LinkMesh

Install

One command. It just works.

Install the LinkMesh Server on any Linux VM in a single command. The .deb / .rpm postinstall generates the JWT secret, initializes the GitOps config repo, and seeds the default admin account, then starts the systemd service. It serves plain HTTP on port 8080 — put a reverse proxy in front to terminate TLS. Open the web UI and enroll your first Collector.

Full step-by-step guide including UI walkthrough and Kubernetes install: Quickstart on docs.linkmesh.io →

How it fits together

Server is the control plane. Your collectors enroll over one connection.

You install one thing: the Server (the .deb / .rpm below). Each OpenTelemetry Collector then enrolls with it over a single HTTPS connection on port 443 — otelcol-contrib via OpAMP, Grafana Alloy via remotecfg — authenticating with a bearer token. The collector pulls its config from LinkMesh and manages itself; your telemetry never flows through LinkMesh — it goes straight from the collector to your own backends. Optionally, the LinkMesh agent runs alongside as an edge connector for guided onboarding and service/log discovery — it carries no telemetry and doesn't run your collector. See Trust for the data-handling specifics, and Architecture on docs for the component topology in depth.

CONTROL PLANE · OpAMP LinkMesh Server your hosted instance OpAMP Server endpoint /v1/opamp transport WSS · port 443 OTel Host opampsupervisor + otelcol-contrib :4317 OTLP / gRPC :4318 OTLP / HTTP :8888 own metrics RemoteConfig · Connection Settings EffectiveConfig · Health · Status DATA PLANE · OTLP logs · metrics · traces Your Observability Backends Loki · Tempo · Prometheus · Grafana Cloud · …

Quickstart — Linux

Install the Server

Pick the line that matches your distro and paste it on a fresh Linux VM. That's the whole install — the postinstall generates the JWT secret, initializes the GitOps config repo, and seeds the admin account, then starts the systemd service.

Ubuntu / Debian

curl -fsSL https://artifacts.saas.opensight.ch/binaries/linkmesh-server/latest/linkmesh-server_latest_amd64.deb -o linkmesh-server.deb && sudo apt install -y ./linkmesh-server.deb

RHEL / Rocky / AlmaLinux

curl -fsSL https://artifacts.saas.opensight.ch/binaries/linkmesh-server/latest/linkmesh-server-latest.x86_64.rpm -o linkmesh-server.rpm && sudo dnf install -y ./linkmesh-server.rpm

After install — set the admin password, then sign in

The install creates an admin account with a random password that is deliberately never written to any log. Set your own with the recovery command — it talks to the local server, so no prior login is needed:

sudo linkmesh-server reset-password --email admin --password 'choose-a-strong-password'

Then open http://YOUR_HOST:8080 and sign in as admin. Omit --password to have a strong one generated and printed instead.

Running on Kubernetes, or want auto-updates from APT/YUM?

The Kubernetes install guide on docs covers Helm + manifests with reverse-proxy preset. For auto-updates via your system package manager, see repository setup.

Windows hosts work the same way

The Server itself is Linux-only, but collectors enroll from any OS. Windows hosts run otelcol-contrib (OpAMP) or Grafana Alloy (remotecfg) and connect over the same port-443 bearer-token handshake; the optional LinkMesh agent ships a Windows AMD64 binary too. After your Linux server is up, follow Add a Collector on docs for the platform-specific enrollment commands.

Enroll your collectors

Connect with vanilla OpenTelemetry — no proprietary agent required.

LinkMesh manages whatever collector you already run. Point otelcol-contrib at LinkMesh with the upstream opampsupervisor (OpAMP), or add a remotecfg block to Grafana Alloy. Both are open, standards-defined protocols; both authenticate with a bearer token over port 443 and leave the data plane (OTLP) untouched. Issue a one-time enrollment token in the UI, install on the host, and the collector appears in the fleet view within seconds.

otelcol-contrib · OpAMP

otelcol-contrib + opampsupervisor

The one-liner fetches both upstream binaries (collector + supervisor), writes the supervisor config, and starts the systemd unit. Swap in your own server's address if you're self-hosting.

curl -fsSL https://linkmesh.example.com/install-opamp.sh | \
  sudo sh -s -- --token YOUR_TOKEN

The supervisor opens a WebSocket to /v1/opamp, receives the config LinkMesh pushes, and writes it to the collector subprocess — you don't author the collector's config.yaml by hand. Full walkthrough: Onboard otelcol-contrib via OpAMP →

Grafana Alloy · remotecfg

Grafana Alloy

Alloy speaks its native remotecfg protocol — HTTP polling rather than OpAMP push. Add one block to your existing Alloy config, point it at the LinkMesh base URL, and authenticate with a per-collector bearer token minted from the collector detail page.

remotecfg {
  url            = "https://linkmesh.example.com"
  id             = constants.hostname
  poll_frequency = "60s"
  bearer_token   = env("LINKMESH_TOKEN")
}

Alloy reloads its pipelines automatically when the remote config changes — no service restart needed. Full walkthrough: Onboard Grafana Alloy via remotecfg →

Optional: add the onboarding agent

The LinkMesh agent is an optional edge connector — install it on a host (or as a Kubernetes DaemonSet) and it auto-detects running services, discovers log sources, and rolls up cluster workloads to make onboarding faster. It carries no telemetry and does not run your collector; your collector still manages itself over OpAMP or remotecfg. Grab it from Downloads.

Episode 1 · 5:47

Watch it end to end

A real walkthrough on two fresh VMs — from a blank machine to a collector reporting into LinkMesh.

Stuck?

Browse the full operator docs, or reach the OpenSight team directly.