privatae-bastion/docs/install.md

Install: the service and the release files

The short version, server and desktop, is in the README.

A networked install runs as the operating system's own service, whoever is signed in, and only the machine's administrator can stop it:

• Linux: the systemd unit privatae-bastion.service, as root.
• macOS: a launchd daemon (ai.privatae.bastion) running as root. The program goes in /Library/Application Support/privatae/bin, which only root can change, with a link on PATH.
• Windows: the service PrivataeBastion, running as LocalSystem. The program goes in Program Files\Privatae, which only administrators can change. The installer needs an elevated terminal, and removes the logon task an earlier install registered. The agent that serves a shared folder runs as the folder's owner, under their own token, while they are signed in to the machine; it never runs as LocalSystem, and the bastion writes nothing into the folder.

On macOS and Windows, privatae-bastion service install|uninstall|status does the same by hand. An administrator's commands (sudo -H … on macOS, an Administrator terminal on Windows) act on the service's state. From an account that does not administer the machine, pair, run and status are refused, so that account does not end up with a second, empty bastion of its own.

Release binaries are served from https://dl.privatae.ai. The release manifest (version.json, read by the installers at https://dl.privatae.ai/version.json and by the self-updater at https://privatae.ai/bastion/version.json) lists the current version, the commit it was built from, and the URL plus SHA-256 of every binary. Beside it, version.json.<first 16 hex of its sha256>.sig is an ed25519 signature over a statement naming the release, its version and the manifest's sha256, made on the key holder's own computer with deploy/release-sign.