended recipient, and compare its checksum with the original. Use the first-package walkthrough below.

• Send and verify your first package

  Follow the sender, monitoring, recipient download, and checksum steps.

• Register and troubleshoot a node

  Resolve credentials, TLS, node connectivity, and advertised-route problems.

• Operations and troubleshooting

  Inspect health and logs before retrying a failed transfer.

• Run and manage RIPTON services

  Start, stop, restart, check boot behavior, and verify recovery for your installation type.