Download & run the agent

The agent is a single self-contained binary with no dependencies. It runs on Linux and macOS, on both amd64 and arm64.

Every collector works on Debian and Ubuntu. On other distributions some features (package updates, vulnerability scanning, vhost discovery) are unavailable — see Supported platforms for the exact matrix before you deploy.

1. Install the binary

The quickest way — the installer detects your OS and architecture, downloads the matching binary, verifies its checksum, and installs it to /usr/local/bin:

curl -fsSL https://get.demerzel.cloud/install.sh | sh

To pin a specific version instead of the latest:

curl -fsSL https://get.demerzel.cloud/install.sh | sh -s v0.1.0

Or download manually

Builds are published as demerzel-agent-{linux,darwin}-{amd64,arm64}. Grab the one for your platform, verify it against the published checksums, and put it on your PATH:

curl -fsSL https://get.demerzel.cloud/latest/demerzel-agent-linux-amd64 -o demerzel-agent
curl -fsSL https://get.demerzel.cloud/latest/SHA256SUMS | grep demerzel-agent-linux-amd64 | sha256sum -c -
chmod +x demerzel-agent
sudo mv demerzel-agent /usr/local/bin/demerzel-agent
demerzel-agent --version

2. Enroll the host

Exchange your enrollment token for a signed identity:

demerzel-agent --enroll <your-token>

The agent talks to https://app.demerzel.cloud by default — you only pass --server (or DEMERZEL_SERVER) to point it elsewhere.

On success you’ll see:

enrolled as 3a623ca8-78ff-4826-9bc2-bcaa4dcfc1f4 (tenant …)
  identity: /etc/demerzel
  cert valid until 2026-08-11T20:15:20Z

What enrollment stores

Everything lands in the config directory (below), each file readable only by its owner:

File	Contents
agent.key	Private key — never leaves the host
agent.crt	Signed certificate carrying the agent’s identity
ca.crt	Issuing CA chain
identity.json	The assigned tenant + agent id

The config directory defaults to /etc/demerzel when running as root, or ~/.config/demerzel otherwise. Override it with --config-dir.

3. Run it

Once enrolled, the agent loads its own identity — no need to repeat it. Do a single test run:

demerzel-agent --once

Then run it continuously (usually via a service — see Run the agent as a service):

demerzel-agent --interval 1m

Command-line flags

Flag	Meaning	Default
--server	Demerzel base URL	https://app.demerzel.cloud
--enroll	Enroll with a token, then exit	—
--config-dir	Where identity is stored	/etc/demerzel
--once	Collect and send a single time	false
--interval	Collection interval in continuous mode	1m
--version	Print version and exit	—

Any flag can also be set from the environment: DEMERZEL_SERVER, DEMERZEL_CONFIG.