Documentation

# ═══ Option A · ONE COMMAND (recommended) — installs, writes a SQLite config, auto-generates a CA token, starts ═══
#   YOUR_SERVER = the address clients reach this box at — its LAN or public IP, or a domain. NOT localhost / 127.0.0.1.
#   e.g.  http://192.168.1.50:8443  (same LAN)   ·   http://203.0.113.10:8443  (public IP)   ·   https://gw.example.com  (domain)
curl -fsSL https://osh.openlay.com/downloads/install.sh | sudo sh -s -- --public-url http://YOUR_SERVER:8443
#   SQLite single-node · no PostgreSQL. Public HTTPS domain? add:  --autocert gw.example.com --public-url https://gw.example.com
#   (bare IP = http only — Let's Encrypt needs a domain.) Then watch for the root-enroll QR:
sudo journalctl -u pam-zta-gateway -o cat --no-pager -n 300   # full QR: -o cat strips the log prefix, -n 300 shows past lines (-f alone tails only 10 → QR cut off) · widen the window if it wraps

# ═══ Updating · already installed? Just re-run the installer (no flags needed) ═══
curl -fsSL https://osh.openlay.com/downloads/install.sh | sudo sh   # upgrades the package in place — your config, CA token, database and keys are kept, the service restarts on the new version

# ═══ Option B · MANUAL (advanced) — if you downloaded the .deb / .rpm above ═══
# 1) Install — --no-install-recommends keeps PostgreSQL OUT (SQLite needs no DB server)
sudo apt install --no-install-recommends ./pam-zta-gateway_0.9.0_amd64.deb            # Ubuntu / Debian
sudo dnf install --setopt=install_weak_deps=False ./pam-zta-gateway-0.9.0-1.x86_64.rpm  # RHEL / Rocky / Fedora

# 2) Point it at SQLite + set a CA token (writes the whole config)
sudo sh -c 'cat > /etc/pam-zta/gateway.toml' <<EOF
[server]
listen_addr = ":8443"
public_url  = "http://YOUR_SERVER:8443"   # IP or domain clients reach (NOT localhost) — goes into the enroll QR
[ca]
token = "$(openssl rand -hex 32)"
[database]
driver = "sqlite"
path   = "/var/lib/pam-zta/gateway.db"
[cert]
ttl = 300
[gateway_key]
key_path = "/var/lib/pam-zta/gateway_key.pem"
EOF
sudo chown root:pam-zta /etc/pam-zta/gateway.toml && sudo chmod 640 /etc/pam-zta/gateway.toml

# 3) Start + watch for the root-enroll QR
sudo systemctl enable --now pam-zta-gateway
sudo journalctl -u pam-zta-gateway -o cat --no-pager -n 300   # full QR: -o cat strips the log prefix, -n 300 shows past lines (-f alone tails only 10 → QR cut off) · widen the window if it wraps
grep token /etc/pam-zta/gateway.toml   # hand this CA token to the CA operator

# ─── Connect to this gateway ───
#   OSH client  →  osh enroll --force --gateway http://SERVER:8443    (first time: register the device)
#                  osh connect root@SERVER --gateway http://SERVER:8443
#   OSH - CA    →  ws://SERVER:8443/v1/ca/ws   +  the [ca].token above
# HA / multi-node? Use PostgreSQL instead of SQLite  ([database] host/user/... ).