Agents & deployment

The agent is a small program (a single Go binary, no dependencies) installed on each target server. It is how certificates reach your infrastructure and how renewals happen without a person.

Before you install

• Outbound HTTPS only. The server needs TCP 443 out to api.nolapse.io (to download the agent, install time only) and agents.nolapse.io (always). No inbound port, no public IP.
• The domain must be verified in the portal first. Until it is, the agent runs but does nothing.
• Root / Administrator for the nginx and iis modes, because they write server config and reload the service.
• IIS only: openssl must be on the PATH. Windows does not ship it.

Install — Linux (systemd)

curl -fsSL https://api.nolapse.io/install.sh | sudo bash -s -- \
  --token <token> --domain <fqdn> --service nginx

Copy the exact command from Agents → New agent in the portal; it contains your single-use token. Supported: x86-64 and ARM64.

Install — Windows

& ([scriptblock]::Create((iwr https://api.nolapse.io/install.ps1 -UseBasicParsing).Content)) \
  -Token <token> -Domain <fqdn>

Run in an elevated PowerShell. The agent runs as a Scheduled Task (PentabyteCertAgent) under SYSTEM and starts at boot.

What gets installed

• Linux: /opt/cert-agent/ (binary, tls.crt, tls.key, state.json) and service cert-agent. Logs: journalctl -u cert-agent -f
• Windows: %ProgramFiles%\cert-agent\
• The private key is created on the server and never leaves it. Only the CSR is sent. tls.key and state.json are readable by root only.

Targets

• nginx (--service nginx) — writes a vhost into /etc/nginx/conf.d/, runs nginx -t, then reloads. That directory must be included by your nginx.conf.
• IIS (--service iis) — imports the certificate into the machine store and binds it.
• PAN-OS / FortiOS (--service panos / fortios) — pushed through the device API. Nothing is installed on the appliance; run the agent on any server that can reach its management IP, with an API user that may import certificates.
• Anything else (--service none) — the agent only writes the files. Add --reload "<command>" to restart your service after each renewal.