Install
One command. It just works.
Install the LinkMesh Server on any Linux VM in a single command. The
.deb / .rpm postinstall generates the JWT secret,
initializes the GitOps config repo, and seeds the default admin account,
then starts the systemd service. It serves plain HTTP on port 8080 — put a
reverse proxy in front to terminate TLS. Open the web UI and enroll your
first Collector.
Full step-by-step guide including UI walkthrough and Kubernetes install: Quickstart on docs.linkmesh.io →
How it fits together
Server is the control plane. Your collectors enroll over one connection.
You install one thing: the Server (the .deb / .rpm
below). Each OpenTelemetry Collector then enrolls with it over a single HTTPS connection on
port 443 — otelcol-contrib via OpAMP, Grafana Alloy via
remotecfg — authenticating with a bearer token. The collector pulls its
config from LinkMesh and manages itself; your telemetry never flows through
LinkMesh — it goes straight from the collector to your own backends. Optionally,
the LinkMesh agent runs alongside as an edge connector for guided onboarding
and service/log discovery — it carries no telemetry and doesn't run your collector.
See Trust for the data-handling
specifics, and Architecture on docs
for the component topology in depth.
Quickstart — Linux
Install the Server
Pick the line that matches your distro and paste it on a fresh Linux VM. That's the whole install — the postinstall generates the JWT secret, initializes the GitOps config repo, and seeds the admin account, then starts the systemd service.
Ubuntu / Debian
curl -fsSL https://artifacts.saas.opensight.ch/binaries/linkmesh-server/latest/linkmesh-server_latest_amd64.deb -o linkmesh-server.deb && sudo apt install -y ./linkmesh-server.deb RHEL / Rocky / AlmaLinux
curl -fsSL https://artifacts.saas.opensight.ch/binaries/linkmesh-server/latest/linkmesh-server-latest.x86_64.rpm -o linkmesh-server.rpm && sudo dnf install -y ./linkmesh-server.rpm After install — set the admin password, then sign in
The install creates an admin account with a random password that is
deliberately never written to any log. Set your own with the recovery
command — it talks to the local server, so no prior login is needed:
sudo linkmesh-server reset-password --email admin --password 'choose-a-strong-password'
Then open http://YOUR_HOST:8080 and sign in as admin. Omit
--password to have a strong one generated and printed instead.
Running on Kubernetes, or want auto-updates from APT/YUM?
The Kubernetes install guide on docs covers Helm + manifests with reverse-proxy preset. For auto-updates via your system package manager, see repository setup.
Windows hosts work the same way
The Server itself is Linux-only, but collectors enroll from any OS. Windows hosts
run otelcol-contrib (OpAMP) or Grafana Alloy (remotecfg) and connect
over the same port-443 bearer-token handshake; the optional LinkMesh agent ships a
Windows AMD64 binary too. After your Linux server is up, follow
Add a Collector on docs
for the platform-specific enrollment commands.
Enroll your collectors
Connect with vanilla OpenTelemetry — no proprietary agent required.
LinkMesh manages whatever collector you already run. Point otelcol-contrib
at LinkMesh with the upstream opampsupervisor (OpAMP), or add a
remotecfg block to Grafana Alloy. Both are open, standards-defined
protocols; both authenticate with a bearer token over port 443 and leave the data
plane (OTLP) untouched. Issue a one-time enrollment token in the UI, install on the
host, and the collector appears in the fleet view within seconds.
otelcol-contrib · OpAMP
otelcol-contrib + opampsupervisor
The one-liner fetches both upstream binaries (collector + supervisor), writes the supervisor config, and starts the systemd unit. Swap in your own server's address if you're self-hosting.
curl -fsSL https://linkmesh.example.com/install-opamp.sh | \
sudo sh -s -- --token YOUR_TOKEN
The supervisor opens a WebSocket to /v1/opamp, receives the config
LinkMesh pushes, and writes it to the collector subprocess — you don't author the
collector's config.yaml by hand. Full walkthrough:
Onboard otelcol-contrib via OpAMP →
Grafana Alloy · remotecfg
Grafana Alloy
Alloy speaks its native remotecfg protocol — HTTP polling rather than
OpAMP push. Add one block to your existing Alloy config, point it at the LinkMesh base
URL, and authenticate with a per-collector bearer token minted from the collector
detail page.
remotecfg {
url = "https://linkmesh.example.com"
id = constants.hostname
poll_frequency = "60s"
bearer_token = env("LINKMESH_TOKEN")
} Alloy reloads its pipelines automatically when the remote config changes — no service restart needed. Full walkthrough: Onboard Grafana Alloy via remotecfg →
Optional: add the onboarding agent
The LinkMesh agent is an optional edge connector — install it on a host (or as a Kubernetes DaemonSet) and it auto-detects running services, discovers log sources, and rolls up cluster workloads to make onboarding faster. It carries no telemetry and does not run your collector; your collector still manages itself over OpAMP or remotecfg. Grab it from Downloads.
Episode 1 · 5:47
Watch it end to end
A real walkthrough on two fresh VMs — from a blank machine to a collector reporting into LinkMesh.
LinkMesh Episode 1 — Install the server, enroll your first collector
Next steps on docs.linkmesh.io
Everything beyond the one-liner — UI walkthrough, enrollment tokens, reverse-proxy setup, certificate lifecycle, collector enrollment commands, and troubleshooting — lives in the operator docs. Single source of truth, kept current with each release.
Quickstart
First Collector in 10 minutes
UI walkthrough from blank install to a live route with throughput. With inline screenshots. →
Kubernetes install
Helm chart + manifests
Production deployment with reverse-proxy preset, NetworkPolicy, and TLS termination. →
Enroll a Collector
otelcol via OpAMP, or Alloy via remotecfg
Both enrollment paths with the actual one-liner commands and token lifecycle. →
Reverse proxy
nginx / Caddy / HAProxy
HTTPS termination for the API, UI, OpAMP/remotecfg enrollment, and OTLP — all on port 443. Annotated config. →
Reference
Configuration schema
All config.yaml keys, CLI flags, and the linkmesh-server cert lifecycle commands. →
Troubleshooting
Operational runbooks
Enrollment failures, cert renewal, server IP changes, common mistakes and how to recover. →
Stuck?
Browse the full operator docs, or reach the OpenSight team directly.