Deploy the Linux agent — PatchPilot Docs

Get an enrolment token

Recommended: use the Deploy Agent wizard in the admin console (sidebar → Deploy Agent). It mints a scoped ppen_ enrolment token and gives you a ready-to-copy install command. Enrolment tokens can only register new devices — they can't read or write any other org data — and expire automatically (30 days by default).

An org API key (ppk_, from Settings > API Keys) also works with --api-key for backward compatibility, but it grants the same full read/write/admin access as the user who created it and never expires. Prefer an enrolment token for anything pasted into an install script or RMM tool.

One-liner install

On the target host, as root:

curl -fsSL https://patchpilot.co.uk/downloads/install-linux.sh \
  | sudo bash -s -- \
      --host https://patchpilot.co.uk \
      --api-key ppen_your_enrollment_token

The installer:

Detects your package manager (apt / yum / dnf) and ensures curl + jq are present.
Installs the agent script to /usr/local/bin/patchpilot-agent.
Writes config to /etc/patchpilot/ (mode 0600, owned by root).
Registers a systemd unit patchpilot-agent.service (or a cron job on hosts without systemd).
Performs first check-in immediately.

The script must run as root because it writes to /etc/ and registers a system service. Pipe through sudo bash, not bare bash.

Verify enrolment

Check the systemd unit:

systemctl status patchpilot-agent
journalctl -u patchpilot-agent -n 50

You should see successful check-in lines. The device will appear in Devices in the admin console within ~60 seconds.

What's collected

Installed packages and available upgrades from your package manager.
Kernel version, distro, uptime.
UFW / firewalld state.
LUKS / disk encryption status.
SSH config posture (key auth, root login disabled, etc.).

Manual install (no internet from the host)

If the target host can't reach the internet at install time, download the agent script and config separately on a connected jump-host and copy them over:

# From a connected machine
curl -fsSL https://patchpilot.co.uk/downloads/patchpilot-agent-linux.sh \
  -o patchpilot-agent
chmod +x patchpilot-agent

# Copy patchpilot-agent + an /etc/patchpilot/config.json onto the target,
# then enable the systemd unit manually.

The shape of /etc/patchpilot/config.json:

{
  "host": "https://patchpilot.co.uk",
  "token": "ppdt_..."
}

Uninstall

sudo systemctl stop patchpilot-agent
sudo systemctl disable patchpilot-agent
sudo rm /etc/systemd/system/patchpilot-agent.service
sudo rm -rf /etc/patchpilot /usr/local/bin/patchpilot-agent
sudo systemctl daemon-reload