Install a datahub

Requirements

Debian 12 or Ubuntu LTS, x86_64 or aarch64, with systemd.
Root (sudo) and about 512 MiB free disk (2 GiB comfortable).
Port 5432 (or your --pg-port) free on 127.0.0.1.
curl, openssl, flock, python3 — the installer installs missing ones via apt-get when run as root.
docker in PATH only if you choose --docker.

the command

One command, as root

On the host that will be your hub:

datahub installer

$ curl -fsSL https://get.rivethub.io/datahub.sh | sudo bash

Piped in, the script has no helper files beside it, so preflight fetches bin/rivethub-hub, lib/rivet-ca.sh and the two worker units from get.rivethub.io and checks each against its SHA256 in pins/stable.json. A missing pin or a mismatch is refused before the installer writes anything. The pins come from the same server as the files, so this catches a broken or half-published release, not a compromised server. To read it first, download it and run the file:

read, then run

$ curl -fsSLO https://get.rivethub.io/datahub.sh && less datahub.sh && sudo bash datahub.sh

the wizard

What the wizard asks

On a terminal, unset fields are prompted (defaults shown), then a SUMMARY, then an explicit yes before anything is written. Flags and RIVETHUB_* env vars skip their own prompt; --yes skips the final confirm. With no terminal to ask on (plain ssh without -t, cron) nothing is prompted and there is no confirm, with or without --yes: flags, env vars and each prompt's documented default apply, and the install proceeds. Fields with no default are listed together in one error with their env names (RIVETOS_EMBED_URL / RIVETOS_COMPACTOR_URL / RIVETOS_COMPACTOR_MODEL for --memory full).

Owner user id — seeds users.json (default owner; honored on first run only).
Memory mode — lite (workers off, the default) or full. Full also asks for OpenAI-compatible embed and compaction endpoints and models, and installs rivet-embedder.service / rivet-compactor.service (not started until a RivetOS runtime is present).
Install mode — bare-metal Postgres from PGDG packages (the default) or --docker for the pgvector image under systemd.
Re-run — an existing install is detected and the wizard offers resume / reconfigure-safe-bits / abort. CA re-init and the postgres password rotation never happen silently — pass --force.

layout

What gets installed where

/var/lib/rivethub/shared/: mesh.json, rivet-ca (exportable)
/var/lib/rivethub/shared/rivetos/users.json: tenancy registry (mode 0600, not clobbered on re-run)
/var/lib/rivethub/ca-root/: root CA key — mode 0700, never exported, never packed into an enroll tarball
/var/lib/rivethub/datahub.env: postgres conninfo + worker env (mode 0600; the password is never printed)
/usr/local/bin/rivethub-hub: datahub helper (ca-init, enroll, renew, mesh-export, status)
/usr/local/lib/rivethub/rivet-ca.sh: pinned CA library

Bare-metal also installs postgresql-16 + postgresql-16-pgvector from PGDG. --docker instead writes rivethub-postgres.service running the pinned pgvector image, publishing 127.0.0.1:PORT:5432.

--data-root DIR (or RIVETHUB_ROOT) moves the /var/lib/rivethub tree.

verify

Verify

on the datahub

$ rivethub-hub status

The CA is initialized once on the datahub (the installer runs rivethub-hub ca-init for you; ca-init --force re-inits). The closing banner prints the hub root, the postgres DSN, and the path to the password file — never the password itself.

on the node host

$ curl -fsSL https://get.rivethub.io/node.sh | sudo bash -s -- --hub owner@192.0.2.10

Replace owner@192.0.2.10 with an SSH login that can run rivethub-hub on this host. Details in the node guide.

Renew node certificates

On the datahub: