Deploy on Linux

These commands show the filesystem and security model. Use the signed package and service unit supplied through your Tenvyr release channel in production.

Prerequisites

• OpenSSH server is installed and sshd -t passes.
• The host can make outbound HTTPS connections to agents.tenvyr.com.
• You have root access and a tested recovery path.
• Time synchronization is healthy.

Filesystem layout

Use root-only locations:

/etc/tenvyr/enrollment-token       one-use bootstrap file
/var/lib/tenvyr/identity.json      durable agent identity
/var/lib/tenvyr/                   agent state

The managed SSH output location is controlled by the agent's -managed-root setting. Do not place unrelated administrator-owned files under that root.

Enroll

sudo install -d -o root -g root -m 0700 /etc/tenvyr
sudo install -o root -g root -m 0600 \
  /secure/staging/tenvyr-enrollment-TOKEN_ID.token \
  /etc/tenvyr/enrollment-token

sudo tenvyr-agent \
  -api https://agents.tenvyr.com \
  -state-dir /var/lib/tenvyr \
  -enrollment-token-file /etc/tenvyr/enrollment-token \
  -once

The private mTLS key is generated on the host. A successful enrollment consumes the token and leaves a mode-0600 empty placeholder.

Validate before service enablement

sudo test -s /var/lib/tenvyr/identity.json
sudo test "$(stat -c '%U:%G %a' /etc/tenvyr/enrollment-token)" = "root:root 600"
sudo test ! -s /etc/tenvyr/enrollment-token
sudo sshd -t

Then start the packaged service and confirm:

• it runs under the intended restricted service context;
• a heartbeat appears in Tenvyr;
• host keys match the server;
• the desired state reconciles without validation errors; and
• a canary user can connect.

Diagnostic modes

The agent supports:

-dry-run     compute and validate without applying changes
-once        complete one enrollment or reconciliation cycle
-poll        desired-state polling interval
-heartbeat   heartbeat interval

Use -dry-run in pre-production qualification and before changing managed-root or manifest-key settings.