Linux server

Install Secretbase on a computer with no screen, a server that stays on, in two steps: install it on the server, then manage it from your laptop (or from any browser).

Install on the server

At the server's keyboard or over SSH, paste the command from the download page:

$ curl -fsSL https://secretbase.me/download/install.sh | sh

It asks for your password once and, at a terminal, shows the notice: type yes to accept it. When it asks "Open Secretbase from any browser, on your phone or another computer?", yes turns on the online dashboard (below).

To install with no questions (from a script, or your own product's installer), name the admin and accept the notice on the command line:

$ curl -fsSL https://secretbase.me/download/install.sh | sh -s -- --admin <user> --accept-terms

--admin is the login name of the user who runs Secretbase here; --accept-terms accepts the notice, which is printed once in the install's output.

The server has no browser, so it prints the sign-in link for you to open on your phone or laptop:

$ secretbase frontdoor setup
…
Ready: your apps can go online.

Open the link after "Continue in your browser:" and sign in to your Tailscale account. If a second link appears, open it too and click Allow. The server then says "Ready: your apps can go online."

With no browser at hand, add a Tailscale key instead (secretbase tailscale-key, below): the server signs in with it, no link to open.

Manage it from your laptop

On the server, make a token for the laptop, as yourself (not with sudo):

$ secretbase tokens create --name laptop --server --limit admin
Server, limited to admin on <machine>. Can: Everything but approvals. Ends: <date>.

Access token "laptop" (shown only now: copy it somewhere safe):

  sbt_…

On the other computer, run this and paste the token when it asks:

  secretbase remote add <name> <address>

…

On the laptop, install only the command (no password; it goes into ~/.local/bin), then add the server and paste the token when it asks:

$ curl -fsSL https://secretbase.me/download/install.sh | sh -s -- --cli
$ secretbase remote add home <address>

It says "Added home (<address>): <n> app(s) there." home is your name for the server (the line tokens create printed names it after the server, or home; any name works, and --to takes the same one); secretbase remote list shows the servers you added. Now add --to home to publish and manage apps there:

$ cd ~
$ secretbase publish ./my-site --to home
$ secretbase status --to home
$ secretbase logs my-site --to home
$ secretbase undo my-site --to home

undo puts the app's previous release back online there. .git and node_modules are never sent. See Tokens for which token to give to whom.

Or from any browser

On the server, turn on the online dashboard and choose a username and password:

$ secretbase dashboard on

secretbase dashboard then says which address to open: "Open <address> in any browser and sign in as <username>." Some things are done only on the server itself, like making a Server token with full control.

Good to know

Tailscale gives a computer three public addresses. The online address, used by tokens and the online dashboard, takes one. For more, add a Tailscale key on the server (secretbase tailscale-key): every new app then gets an address of its own. Or put apps on your own domain.
Deleting an app frees its address; taking it offline doesn't.
The install adds you to the secretbase group and makes you this server's admin: only the user who installed Secretbase can make Server tokens or reach other people's apps. Someone else you add to the group publishes and manages only their own apps, and makes App tokens for those. They see other people's apps by name and state only.

If something goes wrong