Install

Get repo credentials from the operator; they are not in this repo.

macOS (Homebrew)

Paste the whole block; do not use read.

AGENTCTL_USER='REPO_USER'; AGENTCTL_PASS='REPO_PASS'   # ← edit these two
printf 'machine agentctl.srv.ajil.ch\n  login %s\n  password %s\n' "$AGENTCTL_USER" "$AGENTCTL_PASS" >> ~/.netrc && chmod 600 ~/.netrc
unset AGENTCTL_USER AGENTCTL_PASS
brew install muyajil/tap/agentctl      # thereafter: brew upgrade agentctl

Linux (apt)

Paste the whole block; do not use read.

AGENTCTL_USER='REPO_USER'; AGENTCTL_PASS='REPO_PASS'   # ← edit these two
# creds (kept out of sources.list)
echo "machine agentctl.srv.ajil.ch login $AGENTCTL_USER password $AGENTCTL_PASS" | sudo tee /etc/apt/auth.conf.d/agentctl.conf >/dev/null && sudo chmod 600 /etc/apt/auth.conf.d/agentctl.conf
# signing public key → keyring (one-time; required for the signed repo to verify)
curl -fsSL -u "$AGENTCTL_USER:$AGENTCTL_PASS" https://agentctl.srv.ajil.ch/agentctl-archive-keyring.gpg | sudo tee /usr/share/keyrings/agentctl-archive-keyring.gpg >/dev/null
# source (self-contained)
sudo tee /etc/apt/sources.list.d/agentctl.sources >/dev/null <<'EOF'
Types: deb
URIs: https://agentctl.srv.ajil.ch/apt
Suites: stable
Components: main
Signed-By: /usr/share/keyrings/agentctl-archive-keyring.gpg
EOF
unset AGENTCTL_USER AGENTCTL_PASS
sudo apt update && sudo apt install agentctl

Thereafter: sudo apt upgrade agentctl && sudo agentctl apply.

RHEL 10 (dnf)

Targets RHEL 10 and its rebuilds — verified on AlmaLinux 10.2 and Rocky Linux 10.2. RHEL 9 is not supported. Configure the yum repo first on either install path: agentctl provision pulls kasmvncserver and openbox from it.

1. Configure the repo

sudo rpm --import https://agentctl.srv.ajil.ch/RPM-GPG-KEY-agentctl
sudo curl -fsSL -u USER:PASS -o /etc/yum.repos.d/agentctl.repo https://agentctl.srv.ajil.ch/rpm/agentctl.repo
sudo chmod 600 /etc/yum.repos.d/agentctl.repo   # it carries a real password

The released agentctl.repo has username=/password= baked in, so dnf needs no further credential setup. It sets gpgcheck=1 and repo_gpgcheck=1; packages are header-signed and repomd.xml carries a detached signature.

2. Install

sudo dnf install -y agentctl
sudo agentctl provision

From a release asset instead (step 1 still required, in either order):

sudo dnf install -y ./agentctl-<ver>.x86_64.rpm
sudo agentctl provision

What provision installs

One distro-detected step (internal/converge/host.go, gated on isDNFHost) does all of it. There is no manual prerequisite beyond step 1.

Order	Packages	Source
1	epel-release, CodeReady Builder enable	dnf config-manager (Alma/Rocky) or subscription-manager (RHEL)
2	age, ffmpeg-free, git-filter-repo, pandoc, tesseract	epel
3	kasmvncserver, openbox, libobrender32v5, libobt2v5	agentctl repo
4	google-chrome-stable	google

Real Red Hat RHEL must be registered first

Step 1 runs subscription-manager repos --enable codeready-builder-for-rhel-10-x86_64-rpms, which needs an active Red Hat subscription. On an unregistered host it fails loudly with Red Hat's own "this system is not registered" error. provision cannot automate the registration.

Known limits

Limit	Effect
SELinux	RHEL 10 enforces by default; no policy module ships and nothing is tested under enforcing. Expect to need a policy module or semanage fcontext rules.
Air-gap	The package-mirror wiring (internal/converge/artifactory.go) is apt-only. A host with no outbound access is not supported on the rpm path.
fonts-inter	No el10 package anywhere. The video MCP's default caption font falls back to another family. Install Inter into /usr/local/share/fonts and run fc-cache -f, or set a caption font per project.
ffmpeg-free	Carries no libx264/libx265. Voice-note transcode works; h264 renders need the full build.
Office docs / OCR	libreoffice-core/-writer/-calc/-impress and ocrmypdf are absent from el10 entirely — not in baseos/appstream/CRB, not in EPEL. No RPM equivalent exists. The office-pack skill's document-render and OCR paths have no fallback on this platform.

Full ffmpeg from RPM Fusion:

sudo dnf install -y https://mirrors.rpmfusion.org/free/el/rpmfusion-free-release-10.noarch.rpm
sudo dnf install -y ffmpeg   # replaces ffmpeg-free

Packaging details

kasmvncserver and openbox come from agentctl's own yum repo because neither exists in any el10 repo upstream. For the deb-to-rpm dependency map and how those rebuilds are produced, see RHEL packaging notes.

A one-off deb, no repo

apt install -y ./agentctl_*.deb       # pulls age, socat, jq, …

Install is non-destructive: no users created, no units enabled, no reconcile run. The first state-changing step is always an explicit agentctl provision.

Building it yourself

See Build from source. The signed apt repo, the yum repo and the macOS binaries are served by one static container built from packaging/repo/.