Public one-liner install

Audience: PSP / bank operators installing an Edge Node on their Linux hosts.

Purpose: Install Hokeka Edge with a single copy-paste command from the Console — no GitHub token, no private source access.

---

One-liner

curl -fsSL https://hokeka.com/install-edge.sh | sudo bash -s -- --enrol-token <token>

The same script is published at:

https://raw.githubusercontent.com/kevshake/hokeka-edge/main/install-edge.sh

Default Control Plane: https://aml.hokeka.com (override with --control-plane <url>).

---

Step by step

1. Sign in to the Console

Use your PSP account (not a platform/Hokeka staff account). Platform admins do not see the first-login Edge popup; they mint tokens for a named PSP from Edge Nodes.

2. Open Edge Nodes

Navigate to Edge Nodes. On first login, an onboarding modal also walks through this flow. Re-open it anytime from the account Help menu → Edge install onboarding, or from Edge Nodes → Show install guide.

3. Generate install token

Click Generate install token. Confirm the display name (optional). The Console shows:

• The exact one-liner with the token filled in
• Expiry (default 2 hours, max 24 hours)
• A note that the token is single-use and can be revoked

Copy the command. If the token is leaked, Revoke it from the token list before it is redeemed.

4. Run on the Linux box

Supported: Ubuntu/Debian and RHEL/Rocky, amd64 or arm64.

# Example (token from Console)
curl -fsSL https://hokeka.com/install-edge.sh | sudo bash -s -- \
  --enrol-token 'PASTE_TOKEN_HERE' \
  --control-plane https://aml.hokeka.com

What the bootstrap does on first run:

1. Detects distro/arch and installs host dependencies (curl, CA certs, …)
2. Preflight: outbound HTTPS to the Control Plane and GitHub Releases, disk/RAM, SELinux note on Rocky
3. Downloads the pinned (or latest) release from kevshake/hokeka-edge
4. Verifies SHA256SUMS
5. Redeems the install token → creates an approved Edge node and receives an enrollment code
6. Installs under /opt/hokeka and registers systemd

Corporate proxy: export HTTPS_PROXY / HTTP_PROXY before running.

5. Confirm the node is online

Return to Edge Nodes. The new node should move to Active after enrolment completes (mTLS certificate issued, keys pinned). The onboarding modal flips to Node online when that happens.

6. Upgrade / uninstall

# Upgrade to latest (or pin with --version)
sudo bash /opt/hokeka/release-staging/../…   # or re-curl:
curl -fsSL https://hokeka.com/install-edge.sh | sudo bash -s -- --upgrade

# Uninstall (keep data)
curl -fsSL https://hokeka.com/install-edge.sh | sudo bash -s -- --uninstall

# Uninstall and purge data
curl -fsSL https://hokeka.com/install-edge.sh | sudo bash -s -- --uninstall --purge

7. Token expiry and revocation

State	Effect
Expired	Redeem returns forbidden; mint a new token
Revoked	Redeem returns forbidden; mint a new token
Redeemed	Single-use; cannot be reused

---

Windows

Keep using install.ps1 from the release assets (Console also shows a Windows command for the classic enrollment path). Prefer Linux for production Edge Nodes.

---

Troubleshooting

Symptom	Likely cause	Fix
install token expired	Token older than TTL	Mint a new token
install token has been revoked	Admin revoked it	Mint a new token
Cannot reach GitHub Releases	Firewall / proxy	Allow github.com + objects.githubusercontent.com, set HTTPS_PROXY
Control Plane unreachable	Wrong URL / TLS intercept	Check --control-plane, corporate CA trust
SELinux denials (Rocky)	Enforcing mode	Review audit log; allow systemd/container contexts per your policy
Checksum mismatch	Truncated download / mirror	Re-run; do not use --insecure-skip-signature against public releases

---

Operator section (Hokeka staff)

Cutting a release

1. Tag the private repo: git tag v1.2.3 && git push origin v1.2.3
2. .github/workflows/release.yml builds linux amd64+arm64 (+ Windows DLL), checksums, publishes to packages CDN and to public kevshake/hokeka-edge GitHub Releases
3. Bootstrap files on main of hokeka-edge are refreshed by seed-hokeka-edge.yml when public-edge/** changes

EDGE_RELEASES_TOKEN

Required repository secret on Hokeka-AML-Tool:

Secret / variable	Purpose
EDGE_RELEASES_TOKEN	Fine-grained PAT, Contents: Read and write on kevshake/hokeka-edge only
EDGE_RELEASES_REPO (variable, optional)	Single owner/repo channel (default kevshake/hokeka-edge)

Set under Settings → Secrets and variables → Actions. If the secret is missing, the public publish job fails with a message that names the secret and refuses to fall back to the private repo.

What must never be published publicly

• Private source trees (BACKEND/, FRONTEND/, …)
• .env, signing private keys, Control Plane secrets, customer data

Only: install-edge.sh, README, LICENSE, release binaries, SHA256SUMS (+ signatures).