Requirements
| Need | Detail |
|---|---|
| Operating system | Linux with systemd running (the installer checks /run/systemd/system, not just that systemctl exists), or macOS. |
| Processor | amd64 (x86_64) or arm64 (aarch64). |
| Access | Root, through sudo. |
| Tools | curl, sha256sum (or shasum on macOS), gzip, uname, and install or cp with chmod. The installer is plain POSIX sh, so it runs where only dash or BusyBox ash exists. |
| Network | Outbound HTTPS to app.basepit.com. No inbound port, no VPN. |
| For container apps | Docker on the host. RHEL-family servers can use Podman instead, which BasePit can set up for you. |
What each area needs
| Area | Needs |
|---|---|
| Hosts, apps, logs, monitors | The agent on any supported machine. |
| Host insight and host actions | --allow-host-control. On a Mac, host insight shows servers, processes and GPUs only. |
| VMs on your hosts | A Linux host with --allow-host-control and Docker. Linux VMs and Windows VMs also need KVM (/dev/kvm), and Windows needs an x86-64 host with 30 GB free. |
| Cloud machines | Your own DigitalOcean, Hetzner, AWS, Google Cloud or Azure account, connected under Sources. Nothing to install: each machine joins by itself. |
| AI coding agents | A Linux host with --allow-host-control. |
| Ansible playbooks | A Linux host with --allow-automation, which runs them for itself and for machines without the agent. |
| Kubernetes and OpenShift | A cluster where kubectl and helm already point. You connect it with two lines the console gives you, from a Helm chart or plain YAML. |
| RHEL area | RHEL, Rocky Linux or AlmaLinux 9 or 10, with the same install line. |
| Proxmox area | Proxmox VE 8.4 or later, with the agent on each node, using the same install line. |
Install the agent
- Sign in at app.basepit.com, open Hosts and choose Enrol a host.
- Name the host. The console shows a line with a token in it. The token works once, expires in an hour, and is shown only this once.
- Paste the line into the machine as a user with
sudo:
$ curl -fsSL https://app.basepit.com/install.sh | sudo sh -s -- --token <TOKEN>
A successful run looks like this. The four checks at the top run before anything is written:
basepit installer
✓ root uid 0
✓ platform linux / arm64 · Ubuntu 24.04 · systemd 255
✓ controller reachable https://app.basepit.com (42 ms)
✓ agent 1.4.0 15.8 MB · sha256 verified
→ enrolling as web-03
→ installing /usr/local/bin/basepit-agent
→ writing /etc/basepit/agent.env
→ installing basepit-agent.service
→ starting
✓ web-03 is online connected in 2.1 s
Logs journalctl -u basepit-agent -f
Uninstall sudo sh /etc/basepit/uninstall-agent.sh
The figures above are an example. The is online line is printed only once the machine has actually connected, and at the same moment the host turns green in the console.
Install flags
| Flag | What it does |
|---|---|
--token <TOKEN> | The one-time token from the console. Needed for a new machine; an upgrade needs none. |
--token-file <path> | Reads the token from a file and removes the file before doing anything else. Use it in scripts, so the token is never in a process's arguments. |
--location <label> | The location label this host checks monitors from. The default is local, and it is kept across re-runs. |
--dry-run | Prints every step and writes nothing. |
--no-wait | Returns without waiting for the machine to connect. |
--uninstall | Removes the agent. It never asks for confirmation, because the installer has no keyboard to read from. |
--allow-terminal, --allow-host-control, --allow-automation, --allow-builds, --allow-tasks, --allow-openshift-install | Extras only the machine's owner can switch on. What each allows, and its limits: Security. |
Many machines at once
For machines you create with automation, make an enrol key in Hosts. One key enrols many machines, and each joins as a host named by its own hostname. The console gives you ready-to-use snippets for cloud-init, Ansible and Terraform. The cloud-init one looks like this:
#cloud-config
# BasePit: this machine joins BasePit at its first boot.
# Each machine needs its own hostname: it becomes the machine's name in BasePit.
# Revoke the enrol key in BasePit once your machines have joined: cloud-init keeps a copy of this file.
hostname: web-01
write_files:
- path: /root/.basepit-key
permissions: '0600'
content: 'PASTE-YOUR-ENROL-KEY'
runcmd:
- [sh, -c, 'curl -fsSL https://app.basepit.com/install.sh | sh -s -- --token-file /root/.basepit-key']
The key goes through a file, never on a command line. Revoke the key once your machines have joined. For cloud machines that BasePit makes for you in your own account, there is nothing to paste at all.
Your first ten minutes
- Create your account. Choose Just me or An organisation, and confirm your email. You can also sign in with Google or Slack. No card is asked for: every month the account gets 70 free credits, one server and twenty monitors, and it starts with 300 more. Pricing.
- Enrol a host with the line above, and watch it turn green.
- New app. Pick what you are deploying: a container image, a command you already run, a file (a JAR or a saved image), a script on the host, or a compose file. Or start from the catalogue. Choose where it runs, set it up, and read the last step: it shows exactly what will happen, including the command BasePit will run. Nothing runs until that step.
- New monitor. Say what to watch, from where, how often, and who should know when it goes down. The last step runs the first check in front of you.
- Add a channel under Alerts, so a page has somewhere to go. Slack, through an incoming webhook, is the usual first.
- Invite your team from People & access (in an organisation), and give each person a role: Viewer, Operator or Admin.
Containers already on a host can be adopted, and BasePit runs them from then on. You do not have to redeploy anything to start watching it.
A job that checks in
For a backup or any cron job, create a heartbeat monitor. Its last step shows a token once, in full, inside the line to add to the job:
# one crontab line
0 2 * * * /usr/local/bin/backup.sh && curl -fsS https://app.basepit.com/h/<TOKEN>
BasePit expects the call on the schedule you set, allows a grace period, and then marks the job late, then down. The job can also report /start and /fail. If a token is ever exposed, Regenerate makes a new one and the old one stops working at once.
Upgrade and uninstall
- Upgrade from the console, for one host or every out-of-date one. If the new agent does not connect, the old one is put back by itself. Running the install line again without a token also upgrades, and changes nothing else.
- Uninstall with the script the installer left on the machine. It needs no network:
sudo sh /etc/basepit/uninstall-agent.sh # the agent
sudo sh /etc/basepit/uninstall.sh # every BasePit program on this machine
It removes the machine's secret with the rest. Then revoke the host in the console, so its record is sent nothing.
If something goes wrong
- "Nothing was installed" means exactly that: a check failed before anything was written. The line above it says which check, and how to fix it.
- A token refused as not valid on a second run usually means the first run already worked: tokens work once. Look for the host in the console.
- Not sure what it will do? Add
--dry-runto print every step without writing anything. - The agent's own log is in the journal:
journalctl -u basepit-agent -f.