Connect a server

To protect a server, the arcula agent is installed on it. The agent contacts the panel itself: you don't need to open inbound ports on the server. Connecting takes one command on the server and a code in the browser.

Supported: Ubuntu 22.04 and 24.04, Debian 12 on amd64 or arm64 with systemd. Docker is optional: without it the agent finds only what is on the host.

It's better to connect a storage first — without it the protection plan can't be saved. See Connect a storage.

1. Install the agent

Panel → “Servers” → “+ Server”. The panel shows the install line and a “Copy” button. Run the line on the server:

curl -fsSL https://panel.example.com/install.sh | sudo sh

The address in the line is your panel's. The script:

• downloads arcula and restic 0.18.1 for the server's architecture from the panel and checks them against SHA256SUMS;
• puts arcula in /usr/local/bin/arcula, and restic in /var/lib/arcula/bin/restic;
• installs and starts the arcula-agent service;
• runs arcula login.

If you want to read the script first:

curl -fsSL https://panel.example.com/install.sh -o install.sh
sudo sh install.sh

If the agent is already installed, sudo arcula login is enough.

2. Confirm the code

arcula login shows a code and a link and waits:

Open https://panel.example.com/connect and enter the code  WDJB-MJHT
or go straight to: https://panel.example.com/connect?code=WDJB-MJHT
Waiting for approval… (the code is valid for 10 minutes)

1. Open the link. Or enter the code on the “+ Server” page, in the “Confirm the code” step, and click “Next”.
2. On the “Code confirmation” page, check the code against the terminal. It also shows the host name, system, IP and request time. Only confirm what you started yourself.
3. Set the “Server name” — this is how it will be labelled in the panel. Defaults to the host name.
4. Click “Connect”. If the request isn't yours — “Reject”.

The code lives 10 minutes. If it has expired, run sudo arcula login again.

If this machine was already connected, the page warns you: connecting creates a new server, and the old one keeps its history and backups.

Without a terminal, e.g. from cloud-init, the script doesn't wait for confirmation: it shows the code and exits, and the service finishes the connection. Enter the code on the “+ Server” page.

3. First discovery

Right after connecting, the agent scans the server: Docker and Compose projects, volumes, databases, directories in /opt, /srv, /var/www, host settings. It doesn't read secret values. The terminal shows a summary and a link to the plan:

Server linked as "prod-db-01".
The arcula-agent service is started.
Found: 3 projects, 2 databases, 1 needs a decision.
Confirm the protection plan in the panel: https://panel.example.com/servers/<server_id>

After “Connect”, the panel opens the “Protection plan” by itself. Until the agent sends what it found, it shows “Waiting for the agent's findings”. This usually takes a minute — the page refreshes by itself.

4. Confirm the plan

Until the plan is confirmed, there are no backups. In the server list such a server shows “Protection plan not confirmed — no backups”.

Choose what to protect, how often and to which storages, and click “Confirm plan”. Details — in Choose what to protect.

The agent gets the plan on its next check-in — it checks in once a minute — creates the repositories in the storages and makes the first backup right away.

Check the server

On the server:

sudo arcula doctor

It checks the permissions on the agent's files, the service, the connection to the panel, the clock, restic, space for staging and access to the plan's storages. It works before the plan is confirmed too.

After the first backup, sudo arcula status shows the same as the server's row in the panel.