Connect the app

Adding a server is one screen: an address, a port if it is not 22, and an account for the first connection. Nothing else is asked, and nothing is installed yet.

The first connection

The app opens an SSH session as the account you gave — root, or a user with sudo. It uses that account to place the key it generated for this server, run the probe and install. Once the hardening has created dev and checked that the key opens it, the app connects as dev and never needs the first account again. It is the same key you can hand to your own tools: see your key.

The probe

The probe reads the machine and reports:

• the distribution and its version, the architecture, the kernel;
• RAM, swap, disk, and how much of each is free;
• what is already installed among the things the catalogue knows about;
• whether SSH is reachable, whether a firewall is running, whether root can still log in.

It writes nothing. A machine that fails the probe is not touched.

What it refuses

Pupitre says no clearly, rather than half-installing:

• a distribution that is not Ubuntu 22.04 or 24.04;
• less RAM than the modules you selected need;
• an architecture a module does not support;
• a service already installed by other means that a module would have to take over.

Every refusal names the reason and, when there is one, the command that fixes it.

Nothing connects inward

Neither the platform nor support ever connects to your machine. The agent reaches out over HTTPS for its licence, for public keys, and for its own updates; the app reaches the server over SSH from your computer.

Once the server is hardened, the firewall lets in SSH, on 22 and also on 443 if you choose SSH over 443. Installing exposure.caddy opens 80 and 443 for the web, and exposure.tailscale lets in your own tailnet. Nothing else is open. See security.