Install a datahub

Requirements

Debian 12 or Ubuntu LTS, x86_64 or aarch64, with systemd.
Root (sudo) and about 512 MiB free disk (2 GiB comfortable).
Port 5432 (or your --pg-port) free on 127.0.0.1.
curl, openssl, flock, python3 — the installer installs missing ones via apt-get when run as root.
docker in PATH only if you choose --docker.

// the command

Run it from a checkout

From a checkout of the rivethub-distro repository, on the host that will be your hub:

datahub installer

$ sudo bash install/datahub.sh [--docker] [--memory lite|full] [--owner NAME] [--advertise-host 192.0.2.10] [--yes]

No curl-pipe yet. curl -fsSL https://get.rivethub.io/datahub.sh | bash is refused in preflight, before any write: curl-pipe has no sibling bin/rivethub-hub, and pins/stable.json rivetos_tag is still UNPINNED. A checkout is the only path that works until the helpers are published. If you must invoke the script from elsewhere, set RIVETHUB_DISTRO_DIR / RIVETHUB_MIGRATIONS_DIR.

// the wizard

What the wizard asks

On a terminal, unset fields are prompted (defaults shown), then a SUMMARY, then an explicit yes before anything is written. Flags and RIVETHUB_* env vars skip their own prompt; --yes skips only the final confirm. Without a TTY the installer uses flags and defaults with no confirm — the non-interactive contract.

Owner user id — seeds users.json (default owner; honored on first run only).
Memory mode — lite (workers off, the default) or full. Full also asks for OpenAI-compatible embed and compaction endpoints and models, and installs rivet-embedder.service / rivet-compactor.service (not started until a RivetOS runtime is present).
Install mode — bare-metal Postgres from PGDG packages (the default) or --docker for the pinned pgvector image under systemd.
Re-run — an existing install is detected and the wizard offers resume / reconfigure-safe-bits / abort. CA re-init and the postgres password rotation never happen silently — pass --force.

// layout

What gets installed where

/var/lib/rivethub/shared/: mesh.json, rivet-ca (exportable)
/var/lib/rivethub/shared/rivetos/users.json: tenancy registry (mode 0600, not clobbered on re-run)
/var/lib/rivethub/ca-root/: root CA key — mode 0700, never exported, never packed into an enroll tarball
/var/lib/rivethub/datahub.env: postgres conninfo + worker env (mode 0600; the password is never printed)
/usr/local/bin/rivethub-hub: datahub helper (ca-init, enroll, renew, mesh-export, status)
/usr/local/lib/rivethub/rivet-ca.sh: pinned CA library

Bare-metal also installs postgresql-16 + postgresql-16-pgvector from PGDG. --docker instead writes rivethub-postgres.service running the pinned pgvector image, publishing 127.0.0.1:PORT:5432.

--data-root DIR (or RIVETHUB_ROOT) moves the /var/lib/rivethub tree.

// verify

Verify

on the datahub

$ rivethub-hub status

The CA is initialized once on the datahub (the installer runs rivethub-hub ca-init for you; ca-init --force re-inits). The closing banner prints the hub root, the postgres DSN, and the path to the password file — never the password itself.

// next

Add the first node

on the node host

$ curl -fsSL https://get.rivethub.io/node.sh | bash -s -- --hub owner@192.0.2.10

Replace owner@192.0.2.10 with an SSH login that can run rivethub-hub on this host. Details in the node guide.

Renew node certificates

On the datahub:

on the datahub

$ rivethub-hub renew <node-name>

Renew re-issues the node's leaf certificate using the host stored in mesh.json and emits the same base64 tarball contract as enroll. To change a node's address, re-enroll it instead.