Advanced Linux configuration

This page covers interactive installation, Cloudflare Tunnel, custom directories and ports, service-manager selection, NexusDock configuration, and binary-only installation.

Alpine and minimal systems

The unified install.sh entry needs a POSIX shell, Bash, CA certificates, and either curl or wget. Install the missing tools first:

apk add --no-cache bash curl ca-certificates

Then run the same install.sh command shown below. There is no separate bootstrap installer.

Interactive installation

Without AGENTDOCK_NONINTERACTIVE, the installer asks for each setting:

curl -fsSL https://github.com/uvwt/agentdock/releases/latest/download/install.sh \
  -o /tmp/install-agentdock.sh
sh /tmp/install-agentdock.sh

Keep the binary mode for a normal deployment. source and auto are only for development or troubleshooting when prebuilt artifacts are unavailable.

Cloudflare Tunnel

The installer asks whether you already have a domain managed by Cloudflare:

User answer	Installer mode	Result
Domain available	Fixed (named)	Stable HTTPS hostname for long-running clients and OAuth
No domain	Temporary (quick)	Generated trycloudflare.com URL for immediate testing

For fixed mode, complete Configure a fixed domain first, then enter the resulting HTTPS public origin and Tunnel Token when the installer asks.

A temporary installation starts cloudflared, reads the generated URL from the service log, writes it to AGENTDOCK_SERVER_URL, enables OAuth, and restarts AgentDock. Both modes generate or reuse these credentials:

• AGENTDOCK_AUTH_TOKEN
• AGENTDOCK_OAUTH_PASSWORD
• AGENTDOCK_OAUTH_TOKEN_SECRET

The completion panel prints the public URL, MCP URL, Bearer Token, and OAuth login password. The OAuth signing secret is not printed. The Tunnel Token is written only to root-only /etc/agentdock/cloudflared.env; it is not written to agentdock.env, passed to AgentDock, or placed in the cloudflared command line.

If a temporary URL changes, rerun the same installer. Existing host, port, advanced settings, Bearer Token, OAuth password, signing secret, and NexusDock configuration are preserved. The new URL is written back automatically and AgentDock is restarted. The client must replace the old MCP URL and authorize OAuth again.

The default Tunnel service is agentdock-cloudflared:

# systemd
sudo systemctl status agentdock-cloudflared --no-pager
sudo journalctl -u agentdock-cloudflared -n 100 --no-pager

# OpenRC
sudo rc-service agentdock-cloudflared status
sudo tail -n 100 /var/log/agentdock-cloudflared.log \
  /var/log/agentdock-cloudflared.err

Non-interactive installation remains private unless the mode is explicitly supplied. For a temporary Tunnel:

sudo env \
  AGENTDOCK_NONINTERACTIVE=true \
  AGENTDOCK_TUNNEL_MODE=quick \
  sh /tmp/install-agentdock.sh

For fixed mode, set AGENTDOCK_TUNNEL_MODE=named, AGENTDOCK_SERVER_URL, and AGENTDOCK_CLOUDFLARE_TUNNEL_TOKEN. AGENTDOCK_OAUTH_PASSWORD and AGENTDOCK_OAUTH_TOKEN_SECRET are optional first-install overrides; otherwise the installer generates them. Inject secrets from a protected environment or secret manager.

Default directories

Installation directory  /opt/agentdock
Runtime data directory  /srv/agentdock
Environment file        /etc/agentdock/agentdock.env
Service user            agentdock
Listen address          127.0.0.1:8765

A typical systemd installation creates:

/opt/agentdock/bin/agentdock
/srv/agentdock/.agentdock
/srv/agentdock/AgentDock
/etc/agentdock/agentdock.env
/etc/systemd/system/agentdock.service

OpenRC creates /etc/init.d/agentdock instead.

Non-interactive configuration

Override defaults through environment variables in automated deployments:

sudo env \
  AGENTDOCK_NONINTERACTIVE=true \
  AGENTDOCK_RELEASE_VERSION=latest \
  AGENTDOCK_PORT=8765 \
  sh /tmp/install-agentdock.sh

Common variables:

Variable	Purpose
AGENTDOCK_RELEASE_VERSION	latest or vX.Y.Z
AGENTDOCK_SOURCE_DIR	Binary installation root
AGENTDOCK_DATA_DIR	State and working-directory root
AGENTDOCK_ENV_FILE	Service environment file
AGENTDOCK_SERVICE_NAME	systemd or OpenRC service name
AGENTDOCK_SERVICE_USER	Low-privilege runtime user
AGENTDOCK_SERVICE_MANAGER	auto, systemd, openrc, or none
AGENTDOCK_HOST	Listen address
AGENTDOCK_PORT	Listen port
AGENTDOCK_AUTH_TOKEN	Custom Bearer Token
AGENTDOCK_NEXUS_ENDPOINT	NexusDock URL
AGENTDOCK_NEXUS_TOKEN	NexusDock token
AGENTDOCK_TUNNEL_MODE	none, quick, or named
AGENTDOCK_SERVER_URL	Fixed HTTPS origin for Named Tunnel and OAuth
AGENTDOCK_CLOUDFLARE_TUNNEL_TOKEN	Named Tunnel Token; stored only in cloudflared.env
AGENTDOCK_CLOUDFLARED_INSTALL_PATH	Custom cloudflared binary path

Do not commit real tokens. When AGENTDOCK_AUTH_TOKEN is omitted, the installer generates one and writes it to a root-only environment file.

Install only the binary

To avoid registering a system service:

sudo env \
  AGENTDOCK_NONINTERACTIVE=true \
  AGENTDOCK_SERVICE_MANAGER=none \
  sh /tmp/install-agentdock.sh

This mode does not start AgentDock automatically. Run /opt/agentdock/bin/agentdock manually.

Change the port or token

Edit the environment file:

sudoedit /etc/agentdock/agentdock.env

Restart the service afterward:

sudo systemctl restart agentdock
sudo systemctl status agentdock --no-pager

For OpenRC:

sudo rc-service agentdock restart
sudo rc-service agentdock status

View logs

For systemd:

sudo journalctl -u agentdock -n 100 --no-pager
sudo journalctl -u agentdock -f

For OpenRC:

sudo tail -n 100 /var/log/agentdock.log /var/log/agentdock.err

Update

Rerun the installer to replace the binary. Runtime data and the environment file are preserved. To install a fixed version:

sudo env \
  AGENTDOCK_NONINTERACTIVE=true \
  AGENTDOCK_RELEASE_VERSION=vX.Y.Z \
  sh /tmp/install-agentdock.sh

To maintain systemd, the environment file, reverse proxy, and OAuth entirely yourself, see Manual Linux deployment.