Your deployment.
Your responsibility.

Read the engineering boundary first#

You need: a supported 64-bit Linux system with systemd, administration access, a trusted workstation, the intended engineering archive and separately authenticated verification information. The owner must understand backups, permissions, clock handling and recovery.

01 — Verify before extracting#

Runs on: a trusted workstation. Obtain the archive and its separately authenticated SHA-256. The package verifier must be available.

kurdpackage verify --archive <archive>

Changes: verifies a local archive, not the live server. Success: a successful verifier exit for the intended archive and an identity match with trusted publication information. On failure: stop and obtain the correct package; do not skip verification.

Extract into a new empty directory and inspect manifest.json, SHA256SUMS and the scripts.

02 — Install without silently starting#

Runs on: the owner’s Linux system, inside the verified extracted directory. Inspect the scripts and their prerequisites first.

sudo ./preflight.sh --install
sudo ./install.sh --install

Changes: installs the engineering package. The guide explicitly says installation does not create authority keys, enable the listener or start the service.

Success: preflight and installation complete without errors. If preflight fails, correct its reported prerequisite rather than enabling the listener manually.

03 — Establish local authority and recovery#

Runs on: the owner system after installation. The exact flags below were checked in cmd/kurdctl/main.go, not inferred from a marketing example.

First define the non-secret shell variables DEPLOYMENT_NAME, RELAY_ENDPOINT (host:port) and RECOVERY_FILE for the intended deployment. The recovery file must be in a protected location outside /var/lib/kurd-node, writable by the service user.

sudo -u kurd-node /usr/local/bin/kurdctl init \
  --data-dir /var/lib/kurd-node \
  --name "$DEPLOYMENT_NAME" \
  --endpoint "$RELAY_ENDPOINT" \
  --recovery-file "$RECOVERY_FILE"

Changes: initializes deployment identity and writes the encrypted recovery artifact. Success: the command returns kurdctl-init-v1 output with the deployment identifier, root fingerprint, recovery path and a recovery-confirmation next step. Those values are not supplied by this website.

sudo -u kurd-node /usr/local/bin/kurdctl recovery confirm \
  --data-dir /var/lib/kurd-node \
  --recovery-file "$RECOVERY_FILE"
sudo -u kurd-node /usr/local/bin/kurdctl doctor \
  --data-dir /var/lib/kurd-node

Recovery confirmation reads the passphrase on standard input again. A successful response has confirmed: true; the doctor command requires an overall PASS. On failure, preserve the current state. Do not silently reinitialize or delete the recovery artifact.

04 — Prepare the intended device#

Export a fresh public enrollment request from the Android app. Transfer the exact request to the owner through an authenticated channel. The request lets the owner issue a profile for that device; it does not give the app administration powers.

05 — Issue a recipient-sealed profile#

Runs on: the owner’s configured VPS, as the kurd-node service user. Prerequisites: healthy local authority, the intended public request and a new empty output directory. Replace the request path with the actual intended file.

sudo -u kurd-node /usr/local/bin/kurdctl profile create \
  --data-dir /var/lib/kurd-node \
  --name phone \
  --valid-for 168h \
  --recipient-request /path/to/device.kurd-enrollment \
  --recipient-registry-dir /var/lib/kurd-node/recipient-registry \
  --output-dir /var/lib/kurd-node/export-phone

Changes: issues a profile under the deployment’s authority and recipient policy. The output is sensitive. Transfer only the intended profile or QR to the intended device; remove temporary copies after import.

Success: the command completes and the intended device can verify the resulting artifact. A generated file alone is not proof of end-to-end Internet access. On failure, inspect safe diagnostics; do not weaken recipient or signature checks.

06 — Enable only after checks pass#

Runs on: the owner’s VPS with system administration authority. Prerequisites: preflight and local checks passed; appropriate network policy and recovery material are in place.

sudo systemctl enable --now kurd-node-network.service kurd-node.socket
sudo systemctl start kurd-node.service
sudo systemctl is-active kurd-node.service kurd-node.socket

Changes: enables the documented network policy, socket and service. Success: service and socket report active. That only establishes service status—not production egress qualification.

Failure: do not open arbitrary firewall access or disable authentication. Use the operator guide and safe diagnostics. No speculative repair command is offered here.

07 — Verify the deployment; preserve recovery#

On the intended phone, import and verify the profile, compare the deployment fingerprint and explicitly confirm trust. Keep encrypted recovery material and current encrypted backups off the VPS. Losing both is unrecoverable according to the quickstart.

Do not claim successful Internet egress until the exact build passes the namespace, emulator and owner-VPS evidence gates. This website has not executed those campaigns.